The 7 most common challenges to cloud computing Pt. I

Earlier this month the Government Accountability Office (GAO) released the results of their study on the Office of Management and Budget’s (OMB) Cloud First policy. The GAO assessed the progress selected agencies made and identified challenges they are facing in implementing the policy.

In response to the findings, Shamun Mahmud, DLT Cloud Advisory Group team member and a contributor to NIST Cloud Computing Working Groups shares some additional thoughts on the seven implementation challenges identified in the study. In the first of a three-part series, Mahmud tackles the first of the challenges. The remaining six will be covered in two upcoming posts.

• Meeting federal security requirements: Cloud vendors may not be familiar with security requirements that are unique to government agencies, such as continuous monitoring and maintaining an inventory of systems. For example, State [Department] officials described their ability to monitor their systems in real time, which they said cloud service providers were unable to match. [U.S.] Treasury officials also explained that the Federal Information Security Management Act’s requirement of maintaining a physical inventory is challenging in a cloud environment because the agency does not have insight into the provider’s infrastructure and assets.

As a review, FedRAMP (Federal Risk and Authorization Management Program) serves as the primary program for federal acquisition of cloud computing services.  In order to sell Cloud services, a Cloud Service Provider (CSP) must become FedRAMP authorized.  Risk management is a fundamental challenge and must be addressed appropriately for an agency to successfully complete its mission.  FedRAMP is designed to streamline agencies’ efforts expended on all phases of risk management.

Information security continuous monitoring is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions.

NIST SP 800-37 identifies the following as elements essential to a successful organization-wide continuous monitoring program:

• Configuration management and change control – develop processes for organizational information systems, throughout their SDLCs, and with consideration of their operating environments and their role(s) in supporting the organization’s missions and core business processes

• Security impact analyses – develop security impact analysis and conduct analyses to monitor for changes to organizational information systems and their environments of operation for any adverse security impact to systems, mission/business and/or organizational functions which said systems support

• Ongoing assessment of system security controls – assessment frequencies based on an organization-wide continuous monitoring strategy and individual system authorization strategies

• Security status monitoring and reporting – communicate accurate and up-to-date security-related information to support ongoing management of information security risks and to enable data-driven risk mitigation decisions with minimal response times and acceptable data latencies

• Active involvement of organizational officials

FedRAMP PMO requires that Third Party Assessment Organizations transparently audit the security controls (including continuous monitoring) as implemented by CSPs.  CSPs must leverage the information readily found in the Program Management (PM) family of security controls (see NIST SP 800-53r3).  The PM controls are a special type of common controls that are implemented at Tier 2 and are uniquely important to a continuous monitoring strategy.  The associated metrics provide insight into the ongoing effectiveness of the security program, thus supporting risk management decisions. Consequently, Tier 1 has a role in determining these controls.

NOTE: Tier 1- Risk management activities address high-level information security governance policy as it relates to risk to the organization as a whole, to its core missions, and to its business functions.  Tier 2- Organizational officials that are accountable for one or more missions or business processes are also responsible for overseeing the associated risk management activities for those processes.

On the subject of asset inventory, organizations must first establish information owners and asset owners, deciding and documenting which organizations and individuals are responsible for each component of information and each device. In particular, when effective organizations acquire new systems, they record the owner and features of each new asset, including its network interface media access control (MAC) address, a unique identifier hard-coded into most network interface cards and devices. This mapping of asset attributes and owner-to-MAC address can be stored in a free or commercial database management system.  Thus, it is not the asset inventory, but the actual mapping to (system) owners is important to establishing baselines within the construct of configuration management (CM). CM is the 800-53r3 family (name) of security controls that most directly addresses asset inventory.

In the past, the first step towards improving a FISMA compliance rating was to make an IT asset inventory that stored all hardware and software assets in a database.  Given the abstractional nature of Cloud computing, physical inventories of IT assets will be admittedly difficult (to manage/ interact with?).  With FedRAMP, logical assets (aka ‘systems’) shall get mapped back to their respective owners.  Let’s get some historical perspective.

There was a somewhat limited amount of attack vectors in the datacenter.  That is the good news.  Unfortunately, there also were (still are) less resources in the form of an IT security team.  As a numerical example:  Many agencies have less than 10 personnel devoted to IT security on a full-time basis.  They are stretched thinly, spending 80% of their time on hygiene issues like patching and updates.  Whereas, some of the larger CSPs employ over 100 folks exclusively dedicated to security.  Simply put, there is a more coordinated security effort provided by CSPs.

Physical inventories are a requirement long based upon datacenter-oriented perspectives. That perspective, whilst prevalent, shall evolve. Some folks, including me, would argue that Cloud Computing is actually more secure than premises-based computing.

Cloud computing is a paradigm shift in IT resourcing.  Yes, there will be bumps along the road to Cloud adoption. We can liken it to when society switched from horse and buggy to automobiles.  It wasn’t a perfect transition, but it was necessary for the betterment of society.

Furthermore, the FedRAMP initiative requires that 3PAOs transparently audit the security controls (including asset inventory) as implemented by CSPs.  CSPs must leverage the information readily found in Configuration Management (CM) family of security controls (see NIST SP 800-53r3), prior to receiving FedRAMP ATOs.

Parts two and three will post over the next few days. In the meantime, check out Shamun’s whitepaper on The Benefits of FedRamp.

H/T Network World

Images courtesy of Cloud Tweaks, Tech Progress

Share this article!