17.1  Introduction

Cloud computing represents an exciting evolution of application and infrastructure solutions, prompting Information Technology (IT) departments around the world to investigate what the cloud can do for their organizations. Despite the excitement surrounding the cloud, a relatively small percentage of organizations have actually begun leveraging cloud computing, citing concerns such as vendor lock-in, lack of acceptable service-level agreements (SLAs), and limited governance procedures. Of the many obstacles to adopting the cloud model of delivery and consumption of computing resources, the number one concern, from commercial users to developers to CIOs/ CTOs, is security [1]. These concerns are motivated by a variety of factors including:

1.Handing over control of hardware resources to a third party

2.The fact that other companies (including competitors) may also utilize the same cloud platform

3.Meeting the requirements of existing regulations

The lack of strong security controls can resonate throughout the cloud, opening all of the applications and services to exploitation. Put simply, a single vulnerability can contaminate the entire cloud. Providing a cloud environment with strong, demonstrable security controls is desired by all cloud users. In fact, certain user communities, such as those subject to regulatory compliance, must maintain strong security controls in order to consider the cloud a viable platform. For example, government customers must satisfy FISMA [2], healthcare providers are bound by HIPAA [3], publicly traded companies follow SOX [4], and financial institutions are subject to GLBA [5].

To secure the cloud, we begin by applying traditional data center security techniques. However, the very nature of cloud computing (i.e., multitenant, geographically distributed, virtualized, etc.) introduces new security challenges. A structured approach to identifying these security issues includes an analysis of the new technologies introduced by cloud computing and a gap analysis against current standards, such as the ISO 27002 security controls.

In this chapter, we examine cloud security. It is impossible to present a complete overview of cloud security issues and possible resolutions in the context of a single chapter, and the reader is referred to the excellent work being performed by organizations such as the Cloud Security Alliance [6]. For this reason, we focus our discussion on gaps within the existing ISO 27002 security controls when applied to cloud computing. These gaps are used to build a list of potential security concerns that may not be addressed by traditional (noncloud) datacenter policy and procedures. Using the results of this gap analysis, a set of recommendations on how to incorporate security into the cloud is provided.