NIST Cloud Computing Security Reference Architecture

4m ago
8.35 MB
204 Pages

1NIST Special Publication 500-29923456NIST Cloud ComputingSecurity Reference Architecture7891011121314NIST Cloud Computing Security Working GroupNIST Cloud Computing ProgramInformation Technology Laboratory15161718191

20This page left intentionally blank212

Reports on Computer Systems TechnologyThe Information Technology Laboratory (ITL) at the National Institute of Standards andTechnology (NIST) promotes the U.S. economy and public welfare by providing technicalleadership for the nation’s measurement and standards infrastructure. ITL develops tests, testmethods, reference data, proof of concept implementations, and technical analysis to advance thedevelopment and productive use of information technology. ITL’s responsibilities include thedevelopment of technical, physical, administrative, and management standards and guidelines forthe cost-effective security and privacy of sensitive unclassified information in Federal computersystems. This document reports on ITL’s research, guidance, and outreach efforts in InformationTechnology and its collaborative activities with industry, government, and academic organizations.DISCLAIMERThis document has been prepared by the National Institute of Standards and Technology(NIST) and describes standards research in support of the NIST Cloud Computing Program.Certain commercial entities, equipment, or material may be identified in this document inorder to describe a concept adequately. Such identification is not intended to implyrecommendation or endorsement by the National Institute of Standards and Technology,nor is it intended to imply that these entities, materials, or equipment are necessarily thebest available for the purpose.Page 3

AcknowledgementsNIST gratefully acknowledges the broad contributions of the NIST Cloud Computing SecurityWorking Group (NCC SWG), chaired by Dr. Michaela Iorga. Dr. Iorga was principal editor for thisdocument with assistance in editing and formatting from Hannah Wald, Technical Writer, BoozAllen Hamilton, Inc.The following list (in alphabetical order by last name) includes contributors 1 and internal reviewerswho previously agreed to be acknowledged in this document. The list will be updated when wereceive more confirmations from our members.CONTRIBUTORS:Wayne W. Armour, Independent ConsultantNadeem Bukhari, Kinamik Data IntegrityWilliam Butler, PhD., Capitol College – Graduate School of Information AssuranceAlvaro A. Cardenas, Fujitsu Laboratories of AmericaPw Carey, Compliance Partners, LLCKyle Coble, Department of Homeland SecurityVince Grimaldi, Independent ConsultantMuhammad F. Islam, PhD candidate, George Washington Univ. & Booz Allen Hamilton, Inc.Jerry Kickenson, SWIFTJuanita Koilpillai, Electrosoft Services, Inc.Prabha Kumar, PhD., Department of Defense – Chief Information OfficeNancy M. Landreville, PhD., EmeSec (under-contract Dep. of Veteran Affairs) & UMDAnne L. Lee, PhD., U.S. Air Force - Space and Missile Systems CenterCheng-Yin Lee, Independent ConsultantChan Lim, IBMKetan Mehta, Booz Allen Hamilton, Inc.Keyun Ruan, PhD., University College Dublin & EADS N.V., XENSIX Inc.Arnab Roy, Fujitsu Laboratories of AmericaMichael A. Salim, American Data Technology, Inc.Ken E. Stavinoha, PhD., Cisco SystemsINTERNAL REVIEWERS:Wayne W. Armour, Independent ConsultantJerry Kickenson, SWIFTJuanita Koilpillai, Electrosoft Services, Inc.Michael A. Salim, American Data Technology, Inc.1“Contributors” are members of the NCC SWG who dedicated substantial time on a regular basis to research anddevelopment in support of this document.Page 4

Ken E. Stavinoha, PhD., Cisco SystemsSteven Woodward, Cloud PerspectivesOTHER ACTIVE MEMBERS:Richard J Blake, General Services AdministrationRon Martin, Open Security ExchangeSundararajan Ramanathan, CapgeminiNOTE: All views expressed in this document by our contributors are their personal opinions andnot those of the organizations with which they are affiliated.Page 5

Table of ContentsEXECUTIVE SUMMARY .101INTRODUCTION . .12OBJECTIVES .13SCOPE .14STRUCTURE OF THE DOCUMENT .15USING THE DOCUMENT .16BACKGROUND .182.1 REVIEW OF THE FEDERAL CLOUD COMPUTING STRATEGY .182.2 APPROACH .192.3 RISK MANAGEMENT .222.3.1The Risk Management Framework .222.3.2Managing the Risk Inherent in Cloud Services.262.4 ASSUMPTIONS, CLARIFICATIONS AND DEFINITIONS .282.4.1Cloud Computing Service and Deployment Models . Ecosystem.30Cloud Consumer .32Cloud Provider .322. Business and Technical Broker Services. 35A Cloud Brokerage Example. 36Cloud Carrier .37Cloud Auditor .37Business Models and NIST Reference Architecture .38Security Conservation Principle .39SECURITY REFERENCE ARCHITECTURE: DATA ANALYSIS METHODOLOGY .423. Cloud Provider Example. 33Intermediary Cloud Provider Example . 33Cloud Broker .342. Models . 28Deployment Models . 29DATA COLLECTION .43DATA AGGREGATION AND VALIDATION .44DERIVING THE SECURITY RESPONSIBILITIES FOR THE INTERMEDIARY PROVIDER AND TECHNICAL BROKER .46MAPPING SECURITY COMPONENTS TO SECURITY CONTROL FAMILIES .47EMPIRICAL DATA ANALYSIS AND THE GENERIC HEAT MAP .49SECURITY REFERENCE ARCHITECTURE: FORMAL MODEL.524.1 OVERVIEW OF THE FORMAL MODEL .524.2 CONSUMER - ARCHITECTURAL COMPONENTS.554.2.1Secure Cloud Consumption re Business Support . 58Secure Configuration. 58Secure Portability and Interoperability . 59Secure Organizational Support . 60Secure Cloud Ecosystem Orchestration.604.2.2.1Secure Functional Layer . 614.3 PROVIDER – ARCHITECTURAL COMPONENTS .624.3.1Secure Cloud Ecosystem Orchestration.634.3.1.1Secure Deployment and Service Layer. 65Page 6 Resource Abstraction and Control Layer . 66Secure Physical Resource Layer. 68Secure Cloud Service Management .684. Provisioning and Configuration . 69Secure Portability and Interoperability . 71Secure Business Support . 724.4 BROKER – ARCHITECTURAL COMPONENTS .724.4.1Technical Broker .754.4.2Business Broker .774.4.3Secure Cloud Ecosystem Orchestration.784. Service Layers . 79Secure Service Aggregation .79Secure Cloud Service Management .804. Portability and Interoperability . 81Secure Provisioning and Configuration . 82Secure Business Support . 824.4.6Secure Service Intermediation .834.4.7Secu