The CSA guide is a comprehensive effort to list the security risks brought by cloud computing. A good overview but there are security requirements that are spread among several domains. Two such examples are confidentiality and integrity. Moreover, these requirements need to be fulfilled in different situations. For example data integrity in transit and at rest.
Let’s start by focusing on confidentiality and integrity of communications. We have to deal with confidentiality and integrity of communications in several scenarios:
- Communication from the internet to the cloud
- Communication between the internal network and the cloud
- Communication between applications within the cloud (an interesting example is between amazon EC2 and S3)
- Communication between clouds
With PaaS and SaaS, we may use SSL. In IaaS the solution to provide you full access to your cloud network is a VPN.
The requirements for a cloud VPN in all scenarios are as follows:
Clientless: The need to deploy agents should be avoided when possible. The use of standards like IPSec which is supported by security gateways or existing operating systems solves this problem as well.
Centralized management: Modifications on the configuration of servers or clients should not imply a re-deployment.
Authentication and authorization features : The solution should support different authentication methods and it should allow to specify access control lists as well (role based or RBAC).
Integration with endpoint security: The VPN should integrate with endpoint security solutions.
Advanced logging and reporting: At a given moment it should be possible to know who is or was connected and what kind of operations are or were performed.
Support of different communication methods and devices: Legacy applications, some windows applications such as outlook, or applications that use multicast should be supported. On the top of that, several types of devices such as smart-phones need to be supported as well.
High availability: when a server is down, the clients must be able to connect to other available servers in a transparent way.
Static addressing: the number of static public IPs is limited, so it is practical to build a private IP infrastructure.
In a follow-up post we will focus on tools and the scenarios listed above.