In cloud computing, understanding the security boundary is crucial for effectively discussing and implementing security measures. The specific cloud computing model being used helps define the built-in security features, identify the parties responsible for security mechanisms, and establish the boundary between the service provider's and customer's responsibilities.
The most commonly used model, based on the U.S. National Institute of Standards and Technology (NIST), separates deployment models from service models and assigns a set of service attributes to each. Deployment models include community, hybrid, private, and public clouds, while service models follow the SPI (Software, Platform, Infrastructure) model, encompassing Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS). NIST's model does not mandate the use of virtualization or multi-tenancy, but these factors significantly impact security in cloud computing.
The Cloud Security Alliance (CSA) also provides a cloud computing stack model, which depicts the relationship between different functional units in a network stack. This model helps separate the various service models from each other. CSA is an industry working group focused on studying security issues in cloud computing and providing recommendations to its members. They divide their guidance into operational domains, including governance and enterprise risk management, legal and electronic discovery, compliance and audit, information lifecycle management, portability and interoperability, traditional security, business continuity, and disaster recovery, datacenter operations, incidence response, notification, and remediation, application security, encryption and key management, identity and access management, and virtualization.
One notable difference between the NIST model and CSA's approach is that CSA considers multi-tenancy to be an essential element in cloud computing. Multi-tenancy brings additional security concerns that must be addressed. Cloud service providers need to ensure customer isolation, data segmentation, and accurate service accounting. This is achieved through policy-based environments supporting various levels and qualities of service, often with different pricing models. Multi-tenancy manifests differently in each cloud deployment model, introducing specific security considerations in different areas.
Comments