Cloud Computing and the
Federal Government:
Maximizing Trust
Supporting the Mission and Improving Assurance
Table of Contents
Executive Summary ...3
Introduction ...3
Step 1: Basic Trust ...4
Step 2. Limited Trust...4
Step 3. Shared Trust...5
Four Key Areas for Implementing Security in the Federal Cloud...5
Secure Cloud Storage ...6
Cloud Security for Endpoints ...7
Federated Access Control ...8
Virtual Encryption as a Service...9
SafeNet: Delivering the Trusted Cloud Platform... 10
Introduction—Overview of SafeNet Cloud Solutions ... 10
Cryptography as a Service... 10
Trusted Cloud Computing... 11
Conclusion ... 12
To Learn More about Cloud Security ... 12
Executive Summary
Cloud computing services can support nearly every mission the federal government performs – from defending our nation’s borders to protecting the environment. Offering an elastic, adaptive infrastructure, cloud computing enables federal agencies and their component organizations to share information and create services, improving how agencies support the federal mission and serve the American public. Just as the benefits are obvious, however, so too are the security concerns. When consolidating their infrastructures with cloud service providers, how do federal agencies ensure that sensitive data remains secure? How do they remain in control of their information assets and compliant with U.S. Office of Management and Budget (OMB) and agency-specific mandates and policies? Of equal importance is how the security concerns differ within the federal community. This white paper outlines the role of trust in different federal government communities, the path federal agencies can take to start building trust into cloud deployments, and the approaches and capabilities that these organizations need to make this transition a reality.
Introduction
The Obama Administration launched Apps.gov – a cloud computing storefront for federal agencies to leverage cloud-based services – in 2009, with the goal of increasing the scope of available services. The federal government’s move to cloud computing is not only underway; it is here to stay – with good reason. The cloud enables multiple agencies – or organizations within a single agency – to share information and create services by leveraging service-oriented computing technologies from the underlying Information Technology (IT) infrastructure. Migrating to a cloud infrastructure also allows for scalability to quickly add computing power and storage capacity to meet the demands created by
extraordinary events such as a national or manmade disaster. The list goes on.
Cloud computing raises some pretty vexing questions when it comes to security. Some challenges are shared by most federal agencies. How do federal agencies maintain control and ownership of sensitive, classified, or personally identifiable information (PII) when moving from a world where security mechanisms are focused on physical assets and data residing in a single community’s data centers to a world in which everything is virtualized and comingled? How can the federal government move into a cloud infrastructure while safeguarding the trust of the American people, federal employees, other inter-/intra-governmental organizations, and industry? Still other security questions may be raised about multi-tenant information sharing and the mission. For example, a cloud designed to promote intelligence sharing within the national security community will create a very different set of security challenges than a cloud designed to promote public engagement and transparency.
Today, issues of risk, information/data privacy, and compliance are the chief inhibitors to most federal agencies’ adoption of cloud services. In fact, a Gartner report cited data location risk, risk of data loss, and data security risk as three of the top five barriers to cloud adoption.1 Additionally, the risk of cross contamination of classified information (e.g.,
inappropriately sharing information among cloud tenants not cleared to read it) is a key concern for agencies with a national security-focused mission. Therefore, delivering cloud solutions that meet federal tenants’ mission requirements and enable cross-domain/agency information sharing is an invaluable asset. Understanding how to effectively safeguard data in the cloud, federal agencies can begin to fully maximize the potential of cloud offerings to enhance the efficiency of government operations, improve performance, and provide better service to the American people.
To get there, both the federal community and cloud providers must understand federal cloud deployments in terms of the security needed to support the mission, the differing levels of trust required by agencies within the federal
community, and when – if aligned with the mission – agencies can transition to the next level of trust. For example, agencies sharing information in support of national security missions will do so with a basic level of trust. Similarly, public-facing agencies with citizen-centric missions will incorporate solutions and processes that lead to limited and ultimately shared trust, making cloud security a true win-win for federal agencies and providers alike.
In the following pages, we’ll walk through these key differences and the potential for transition in more detail, and then show what this means for the federal government in the months and years ahead. Then, the document will outline some specific areas federal agencies can target in their efforts to optimize the security and utility of their cloud initiatives. Finally, we will outline some of the most important capabilities that federal organizations need to support these efforts. [Note: In the following pages, unless otherwise specified, when discussing the cloud, we will be referring to the public and hybrid clouds. While private clouds present their own specific security challenges, given their internal deployments, the nature of security will more closely resemble those of current data center deployments. It is the public and hybrid clouds, and the changing nature of the client and cloud service provider relationship, that are the focus of this document.]
Step 1: Basic Trust
For most federal agencies today, security in the cloud is viewed in a pretty straightforward way: don’t assume there is any. Federal organizations that have gone forward with cloud deployments have thus taken full ownership and responsibility for security. This can play out in several ways:
• An agency can segment its data into three classifications: classified, sensitive, and non-sensitive. Non-sensitive data can be transferred into the cloud as is; for example for disaster recovery or archival purposes. Classified and sensitive data, on the other hand, will either be kept out of the cloud entirely or it will be protected, generally through encryption, before it is exposed to the cloud. Further, that information will stay secured through those mechanisms the entire time it resides in the cloud, shared only through cross-domain solutions that ensure only users with the appropriate levels of trust are able to access it. This approach is utilized by federal cloud environments that support homeland and national security missions.
• A federal agency may opt to use Software as a (SaaS) offerings, but only for applications that do not involve PII or other types of data subject to federal regulation, mandates, or privacy laws.
• An agency can migrate the processing of non-sensitive applications to the cloud. For example, this can take the form of “cloud bursting”—an approach in which a federal organization will migrate an application to the cloud when the processing capacity of its cloud or data center is exceeded. This can be an effective way for federal organizations to handle the increased demands for processing that occur during extraordinary events, such as disaster response or launching a significant agency initiative. For example, an agency can adopt this approach for providing emergency information (i.e., data, video, audio, interactive tools, etc.) when its internal infrastructure hits capacity.
Each of these scenarios can present agencies with near-term benefits; they enable federal organizations to quickly leverage many of the benefits and strengths of cloud computing, without compromising security or compliance. These scenarios represent the bulk of cloud deployments done to date.
Step 2. Limited Trust
As the federal community becomes more fully invested in cloud offerings, and seeks to take greater advantage of the cloud’s benefits, agencies will increasingly embark upon initiatives to migrate their own security mechanisms to the cloud. This next step in the transition to a trusted cloud inherently will require more of an upfront investment than prior cloud approaches, and also require a deeper, more collaborative relationship with the cloud provider.
As agencies take their existing encryption solutions and run them in the cloud, they’ll retain full control over security ownership. At a high level, these deployments will be structured similarly to traditional hosting provider models. Specific deployment approaches can include the following:
• Deploying physical security systems in a virtual private cloud
• Running a virtual service within a hybrid, multi-tenant cloud environment
• Federating cloud user directories with internally managed identity and access management systems
Here, data protection can be conducted in the cloud, yet still within the federal enterprise’s control. As a result, the type of services that can be migrated to cloud platforms expands substantially, enabling agencies to perform more effectively in support of their agency missions. This transition will be particularly valuable to agencies that maintain sensitive or PII data and may support multiple missions by sharing the information among users with different levels of trust. For example, an agency may utilize cross-domain solutions to securely share data with trusted users in one organization but leverage service-oriented computing technologies to create a service-providing aggregate available for public
dissemination.
Step 3. Shared Trust
In this ultimate phase of the cloud’s evolution, cloud providers gain the controls they need to deliver trust as a service, so federal agencies can specify security policies and have confidence in the cloud provider’s infrastructure and capabilities for executing these policies. Here, the federal organization, as the information owner, still holds control over security, but in a virtual, rather than operational, way.
In this scenario, the federal agency sets security policies, and owns the core key materials, credentials, identities, and other elements that are used by the cloud providers to protect information, which gives them the final say over how security is handled. The cloud provider will have the sophisticated security infrastructure in place to meet the agency’s security objectives, including robust encryption, secure key management, granular access controls, and more.
The federal government can leverage the cloud and get the level of security essential to comply with OMB and agency-specific mandates, regulation, and security policies. As a result, virtually any service or application can subsequently be a potential candidate for migration to cloud services.
Four Key Areas for Implementing Security in the Federal Cloud
Without the right security in place, the move to cloud computing can be a disastrous one for any organization. This is particularly true in the federal government, which by its nature, is both a steward of the public trust and responsible for securing our nation’s homeland and global interests. Whether insufficient security results in a devastating national security breach, the compromise of PII, or a host of other scenarios, the impact of a poorly-secured cloud implementation is significant and certain, ranging from an increase in negative publicity, to inviting government investigations, or even placing American lives at risk of a terrorist attack.
With the right capabilities, however, federal agencies can ensure high levels of security in cloud deployments, providing previously unimagined opportunities to create and share information that strengthens our nation. What capabilities will be required in cloud environments and how do they differ from traditional approaches? The sections below outline some specific areas for applying security measures to cloud environments, and the capabilities required to undertake these
measures. With these initiatives, federal agencies can begin to gain the control, visibility, and efficiency they need to both ensure security and leverage the operational benefits of cloud services.
Secure Cloud Storage
Driven by a need to use the cloud’s elastic storage, without exposing data to the cloud’s vulnerabilities, federal agencies can do secure storage in the cloud, effectively using the cloud for the backup, disaster recovery, and archival of data. To do effective secure cloud storage, agencies need the following capabilities:
• Granular encryption. While a federal entity could simply encrypt all data as it is passed to the cloud, this could introduce a lot of unnecessary processing overhead, and add significant delays in data restoration. Consequently, the entity benefits by having granular encryption capabilities, ideally at the file level, so it can more selectively encrypt only the information that is sensitive.
• Robust access controls. In tandem with granular encryption, federal organizations need strong access control, including at the user level, to authorize which files or folders can be accessed, when, and by whom. • Group-based policies. To streamline implementation, agency information security teams need to be able to
enforce policies at the group level, so categories of users can be assured of getting appropriate access to sensitive data.
• Central management of remote systems. To make this approach practical, federal agencies need to be able to leverage centralized mechanisms for managing disparate systems, including centralized key and policy management.
Armed with these capabilities, federal enterprises can efficiently leverage many of the benefits of cloud services, while retaining effective security controls.
With this approach, sensitive data is encrypted the entire time it is housed in the cloud. While securing sensitive data in this way will address many fundamental security objectives, it will not address them all. For example, this approach would not address many of the compliance mandates that require the use of tamper-proof, FIPS-certified hardware security modules (HSMs) for the storage of keys.
[caption: Secure cloud storage represents an opportunity for federal organizations to leverage the cloud’s elastic, cost-effective storage capacity, while maintaining security. This approach requires a combination of granular encryption mechanisms and centralized access and policy management. ]
Cloud Security for Endpoints
With this approach, federal organizations can protect data at the end-user level, including at the mobile device and laptop or desktop level. This enables seamless interaction between users and information in cloud storage. In this scenario, sensitive information remains encrypted in the cloud at all times.
An efficient deployment scenario would include a centralized, hardened security appliance, which is used to manage cryptographic keys, access control, and other security policies. In addition, a virtualized instance of this appliance would be deployed in the cloud to replicate policies and security enforcement on the data. Security administrators need to be able to dictate policy based on content, documents, and folders in order to ensure only authorized users and groups can access sensitive data.
When this approach is employed, cryptographic keys never leave the federal agency, and in fact, they never leave the secured, hardened HSM-based appliance. For optimal security, tokens can be employed at the user level, helping add an additional layer of security to user access. Consequently, federal agencies can leverage an elastic, cloud-based storage pool, while optimizing security, ensuring sensitive data is only visible to authorized users at authorized endpoints.
[caption: By employing centralized key management and tokens at the end-user level, federal organizations can harness cloud services, while ensuring sensitive data is only visible to authorized users.]
Federated Access Control
Today, even without cloud deployments in the mix, most federal organizations have to manage multiple user identities across various platforms and services, which can pose a significant administrative burden, inefficiency for end users, and security threats. By employing federated access control, government agencies can accomplish the following objectives: • Deliver single sign-on access for users to all enterprise applications and platforms—including internal email and
ERP systems, and external SaaS applications.
• Streamline administration through central management of policies, identities, and tokens • Adhere to a host of compliance mandates and stringent security policies
• Leverage open standards and a broad range of authentication solutions
• Boost security through stringent, cohesive policy enforcement, separation of duties, and granular access controls
By offering a means to streamline end user access and access control administration, federated access initiatives can help optimize security while reducing overall security costs.
To deliver on this objective, identity management needs to be done through a simple, Web-based gateway that offers all the administrative access controls required. eTokens need to be leveraged to ensure proper authentication. In addition, this deployment approach can leverage Security Assertion Markup Language (SAML), an XML-based standard for exchanging authentication and authorization data, for managing the exchange of information between the agency and external service providers.
[caption: By federating access control mechanisms, federal organizations can simultaneously streamline security administration and improve adherence with security policies.]
Virtual Encryption as a Service
To fully leverage the cloud opportunity, federal agencies and cloud providers alike, need a way to take the unparalleled security offered by sophisticated, hardware-based encryption solutions, and virtualize those offerings. This enables the delivery of symmetric encryption, file encryption, secure key management, and a host of other capabilities and services within cloud environments.
When cloud providers deliver Virtual Encryption as a Service, they can implement database, application, and file encryption—all managed through a single, virtual platform that combines cryptographic key management, policy management, and encryption processing. Because the platform is virtualized, it can be integrated seamlessly within the cloud provider’s infrastructure. Further, by combining the security benefits of these technologies with the cloud delivery model, security implementations can be far less expensive than traditional in-house deployments, ensuring that even federal organizations with tight budgets can incorporate state-of-the-art security capabilities into their organizations. Virtual Encryption as a Service deployment will largely be implemented by the cloud provider, who will leverage robust security mechanisms, such as centralized key management, granular encryption, and access control, within their
infrastructures. To support Virtual Encryption as a Service, many cloud customers will deploy multi-factor authentication tokens and token management systems in their environments, which can ensure the appropriate access controls are applied to security services and protected data.
[caption: By providing Virtual Encryption as a Service, smaller government organizations can gain access to robust security mechanisms that may have been cost-prohibitive in the past.]
SafeNet: Delivering the Trusted Cloud Platform
Introduction—Overview of SafeNet Cloud Solutions
With SafeNet’s security offerings, federal organizations can fully leverage the benefits of cloud environments—while ensuring trust, compliance, and privacy. SafeNet offers intelligent, data-centric solutions that persistently protect data throughout the information lifecycle and evolve to support changing cloud delivery models—from today’s SaaS and private clouds to the evolving demands of hybrid and public clouds.
Cryptography as a Service
SafeNet offers the broad set of solutions that enable both government agencies and cloud providers to leverage Cryptography as a Service. SafeNet solutions offer the unparalleled combination of features—including central key and policy management, robust encryption support, flexible integration, and more—that make Cryptography as a Service practical, efficient, and secure.
SafeNet offers these security solutions:
• Token management systems and multi-factor tokens that ensure stringent, granular end user access controls • Hardware security modules, including the Luna SA product line, that enable centralized, FIPS- and Common
Criteria-certified storage of cryptographic keys
• DataSecure, which offers file, application, and database encryption—all managed through a hardened appliance that centralizes encryption processing, keys, logging, auditing, and policy administration
Together, these solutions deliver the critical capabilities required for a robust, cost-effective, and secure Cryptography as a Service implementation.
[caption: SafeNet’s HSMs and DataSecure offerings offer FIPS- and Common Criteria-certified, hardware-based protection of cryptographic keys and controls that help ensure regulatory compliance in cloud deployments.]
Trusted Cloud Computing
The dynamic nature of cloud computing can pose significant risks. Today, someone can take an application, for instance, running for one federal agency, then move it to another location and run it for another government organization—and that application could thus enable unauthorized users and processes to access sensitive data.
With SafeNet, your agency can control applications and services within the cloud environment, and ensure applications only run on platforms for intended end users. SafeNet enables federal agencies to control the instances of the high-value virtual machines, ensuring they are only invoked in the right circumstances. SafeNet delivers the solutions that enable organizations to do rights management for virtual machines:
• Software rights management solutions and tokens for authenticating virtual machines
• The ProtectFile file encryption solution, which enables pre-boot authentication of virtual machines • DataSecure, which delivers central policy management of all file, application, and database encryption
[caption: SafeNet offers the products and capabilities federal agencies need to control instances of virtual machines running in the cloud, including where they are located and when they can be invoked, so they can safeguard trust in their cloud deployments.] Conclusion
In terms of potential, the sky truly is the limit when it comes to the benefits cloud computing can deliver. However, the full magnitude of this opportunity can only be realized when security is efficiently, persistently, and effectively employed to safeguard sensitive data. With its sophisticated, data-centric security solutions, SafeNet enables federal agencies and organizations to gain the agility they need to leverage cloud environments most effectively, without making any compromises in security, privacy, or compliance.
To Learn More about Cloud Security
To provide federal and security leaders with more information on secure cloud computing, SafeNet has introduced its “SafeCloud” Web site, a new microsite that features a series of white board videos and white papers. These resources outline how cloud security is expected to evolve, and describe what organizations need to do to prepare for and take advantage of these changes. To visit the SafeCloud site, go to www.safenet-inc.com/safecloud.
About SafeNet
SafeNet is a global leader in information security founded more than 25 years ago. The Company protects identities, transactions, communications, data, and software licensing through a full spectrum of encryption technologies, including hardware, software, and chips. More than 25,000 corporate and government customers in 100 countries, including UBS, Nokia, Fujitsu, Hitachi, Bank of America, Adobe, Cisco, Microsoft, Samsung, Texas Instruments, the U.S. Departments of Defense and Homeland Security, and the U.S. Internal Revenue Service, trust their security needs to SafeNet. In 2007, SafeNet was acquired by Vector Capital, a $2 billion private equity firm specializing in the technology sector. For more information, visit www.safenet-inc.com/government.
