By Vikas Jain
Cloud computing has become an integral part of all IT decision making today across industries and geographies. This market is growing at a rapid pace. By 2014, IDC expects public cloud spending to rise to $29.5 billion growing at 21.6% per year. At the same time, Forrester predicts the cloud security market to grow to $1.5 billion by 2015. This is good news, yet there are many CIOs sitting on the fence and not jumping on the opportunity cloud computing presents as they worry about security of data and applications. The figure below lists survey results by TechTarget from top CIOs when asked about their top-of-mind concern for using cloud services.
.JPG)
Loss of control, compliance implications, and confidentiality and auditing topped the results. Under these three themes, the issues they listed are:
- They find it hard to trust cloud provider's security model
- Manage proliferation of user accounts across cloud application providers
- Extended enterprise boundary complicates compliance
- Shared infrastructure – if the cloud gets hacked so do you
- Audit log silos on proprietary cloud platforms
This blog post lists a potential solution to address these issues and more.
Security Layers
First, lets look at the various layers that are required to secure cloud applications and data.
You need to protect applications and data for assurance and compliance, access control, and defend against malicious attacks at the perimeter. Yet, the weakest link remains the client as malware and phishing attacks can send requests as if it were coming from a human user. To achieve end-to-end security, you need to look holistically at how to provide “trusted client to cloud access”. You can watch a webinar on this topic I recently did with security expert Gunnar Peterson.
Solution
One solution to this problem is to have a trusted broker that provides the glue between client security and cloud security. It should be able to determine if cloud applications are being accessed from trusted and attested client devices or not, and block access from all non-trusted clients. One way to get client attestation is through Intel Identity Protection Technology (IPT) which embeds 2nd factor authentication in the processor itself.
While a trusted broker enforces above check it should also be able to provide supplemental security on top of what cloud applications provide by offering:
- Federated Single Sign-On (SSO) using industry standards such as SAML, OAUTH and OpenID
- 2 factor strong authentication with convenient soft OTP token support
- Elevated authentication (term to represent step-up authentication on a per request basis, coined by Mark Diodati of Burton group in his latest report on Authentication Decision Point Reference Architecture)
- Automated account provisioning and deprovisioning with automated identity attribute synchronization to ensure that all identity attributes across enterprise and cloud applications never go out-of-sync
- Centralized audit repository with common audit record across cloud applications
- Orphan account reporting to catch unauthorized account creation by administrators in cloud applications
- And, a single dashboard to get 360 degree visibility on how cloud applications are being accessed by users (aka user activity monitoring)
Industry initiatives
Cloud Security Alliance (CSA) is working feverishly to provide awareness and guidance with reference implementations to address some of the security concerns listed earlier in this blog post. At the CSA summit 2011 held at RSA conference 2011, I presented a roadmap for Trusted Cloud Initiative (TCI) which is one of the sub groups of CSA. In it’s reference architecture, TCI lists the following use cases for trusted access to the cloud.
TCI also published a whitepaper covering identity and access control for cloud applications.
Summary
While cloud application providers continue to enhance their security posture, it’s in the best interest of enterprises to supplement it with additional security controls using technologies such as “Trusted Broker” that enable end-to-end secure client to cloud access and provide 360 degree visibility and compliance into how various cloud applications are being accessed by enterprise users. One such implementation of a “Trusted Broker” is provided by Intel Expressway Cloud Access 360 product. Visit http://www.dynamicperimeter.com to learn more.
Vikas Jain, director of product management for Application Security and Identity Products with Intel Corporation, has over 16 years of experience in the software and services market, with particular expertise in cloud security, identity and access management, and application architecture. Prior to joining Intel, Jain has held leadership roles in product management and software development at a wide-range of technology companies including Oracle, Oblix, Wipro and Infosys.You can follow him on twitter @ VikasJainTweet