Who Moved My Cloud

by Allen Allison, Chief Security Officer at NaviSite (www.navisite.com)

Managed cloud services are quickly being adopted by large enterprises. Organizations are increasingly embracing cloud technologies for core services like financial systems, IT infrastructure, online merchant sites, and messaging solutions. This adoption rate is creating an ever-increasing role for audit and compliance in the cloud.

Before cloud computing gave IT environments elasticity, flexibility, and transportability, it was relatively simple to provide the regulatory compliance. Prior to the cloud, an organization was able to isolate all of the devices, operating systems, and applications on which sensitive or regulated data could reside, and the auditors had an easy task of auditing the security controls and verifying policies, procedures and processes for isolated environments. However, as the industry began to adopt more flexible solutions such as cloud, it became more difficult to contain environments for auditors to provide the same review without requiring a significantly higher level of work. While a managed cloud services company may deploy like policies and security solutions for cloud computing as would be in a traditional IT environment, proof of those same controls grows more difficult to demonstrate to the satisfaction of the auditors.

For example, if an organization had a virtualized environment that had well-defined boundaries or security zones, and even during a failover or disaster recovery all events, logs, and incidents were easily tracked and verified, it took little effort for an auditor to review and provide the assurance of compliance for the environment.

Cloud changes this game a bit, with its ability to move environments dynamically, without human intervention. This move could be within a single data center, but is often from data center to data center, from coast to coast, or even from continent to continent. This flexibility, while often necessary to support business needs, introduces a level of complexity that many auditors have had difficulty with. When the auditor can’t pin down the environment, how can she or he assess its compliance?

But there are a number of cloud providers who have been working to overcome these challenges in conjunction with their auditors. For example, SAS70 (soon to be SSAE16) has been especially difficult for auditors to assess in cloud environments. Depending on the controls, SAS70 will likely have the requirement of aggregating the review of physical access to the facility, at-console access to systems, and logical access to the environment. To add to the complexity, there may be differing controls for the application that provides the user interface from the application being presented to the end users. Furthermore, the controls in place may incorporate role-based access controls with built-in work flow for provisioning and approvals. This has provided for a very complicated system of buttons and levers to assess. However, by providing a common platform for the audit trails and logs, managed cloud providers are simplifying the work for the assessor and allowing for the aggregation and correlation of those events into a simplified platform.

In addition to the aggregation of these access events, following are additional controls that cloud service providers are incorporating in order to provide the common manageability of and the ability to audit a cloud platform:

Security Event Correlation – By incorporating industry leading Security Incident and Event Management (SIEM) solutions, more cloud providers are able to aggregate the logs from multiple platforms, multiple customer-specific and customer-shared devices, and multiple data centers into a centralized security management solution that can provide an easy to review aggregation point of all related security events.

Centralized Authentication – Providing a single authority for authentication and authorization, while centralizing all accounting, is a significant step to providing the proof of access and attempted access to an auditor. This authentication, authorization, and accounting (AAA) is a critical aspect of audit and verification of access to key systems housing data or intellectual property.

Data Replication – A growing requirement for organizations moving to cloud is the seamless failover and recovery of applications in the event of an outage. While we have always enjoyed highly available, fault-tolerant systems, the gating factor has always been the integrity and currency of the backend data. In order to provide the assurance that the data in all systems, and all data centers is consistent, data replication solutions are often deployed to guarantee the low Recovery Point Objective (RPO) often required in a Disaster Recovery solution. These may require high bandwidth, low latency backend solutions to deliver the infrastructure to support such replication, and most globally diverse managed cloud service providers deliver these networks across their infrastructure.

Common Monitoring and Management Solutions – A single pane of glass is often required to provide a unified look of the entire infrastructure. This will provide an auditor the ability to verify the provider is delivering the level of service guaranteed by the solution. Auditors often look for event handling and common management across all systems. By automating the deployment of such monitoring solutions, and relying on a common platform for the management (including patch management, software revision control, and system lockdown procedures) a level of assurance can be provided to the auditor that all systems are uniform and follow the controls of the monitoring and management criteria.

As the adoption of cloud accelerates, there will be added requirements for auditors to understand these ever-changing, elastic environments, and to be able to provide the same compliance and accreditation that they have historically provided for more static, pre-defined solutions in the past. These requirements are increasing at a significant pace, and the industry relies heavily on managed cloud service providers to guide the auditors through these more difficult assessments.

Allen Allison, Chief Security Officer at NaviSite (www.navisite.com)

During his 20+ year career in the information security industry, Allen Allison has served in management and technical roles, including the development of NaviSite’s industry-leading cloud computing platform; chief engineer and developer for a market-leading managed security operations center; and lead auditor and assessor for information security programs in the healthcare, government, e-commerce, and financial industries. With experience in the fields of systems programming; network infrastructure design and deployment; and information security, Allison has earned the highest industry certifications, including CCIE, CCSP, CISSP, MCSE, CCSE, and INFOSEC Professional. A graduate of the University of California, Irvine, Allison has lectured at colleges and universities on the subject of information security and regulatory compliance.