Last week NIST released Special Publication (SP) 800-146, Cloud Computing Synopsis and Recommendations. Weighing in at 81 pages, this document is the follow-on to infamous SP 800-145 that defines what a cloud is but goes further by defining its “characteristics.” It goes on to discuss issues with typical commercial terms of service (big, big, big problem here) as well as an introduction to general cloud environments (e.g., on-site vs outsourced and public vs private vs community). Next, 800-146 highlights several classes of clouds that include the norm we’ve seen over the years.
- Software-as-a-Service
- Platform-as-a-Service
- Infrastructure-as-a-Service
SP 800-146 saves the worse for last … detailing 23 “open issues” that require further analysis. These issues were grouped into five categories as outlined below.
- Computing Performance (Latency, Off-line Data Synchronization, Scalable Programming, Data Storage Management)
- Cloud Reliability (Network Dependence, Cloud Provider Outages, Safety-Critical Processing)
- Economic Goals (Risk of Business Continuity, Service Agreement Evaluation, Portability of Workloads, Interoperability between Cloud Providers, Disaster Recovery)
- Compliance (Lack of Visibility, Physical Data Location, Jurisdiction and Regulation, Support for Forensics)
- Information Security (Risk of Unintended Data Disclosure, Data Privacy, System Integrity, Multi-tenancy, Browsers, Hardware Support for Trust, Key Management)
So what’s this all have to do with security? Well as you see above, one of the five categories is Information Security but keep in mind that it’s crucial to many of the other areas as well. Overall, we don’t see anything new in SP 800-146 but it appears to be NIST’s best attempt to capture the industry’s current accepted understanding.
via FierceGovernmentIT.com
A new publication from the National Institute of Standards and Technology summarizes major classes of cloud computing technology and their benefits, but also notes 23 “open issues” regarding the cloud computing technology overall.
Some of the issues highlighted in NIST Special Publication 800-146 (.pdf) “are traditional distributed computing topics that have remained open for decades” but have become more relevant since the emergence of cloud computing. “Other issues appear to be unique to cloud computing,” says the document.
Continued here.
#####
Please let us know what you think. Today’s post image is from FrustrationFreeIt.com.