Cloud Security Alliance Working Toward Cloud-Specific Certifications

The Cloud Security Alliance (CSA) is working with other key players in cloud security and auditing to determine which organizations should provide the certification, as well as what such a certification should include. Certification is likely to be managed by multiple bodies.

[The CSA�s] research identifies the vulnerabilities that threaten to hinder cloud service offerings from reaching their full potential. For example, companies must be aware of �abuse and nefarious use of cloud computing,� which includes exploits such as the Zeus botnet and InfoStealing trojan horses, malicious software that has proven especially effective in compromising sensitive private resources in cloud environments. However, not all of the threats in this category are rooted in malicious intent. As the social Web evolves, more sites are relying on application programming interfaces (APIs), a set of operations that enable interaction between software programs, to present data from disparate sources. Sites that rely on multiple APIs often suffer from the �weakest link security� in which one insecure API can adversely affect a larger set of participants. Together, these threats comprise a combination of existing vulnerabilities that are magnified in severity in cloud environments as well as new, cloud-specific techniques that put data and systems at risk. Additional threats outlined in the research include:

� Malicious Insiders
� Shared Technology Vulnerabilities
� Data Loss/Leakage
� Account/Service and Traffic Hijacking

Source: http://www.hp.com/hpinfo/newsroom/press/2010/100301b.html

The entire cloud model of computing as a utility and its dynamic characteristics makes this a whole new ballgame for certification. Jim Reavis, CSA�s Co-founder and Executive Director, quoted in Dark Reading, says, �[Cloud computing] brings everything into question: where the machines are, what is the nature of data. If data is encrypted on the public cloud providers� [systems] and the key held by a separate cloud [provider]�is that even data? There�s some rethinking we need to do.�

In the same article, Bret Hartman, chief technology officer at the RSA, states that an enterprise�s own security controls and their cloud security provider�s controls must go hand in hand as well. �It�s complicated with cloud computing because there are multiple parties involved,� Hartman says. �I think it�s time for us to think about what a cloud certification would be ... and there would be different levels of certification required,� Hartman says. �It would be different than SAS 70.�

Source of Information : Implementing and Developing Cloud Computing Applications 2011

SysTrust Certification

SysTrust certification was developed jointly by the American Institute of Certified Public Accountants (AICPA) and the Canadian Institute of Chartered Accountants (CICA).

A SysTrust engagement is performed by a licensed CPA to evaluate a system�s reliability as measured against the SysTrust principles and criteria. The CPA performs tests to determine whether the system was available for operation and use at times set forth in service level statements or agreements. If the system meets the requirements of the Trust Services Principles and Criteria, an unqualified attestation report is issued.

Source: https://www-935.ibm.com/services/us/index.wss/summary/iss/a1029093

Trust Services are defined as:

A set of professional assurance and advisory services based on a common framework (i.e., a core set of principles and criteria) to address the risks and opportunities of IT.9

The objective in developing Trust Services was to establish a core set of principles and related criteria for key areas related to IT, e-commerce, ebusiness, and systems, all of which form the measurement basis for the delivery of the related service(s).

The SysTrust seal indicates that this core set of principles have been examined by an independent auditing firm in conformity with the rigorous AICPA and CICA Trust Services Principles & Criteria. The certification attests that:

� The system was available for operation and use at times set forth in service-level statements or agreements

� The system was protected against unauthorized physical and logical access

� Information designated as confidential was protected as committed or agreed

Source: https://www-935.ibm.com/services/us/index.wss/summary/iss/a1029093

Source of Information : Implementing and Developing Cloud Computing Applications 2011

SAS 70 and Cloud Computing

Increasingly, vendors point to SAS 70 and ISO 27001 certifications as evidence of their security credentials.

Vendor Security Credentials
� Google
�Asked to flash its cloud security credentials at an industry forum, Google pointed to its SAS 70 certification, giving more support to that set of standards as a measure of how well cloud providers lock down customer data. �We need to prove we are secure,� says Rajen Sheth, the product manager at Google who came up with Google Apps, speaking at a panel on cloud services at the Enterprise 2.0 conference in Boston.*�

� Microsoft
Microsoft announced that it recently gained SAS 70 Type I and Type II attestations and ISO/IEC 27001:2005 certification.

� Amazon
Amazon Web Services (AWS) has successfully completed SAS 70 Type II Audit from independent auditors, and has stated that it will continue to obtain the appropriate security certifications and accreditations to demonstrate the security of our infrastructure and services. An overview of Security Processes applicable to Amazon Web Services is available at http://awsmedia.s3.amazonaws.com/pdf/AWS_Security_Whitepaper.pdf.

� Rackspace
Rackspace has achieved ISO/IEC 27001, ISO 17799, SAS 70 Type II audit process, Microsoft Gold Partner, Gartner Leader, Dell Partner, and Cisco Powered Network Certification.

� Salesforce.com and Force.com
Salesforce.com and Force.com are SAS 70 Type 2, SysTrust, and ISO 27001 compliant.

� ServePath
In addition to SAS 70 and ISO 27001 certifications, Serve-Path has a particularly rigorous service level agreement (SLA), which they call 10,000% Guaranteed�. It states:

For every minute ServePath fails to deliver, we will provide you with 100 minutes of service credit.

� The SLA covers the following elements of service:
� Network performance
� Hardware replacement (within 60 minutes)
� Support response time (30 minutes for server down, packet loss, or routing issues)
� Domain name services
� Power availability and performance
� Cooling and environment
� Server power cycling
� Physical security
� 24 x 365 onsite engineering

However, no credit will exceed one hundred percent (100%) of Customer�s fees for the service feature in question for the then-current billing month. Details of the SLA are available at http://servpath.com/pdfs/ServePathSLA.pdf

� Unisys
The Unisys Secure Cloud Solution allows balancing workloads across a global network of Unisys data centers, which are certified to key international standards such as ISO/IEC 27001:2005 for security, ISO/IEC 20000 for service management and the SAS 70 Type II auditing standard.

� Verizon
Verizon announced that it had successfully completed the first annual SAS 70 Type II examination of controls for its cloud computing data centers.

� IBM
IBM offers customers Security Assessment services. Of course, its own cloud offerings are fully compliant.

Source of Information : Implementing and Developing Cloud Computing Applications 2011

SAS 70 (Statement on Auditing Standards No. 70): Service Organizations

The Statement on Auditing Standards No. 70, commonly known as SAS 70, is an auditing statement put forth by the Auditing Standards Board as designated by the American Institute of Certified Public Accountants (AICPA). Over the years, more than 110 �SAS� have been issued, ranging on a number of critical subjects for auditing matters.

Source: http://www.sas70.us.com/what-is/history-and-overview.php

SAS 70 is part of the AU Section 324 Codification of Auditing Standards, which is used to report on controls placed in operation and the testing of the operating effectiveness of those controls. Put simply, it�s a widely used compliance audit for assessing the internal control framework on service organizations that provide critical outsourcing activities for other entities. Introduced in 1992, SAS 70 audits were used in the early and mid-1990s. They still are used for very traditional standards, such as evaluating a service organization�s services if those services are part of the user organization�s information system:

For example, if the ABC company used the XYZ company, which is a service organization, to perform and conduct transactions and procedures that are considered significant to the ABC company�s �information system� or business environment, then the XYZ service organization would need to be SAS 70 compliant.

Source: http://www.sas70.us.com/what-is/history-and-overview.php

Think of it as an audit that examines and tests the characteristics of internal controls for service organizations. Service organizations are the entities that undergo the SAS 70 audit. Who requires the audit to be done and why? Generally speaking, compliance legislation in recent years has revolved around corporate governance and the ability to have a strong mechanism of internal controls within organizations. Laws such as The Sarbanes-Oxley Act of 2002 (SOX), the Health Insurance Accountability and Portability Act (HIPAA), and the Gramm-Leach-Bliley Act (GLBA), have emphasized themes such as governance, privacy, security, confidentiality, and segregation of duties.

Source of Information : Implementing and Developing Cloud Computing Applications 2011

ISO 27001

ISO 27001 is an Information Security Management System (ISMS) standard published in October 2005 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Its full name is ISO/IEC 27001:2005 � Information technology -- Security techniques -- Information security management systems -- Requirements but it is commonly known as �ISO 27001�. Compliance with ISO 27001 requires that management:

� Systematically examine the organization�s information security risks, taking account of the threats, vulnerabilities and impacts;


� Design and implement a coherent and comprehensive suite of information security controls and/or other forms of risk treatment (such as risk avoidance or risk transfer) to address those risks that are deemed unacceptable; and

� Adopt an overarching management process to ensure that the information security controls continue to meet the organization�s information security needs on an ongoing basis.

Source: http://en.wikipedia.org/wiki/ISO/IEC_27001

ISO/IEC 27001 provides a model for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an information security management system (ISMS). The design and implementation of an ISMS is influenced by the organization�s needs and objectives, security requirements, processes, size, and structure.

An ISMS may be certified compliant with ISO/IEC 27001 by a number of accredited registrars worldwide, also called an Accredited Certification Body (CB). Certification against any of the recognized national variants of ISO/IEC 27001 (e.g., JIS Q 27001, the Japanese version) by an accredited certification body is functionally equivalent to certification against ISO/IEC 27001 itself. In the United States, accreditation is managed bu ANSI-ASQ National Accreditation Board.


The ISO/IEC 27001 certification, like other ISO management system certifications, usually involves a three-stage audit process:

� Stage 1 is a preliminary, informal review of the ISMS, for example, checking the existence and completeness of key documentation such as the organization�s information security policy, Statement of Applicability (SoA), and Risk Treatment Plan(RTP). This stage serves to familiarize the auditors with the organization and vice versa.

� Stage 2 is a more detailed and formal compliance audit, independently testing the ISMS against the requirements specified in ISO/IEC 27001. The auditors will seek evidence to confirm that the management system has been properly designed and implemented, and is in fact in operation (for example by confirming that a security committee or similar management body meets regularly to oversee the ISMS). Certification audits are usually conducted by ISO/IEC 27001 Lead Auditors. Passing this stage results in the ISMS being certified compliant with ISO/IEC 27001.

� Stage 3 involves follow-up reviews or audits to confirm that the organization remains in compliance with the standard. Certification maintenance requires periodic re-assessment audits to confirm that the ISMS continues to operate as specified and intended. These should happen at least annually but (by agreement with management) are often conducted more frequently, particularly while the ISMS is still maturing.

Source: http://en.wikipedia.org/wiki/ISO/IEC_27001

Source of Information : Implementing and Developing Cloud Computing Applications 2011

Recent VM Acquisitions

VMware has made several other acquisitions in 2010:

� Zimbra, a hosted e-mail service, acquired from Yahoo. The New York Times called it �the icing on the PaaS.�

� Parts of EMC�s Ionix IT management business, including solutions aimed at delivering improved management and deployment of servers and applications in a virtualized data center. This deal gives VMware some tools to measure and automate the provisioning and management of virtualized machines. Since a platform can have hundreds of thousands of VMs, automation is essential. VMware is acquiring from EMC, its parent, all technology and intellectual property of FastScale, Application Discovery Manager, Server Configuration Manager, and Service Manager and will maintain engineering, marketing, sales, and support operations in the United States, Europe, Israel, India, and Australia. (As part of the agreement, EMC will retain the Ionix brand and have full reseller rights to continue to offer customers the products acquired by VMware.) VMware says that this �new capability will provide a holistic view of configuration compliance of complete IT services from underlying physical assets to applications. VMware plans to further optimize the acquired products for dynamic, VMware vSphere-based cloud infrastructure, to deliver unparalleled visibility, control and simplicity of enterprise IT management.�

� Rabbit MQ, an open-source messaging protocol acquired by VMware�s SpringSource subsidiary. This acquisition �enables VMware to provide a messaging platform that is flexible enough to live on company servers, a platform or a private or public cloud computing environments� according to The New York Times. RabbitMQ is a successful and well-regarded technology that forms the backbone for many cloud messaging systems environments, providing a multi-protocol, completely open, portable messaging system. The code was created by Open Source vendors Cohesive FT16 and LShift based on the relatively young AMQP open standard for messaging middleware, an industry effort backed by major banks, Cisco, and a handful of smaller companies. As hardware is virtualized, translating some of the network equipment like load balancers into software allows services running on the virtualized hardware to better scale.

� Gemstone, which �provides a distributed data caching technology to help analyze and crunch data across a number of servers or in the cloud��something VMware can use to make sure its PaaS can handle data without bogging down� according to The New York Times.

� EngineYard? Maybe. As we go to press, EngineYard was also in talks to be acquired by VMware. EngineYard already works closely with VMware, because VMware provides its underlying software and is a strategic investor in Terremark, which hosts EngineYard�s enterprise-class PaaS.

Source of Information : Implementing and Developing Cloud Computing Applications 2011

Operating Systems Functionality

Proprietary systems vendors were, for a long time, considerably ahead of open systems in the level of functionality offered by their operating systems, especially in areas like the number of processors supported in SMP versions, robustness, availability, systems administration, and so forth. But over time, UNIX systems have caught up, and offer SMP, cluster support, and constantly-improving robustness and availability. This maturation of UNIX has thus significantly reduced any functionality advantage proprietary systems may now offer over UNIX (although that very process of maturation has drastically reduced the number of extant UNIX variants). In terms of functionality, we should see the same process happening between UNIX and Windows, as Windows gathers experience.

(There areonline masters degree programs in technology that can be helpbusinesses utilize the newest systems.)

There are five useful technical areas in which one may compare operating systems. We list them here, and then subsequently discuss them at greater length.

� Scalability. As already noted, this is a measure of the ability of a system to match the dimensions of a problem it must handle

� RAS�Reliability, Availability, and Serviceability. These characteristics drive the total availability of the servers and thus their capacity to support the uses for which they were acquired.

� Distributed services and Internet support. Here, we mean the integration of the basic elements that allow operation in a distributed system (these services are, properly speaking, middleware and do not form part of the operating system). Supporting basic Internet capabilities and supporting PC clients fall into this category.

� System management. By this we mean the complete collection of facilities� mainly software�that facilitate the management of the system. One may observe these facilities evolving towards some quasiautonomous decision-taking capabilities (so that the software can react without further human input), which should lead to lower cost of ownership.

� Capacity to simultaneously support various isolated workloads. Since a server is an expensive investment, systems managers are pushed into making each server support many different independent workloads simultaneously. The process of server consolidation, which is the act of reducing the number of (generally distributed) servers deployed in an enterprise to a smaller number of (probably co-located) servers, requires this capability. The management of several workloads according to a given policy (for instance, priority given to certain applications regarding the allocation of resources) is also called workload management. A system�s capability to be partitioned into several independent system to support, in complete isolation, different workloads is another approach to server consolidation. Dynamic partitioning capability (i.e., without stopping the complete system) is a key feature.

Source of Information : Elsevier Server Architectures 2005

Operating System Options and Installation Methods

An OS is installed on the computers' hard disk, inside an area called hard disk partition. There are several ways for installing a new operating system. The installation method is based on the system hardware and end-user requirements. Generally, you have four basic options for the installation of a new operating system:

Clean Installation

We can perform a clean installation on a new computer or in those cases where there is no upgrade path between the current operating system and the new one. This type of installation deletes all data on the hard disks partition where the current operating system is installed. A new PC requires, of course a clean installation. You can also do a clean install when the current operating system installation has corrupted files or does not work properly.

Upgrade Installation

Sometimes, it is also possible to perform an upgrade. When you perform an upgrade, OS configuration settings, installed programs and data are preserved. With this installation you have nothing to worry about, because you will not lose any personal data. You will just replace the old operating system files with the new, upgraded files. However, keep in mind that after the upgrade the applications and drivers that are incompatible with the new OS will not work as expected.

Multi-boot Installation

Another option is to install multiple operating systems on a single computer. You can install each OS inside a different disk partition and this way every OS will have its own files and configuration settings. On multi-boot installations, the users see a menu when they open their computers and they have to select the desired OS. Of course, only one operating system can run at a time.

Virtualization

This is relative new technique that is often used on servers. With virtualization we can run numerous copies of an operating system on a single set of hardware and create this way several virtual machines. Every single virtual machine works like a separate computer. This technology makes a single physical hardware resource to appear like multiple logical resources.

Before starting any operating system installation you have to make sure that all the hardware is certified to work with the new operating system. Also confirm that the hardware resources meet the minimum installation requirements. Moreover, when you perform an upgrade it is a very good practice to perform a virus scan before starting the installation and a complete full backup of all your personal data.

One method that helps you protect your data is this: Create multiple partitions on the hard disk and install a different OS on each partition. Then copy all your data inside an empty partition that does not contain an OS. This way you can upgrade the operating system without the risk of losing any data. Backup and recovery of data files is also easier with this design.

It is also important to decide the type of file system to use. The file system controls how the OS stores and tracks the files. There are several different file systems available. The most well-known are: FAT 32, NTFS, HPFS, ext2 and ext3. Every operating system is designed to use one or more of these file systems. There are advantages and disadvantages on every file system. Careful consideration should be made to the type of file systems supported by the selected OS and the benefits of each.

You can find several programs to modify the partitioning structure and file system of a hard drive after installation, but it is better to avoid them if possible. When modifying either the file system or partition structure on a hard drive, data loss may result. Careful planning can help preserve the integrity of the data.