Cloud Security
August 3rd, 2009 by Jeff Jaffe
Fourth in a series about Novell’s comprehensive approach to cloud computing.
Recent Events
The summer has seen numerous announcements with the proof points of our cloud infrastructure contributions. These announcements are transformative. They are not merely new products. They address issues that the industry has not totally addressed, with innovative solutions.
Last week was especially exciting. As foreshadowed in Software Appliances and Cloud Computing we launched SUSE Studio a key tool in our overall appliance program and in developing for the cloud. The press reaction was breathtaking with some saying that this was Novell’s most important announcement in decades.
Also last week we provided our cloud security demo at the Burton conference. More about that below.
The previous week saw Microsoft releasing 20,000 lines of GPL code to the Linux kernel. Interesting times.
Reprise
In mid-June, we identified five cloud infrastructure priorities:
- Connect
- Secure
- Manage
- Develop
- Collaborate
We’ve elaborated about Connect and Develop and here we will talk about Securing the Cloud.
Cloud Security
Many studies have documented that enterprises are concerned about cloud computing security.
This is not surprising. Many events have heightened concerns about security. Information leakage, viruses, and lost laptops are examples of security lapses. Cloud computing exacerbates concerns. Data and applications are placed outside of the enterprise, outside the firewall, and outside the adminstrative domain of the IT organization.
The security fears are dramatic enough. Sometimes, the fix is worse than the fear. A cloud computing vendor might propose a new security model to assure wary users that their data is safe. However, even if this new model is theoretically secure—it does not immediately address the practical problem. The IT organization must incorporate the model deeply enough to be secure. They must be able to explain it to survive a corporate audit about data protection. After the IT organization appreciates the security of the new model there is complexity to introduce the new model and security holes that arise from lack of training or misuse
Annexation
With so many barriers the best way to secure the cloud is to use existing security models. The IT organization should use the same security and access control technology for the cloud as they use in the enterprise. The interfaces must be the same. The user model must be the same. If passwords are used the actual password must be the same.
We call this idea annexation of the cloud. In this model we provide transparency in usage and security model so that the IT organization does not use a new access control paradigm. Rather, they feel that the cloud has become an extended part of their enterprise.
Novell Cloud Security Service
This is the essence of the Novell cloud security service that we demonstrated together with PivotLink at the Burton conference last week. By federating a SaaS vendor’s access control mechanism with existing enterprise mechanisms we provide cloud security within the existing model of an enterprise.
Another key piece of the cloud infrastructure provided by Novell!
Log Management
Also last week, we announced our Sentinel Log Management product. This has immediate value to today’s enterprises as they struggle with masses of data that need to be processed to assure compliance. With respect to cloud computing, we can only imagine that these compliance needs will become more demanding, data sources more disparate, and organization of this data more critical. Sentinel Log Management is focused on today’s compliance needs but this asset will also provide value to secure the cloud.