CLOUD COMPUTING

Federal Initiatives Provide Cloud Security Guidance

Salvatore Salamone | Date: 01-18-12 | Comments

Two efforts aimed at improving the security of cloud services used by federal agencies provide guidelines for providers. As the provisions of those specifications are adopted, businesses will reap the benefits of improved security for their cloud services.

Security is often cited as a primary cause for concern when considering cloud deployments. To overcome these concerns, companies moving to public cloud services might look to some emerging standards for help.

The first source of help is an initiative from the Federal government called the Federal Risk and Authorization Management Program. This program, known by its acronym FedRAMP, establishes a baseline of security requirements for government contractors interested in providing the federal government with cloud services.

FedRAMP defines a set of minimum security controls cloud providers have to meet to work with the federal government. The guidelines also define an assessment process for authorizing those services and mandate the use of a continuous monitoring tool that all agencies apply to ensure compliance with the guidelines.

While FedRAMP only applies to government agencies, the thought is that, as has happened in the past, many providers will implement the necessary security features and practices to be in compliance. And this in turn will raise the level of security of those public clouds services for any company that uses them. Additionally, companies can look to the details of FedRAMP when developing their own security criteria for using cloud service providers.

A second source of help comes from the National Institute of Standards and Technology. NIST has developed a road map and a reference document about cloud architecture covering interoperability and security.

In developing this material, NIST applied past standards used for pre-cloud technologies, like Web services and the Internet. NIST identified several holes in current cloud standards, for example, in the area of privacy protection. It also created new standards specifically for cloud architectures.

As is the case with FedRAMP, the NIST work is designed to give federal agencies guidance on cloud security, but it will also be used by service providers to map their architectures to the one NIST developed. This will help ensure that providers who work with the federal government offer the security needed to make cloud computing safer. And this, in turn, will mean that businesses that use the same cloud service providers will benefit from this work.

For more details about these initiatives, take a look at these two articles:

eWEEK: "White House Sets Uniform Security Standard for Cloud Providers"

Smarter Technology: "NIST Releases New Federal Cloud Standards"