On the Next Generation of Cloud Computing and Cloud Operations Centres

I am going to spend more R&D time in the intersection of Cloud Computing & Security.

The area of cloud computing is getting increasingly busy, with various organisations providing solutions targeting the IaaS, PaaS and SaaS levels.

However, in my view there are still major outstanding questions and issues to be addressed, including:

• Security and Privacy across various boundaries
• Assurance and governance for the involved parties
• Dynamic management of SLAs and policies across the involved parties
• Effective Cloud Operation Centres
• Effective migration of services and information in the Cloud

From a security and privacy perspective it becomes increasingly relevant a trustworthy and reliable exchange of information between the involved parties (organisations, service providers in the cloud, etc.), as well as sharing of threat intelligence.

In this context, I am exploring:

• The next generation of Security Event & Incident Management Processes in the Cloud
• Models for the provision of Cloud Operation Centres
• Information flow exchange, to underpin some of the above aspects
• Application of Security Analytics methodology in the Cloud

All these capabilities could be offered as a Service, in the context of the next generation of Cloud Operations Centres.

What is your view? What is coming next in the Cloud?

--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Focusing on the Cloud and the Intersection of Cloud with Security

An area I am interested in spending more R&D time is the Cloud and the intersection of the Cloud with Security.

In particular I am interested exploring and contributing in the space of “Cloud middleware”. Some initial questions:

Which “middleware” services can be provided in the cloud to support various Cloud applications and services?
Which identity maangemet, security and privacy capabilities need to be in place?
How ensure accountability and assurance?
How to exploit recent Identity and Security Analytics capabilities, developed by HP Labs, in that space

I am currently gathering various information and documents in this space, related to business opportunities, current solution offering and technological approaches.

Any input and links to publicly available information are really welcome.

--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

HP G-Cloud Demonstrator (by HP Labs)

The G-Cloud Theatre is a room designed to demonstrate systems management in a mission-critical environment.
The 'G' in G-Cloud stands for "government" and the demonstration in the theatre shows how a cloud hosting many virtual services could automatically resist even a sophisticated security attack intended to destabilise core data and programs (or generally cause mayhem).
A video footage is available at: http://www.youtube.com/watch?v=zMsWaEqQcbI


--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

HP Labs Presentation at European Commission and RAND EUROPE event on “The Cloud: understanding the Security, Privacy and Trust Aspects”

As mentioned in a previous blog post, I recently attended an event, organised by RAND EUROPE, as a part of an EU project and study commissioned to RAND, time.lex and IDL Warwick:

“This study has undertaken a review of the literature and a number of real-life case studies to identify how challenges in respect of the privacy, security and trust issues were overcome in various implementations of cloud computing.”

It has been a very interesting meeting with key discussions on the implications of privacy, trust and security for Cloud Computing and input from various stakeholders. A full report will be provided RAND, time.lex and IDL Warwick.

In this context I gave a presentation on "Cloud Computing: Security, Privacy and Trust Aspects across Public and Private Sectors” from an Industrial and R&D perspective.

I believe the presentation went very well, with interesting questions and follow-up debates.

Thanks to all the people that provide me with their input, material and suggestions on topics to cover in this presentation.

--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Paper Accepted at 2nd ICST Conference on Cloud Computing – CloudComp 2010

An HP Labs paper has been accepted at the 2nd International ICST Conference on Cloud Computing (CloudComp 2010):

“Information StewardShip in The Cloud: A model-based approachDavid Pym, Martin Sadler, Simon Shiu, and Marco Casassa Mont”

This paper provides an overview of key R&D research happening at HP Labs Bristol, Systems Security Lab in collaboration with various UK partners, in the UK TSB project called “Cloud Stewardship Economics”.

In this work, aspects of Economics theory and HP Labs Security Analytics have been applied to provide decision support to strategic decision makers when exploring the opportunity to migrate their IT infrastructures and services to the cloud.

More information will be posted both on this TSB project and the presentation that will be given at the conference.

--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

RAND Europe Meeting – The Cloud: understanding the Security, Privacy and Trust Aspects

I am going to attend and present at a RAND Europe meeting on the topic of “The Cloud: understanding the Security, Privacy and Trust Aspects”, as a part of a EU project commissioned to RAND, time.lex and IDL Warwick:

“This study has undertaken a review of the literature and a number of real-life case studies to identify how challenges in respect of the privacy, security and trust issues were overcome in various implementations of cloud computing.”

In particular I am going to give a related presentation, from an industrial and research angle, followed by a panel debate.

If you have any point or aspect you’d like me to cover, please let me know.

Currently my presentation is structured as it follows:

- provide an overview of cloud computing, its main aspects and implications
- highlight current security, trust and privacy issues in cloud computing
- discuss trade-offs and different approaches to cloud computing depending on the type of business, e.g. SMEs, medium-large organisations, goverments
- talk about some standardisation/public initiatives in the security space (Jericho, Cloud Security Alliance, etc.)
- Provide an overview of current approaches and solutions to security, trust and privacy and their limitations
- talk about collaborative (industry driven) R&D activities in cloud computing where HP Labs are currently involved, including UK TSB projects (EnCoRe, Cloud Stewardship Economics, etc.)



--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

Applying Security/Identity Analytics to Cloud Computing

In previous posts of mine, I provided additional information about what the HP Labs Identity Analytics is and how it relates to the Security Analytics initiative. I then provided an overview of various IAM areas where to apply Identity and Security Analytics.

Related to this, an interesting area where Identity/Security Analytics can be applied is Cloud Computing.

Organisations (and their decision makers) need to make decisions about adopting cloud-based resources and services in their businesses. They need to explore relevant trade-offs, i.e. lower costs (and perhaps better efficiency) vs. potentially losing control on IT and exposing themselves to additional threats and risks.

In this context, IAM solutions and emerging related frameworks can provide some of the required controls (e.g. via trusted federation, cloud-based compliance and assurance management, etc.).

On the other hand, the IAM frameworks and solutions we know are too enterprise-biased/focused: IAM needs to go through a profound transformation to fully address the needs and requirements of managing identities, profiles and user access rights in cloud environments.

This without keeping into account that individuals - both as private people and employees - are themselves increasingly making decisions about adopting cloud computing solutions for personal and work related matters (consumerisation of the enterprise).

I discussed some of these concepts and dynamics in previous presentations, such as “The Future of Identity in the Cloud” and “The Future of the Information Society”

Security/Identity Analytics can help to explore these trade-offs, related investment options and threats.

Furthermore, Security/Identity Analytics can be used to explore “what-if” scenarios, based on different assumptions and risk mitigation capabilities introduced by different IAM frameworks and other related controls (based on different models and assumptions).

I indeed believe that there is a need for a more rigorous, scientific analysis of this space as well as a better understanding of the impact of various IAM approaches in the Cloud and their actual added values.

--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: use this mirror blog if you prefer posting on an external blog site ---

--- NOTE: my original HP blog can be found here ---

ENISA Cloud Computing Risk Assessment Report

ENISA has recently released three documents related to Cloud Computing, all of them available online:
· Cloud Computing Risk Assessment
· Cloud Computing Information Assurance
· Cloud Computing SME Perspective Survey
Enjoy.

--- Posted by Marco Casassa Mont (here and here) ---

--- NOTE: my original HP blog can be found here ---

Gartner’s Report: Top Seven Cloud-computing Security Risks

I tend to agree with the outcomes of a recent Gartner’s Report on the top seven cloud-computing security risks. A related article, by Jon Brodkin, provides a nice overview and summary of the key taking points of this report:

“Cloud computing is fraught with security risks, according to analyst firm Gartner. Smart customers will ask tough questions, and consider getting a security assessment from a neutral third party before committing to a cloud vendor, Gartner says in a June report titled “Assessing the Security Risks of Cloud Computing.”

Cloud computing has “unique attributes that require risk assessment in areas such as data integrity, recovery and privacy, and an evaluation of legal issues in areas such as e-discovery, regulatory compliance and auditing,” Gartner says.”

In particular I believe that the aspects related to “privileged user access”, “regulatory compliance” and “data location/data segregation/privacy management” are potential key issues that, if not properly addressed, can expose organizations (and users) to high risks.

--- NOTE: my original HP blog can be found here ---