This column provides pragmatic and practical guidance as to the secure implementation of hybrid cloud services.
First things first: what exactly is a “hybrid” cloud? In terms of the widely accepted NIST definition of cloud computing, a hybrid cloud is any combination of the other three deployment models, i.e. any combination of public, private or community cloud services. Public cloud services are those with which we are all familiar – Amazon Web Services, Microsoft Azure etc. A private cloud service is one built exclusively for the use of a single organisation. A community cloud is one built for the needs of a discrete community, law enforcement for example.
Security and compliance requirements are amongst the primary criteria used to determine the most appropriate deployment model. Are such requirements mandatory and specific to you? Public cloud providers tend to offer off-the-shelf services and take it or leave it terms and conditions. If commoditised services and generic contractual terms are not acceptable to you, then you are driven down the route of private cloud. Private cloud is a more expensive approach, but one tailored to your specific needs and free of the multi-tenancy worries associated with other approaches. If you have low-risk, commoditised services then the choice to use public cloud is a simple one. However, what if you are dealing with an overall service that is composed of a number of different components, some of which are sensitive and some not? Or perhaps you are launching a new web service and are unsure of likely demand, how can this service be launched safely but have capacity on-hand should demand surge? These are just some use cases where a hybrid cloud service can be an excellent choice. Other examples include the provision of warm Disaster Recovery services and data archiving (whereby encrypted archives are stored on a cheap public cloud and only decrypted within a private cloud).
From a security perspective, hybrid cloud is the worst of both worlds; security considerations of both public and private cloud apply! This is where the true value of security architecture shines through. If you have invested in defining a set of consistent and comprehensive logical security services (including functional and non-functional aspects) then you can choose appropriate physical implementations for each of those services relevant to the cloud deployment model and achieve the desired levels of security. Furthermore, if you have established a relationship with a Service Integration and Application Management (SIAM) provider, then you can also ask the SIAM to provide a set of common security services across your cloud-based supply chain. Services such as identity management, security monitoring and PKI management can all be centralised and re-used where necessary. An upfront investment in security architecture enables you to support your business stakeholders to adopt cloud services rather than frustrate their desire for agile, flexible service provision. Hybrid cloud is certainly not the easiest cloud model to deploy securely, however an architectural approach to security, conscious of business context, makes an appropriately secure deployment possible.
Lee Newcombe, an active member of (ISC)2 & Chief Information Risk Advisor within the Infrastructure Transformation Services Practice at Capgemini UK
This was first published in February 2014