The newsletter discusses several topics related to information assurance and cloud computing. It includes articles on establishing trust in cloud computing, the Insider Threat Center at CERT, public-private partnerships for combating cyber threats, operating and defending the global information grid, and secure browsing alternatives to CAC middleware. Other articles cover security considerations for social media use, using wikis within the DoD, cloud computing for the federal community, DISA certification for the cloud, and standardizing vulnerability assessment processes.

1. Volume 13 Number 2 • Spring 2010
13/2
The Newsletter for Information Assurance Technology Professionals
Cloud Computing:
Silver Lining or
Storm Ahead?
also inside
Establishing Trust in Insider Threat Center at Public/Private Partnership
Cloud Computing CERT Grows Solutions from Becoming a Necessity
Reality-Based Research
Cloud Computing for the Apples & Oranges: Operating
Federal Community Wikis Within the DoD and Defending the Global
Information Grid
DISA RACE: Certification and Vulnerability Assessment
EX
Accreditation for the Cloud Processes Within DoD LPS-Public: Secure
C E L L E NC E
SE R V CE
N
Browsing and an Alternative
N
I NF IO
O R MA T
Look Before You Leap Eight Steps to Holistic to CAC Middleware
Database Security

2. contents
feature
About IATAC and the IAnewsletter
The IAnewsletter is published quar-
terly by the Information Assurance
Technology Analysis Center (IATAC).
IATAC is a Department of Defense
20 Look Before You
Leap: Security
Considerations in a
34 Eight Steps to Holistic
Database Security
Government organizations are
4
(DoD) sponsored Information Analysis
Center, administratively managed by Web 2.0 World finding new ways to secure
the Defense Technical Information
Center (DTIC), and Director, Defense Embracing social media is their data.
Research and Engineering (DDR&E).
imperative to success in a new
37
Contents of the IAnewsletter are not
necessarily the official views of or communications environment, but Public/Private
endorsed by the US Government, DoD,
DTIC, or DDR&E. The mention of Establishing Trust in Cloud Computing doing so without adequate planning Partnership
commercial products does not imply
endorsement by DoD or DDR&E. We can argue that it is not a matter of can do more harm than good. Becoming a Necessity
whether cloud computing will become Combating advanced persistent
25
Inquiries about IATAC capabilities,
products, and services may be
addressed to— ubiquitous—because the economic forces Insider Threat Center threat (APT) in silo efforts is an
IATAC Director: Gene Tyler are inescapable—but rather what we can at CERT Grows unsustainable strategy.
Inquiry Services: Peggy O’Connor
do to improve our ability to provide cloud Solutions from Reality-
38
If you are interested in contacting an
author directly, please e-mail us at computing users with trust in the cloud Based Research Apples & Oranges:
Iatac@dtic.mil.
services and infrastructure. Educating organizations on how Operating and
IAnewsletter Staff
to detect and manage insider Defending the Global
9
Art Director: Tammy Black
Copy Editor: Kali Wilson
Designers: Michelle Deprenger IATAC Spotlight on a threat is critical. Information Grid
Dustin Hurt
University Our language and doctrine needs
26
Editorial Board: Dr. Ronald Ritchey
Angela Orebaugh
Gene Tyler Penn State is one of the nation’s Wikis Within the DoD to evolve to view cyberspace as
Kristin Evans
Al Arnold ten largest undergraduate Reaping the benefits the contested, warfighting
IAnewsletter Article Submissions engineering schools. of community-driven information domain it is.
To submit your articles, notices,
sharing with wikis.
10 42
programs, or ideas for future issues,
please visit http://iac.dtic.mil/iatac/
Cloud Computing for LPS-Public: Secure
29
IA_newsletter.html and download an
“Article Instructions” packet.
the Federal Community IATAC Spotlight Browsing and an
IAnewsletter Address Changes/
Additions/Deletions A community cloud is the most on a Conference Alternative to CAC Middleware
To change, add, or delete your mailing
or email address (soft-copy receipt), secure way for the federal This event provided opportunities Secure Browsing and an
please contact us at—
government to realize the to learn about research as well Alternative to CAC Middleware:
IATAC
Attn: Peggy O’Connor potential of cloud computing. as ongoing developments. The public edition LPS is a free,
13200 Woodland Park Road
easy to use, install nothing,
16 30
Suite 6031
Herndon, VA 20171
DISA RACE: Vulnerability browsing alternative with
Phone: 703/984-0775
Fax: 703/984-0773 Certification and Assessment built-in CAC software for
Email: iatac@dtic.mil Accreditation for the Cloud Processes Within DoD almost any computer.
URL: http://iac.dtic.mil/iatac
Government organizations are Standardizing the vulnerability
Deadlines for Future Issues
Summer 2010 May 8, 2010 taking full advantage of the assessment processes can help
Cover design: Tammy Black potential benefits offered by avert disaster.
Newsletter
cloud computing.
33
in every issue
design: Donald Rowe
Distribution Statement A: Subject Matter Expert
Approved for public release;
distribution is unlimited. The SME profiled in this 3 IATAC Chat
article is Dr. Peng Liu, at 36 Letter to the Editor
Pennsylvania State University. 43 Products Order Form
44 Calendar
2 IAnewsletter Vol 13 No 2 Spring 2010 • http://iac.dtic.mil/iatac

3. IATAC Chat
Gene Tyler, IATAC Director
I n early February, I had the
opportunity to attend the Information
Assurance Symposium (IAS) in
importantly, its weaknesses. I believe
they say it best in their statement, “It is
unclear whether the current set of [cloud
this edition of the IAnewsletter also
provide you with various perspectives
on cloud computing so that you feel
Nashville, TN. I always look forward to computing] services is sufficiently inspired to enter into the dialogue. I ask
attending this event because it brings secure and reliable for use in sensitive you, is cloud computing the silver lining
together folks who truly care about government environments.” They to computing, and should we storm
information assurance (IA). I am always advocate a cautious approach to ahead in implementing it across various
excited to converse with colleagues implementing cloud computing organizations? Or might it weaken our
interested in solving tough IA problems capabilities across the government and, computer network defenses and result
ahead, and yet again, the IAS did not in particular, the Department of in a potential storm of malicious attacks
fail; I enjoyed talking with people about Defense (DoD). However, these subject in the future?
some of the newest innovations matter experts remain optimistic, which In addition to cloud computing, I
currently changing our field. is why they are excited about the invite you to look at the various other
One topic that seemed to dominate research and investigation NPS is doing articles in this edition that highlight the
the conversations I had with various to identify methods of securing cloud- following topics, also discussed at IAS:
colleagues and subject matter experts at based systems. insider threat; Web 2.0 Security; social
IAS was cloud computing, and as this On the other hand, some media and its use in DoD; vulnerability
edition of the IAnewsletter reflects, this organizations are beginning to assessments; defending the Global
topic is getting a lot of well-deserved successfully implement cloud Information Grid; and our industry
attention, for a multitude of different computing already. Most notably, the expert contributes a very interesting
reasons. Cloud computing is Defense Information Systems Agency article on public/private partnerships.
revolutionizing how organizations are (DISA) successfully developed the Rapid As I always remind our readers, we are
constructing their networks and Access Computing Environment (RACE), interested in your perspectives and
systems; it is changing how which is a cloud-based system. Not only welcome your contributions to this
organizations invest in their information has DISA successfully implemented publication. We know our readers are
technology infrastructure; and it is RACE, but, as the authors point out, the very subject matter experts who are
forcing organizations to reconsider how “certification and accreditation policy analyzing and experimenting with
they secure critical information— has been adapted to allow organizations innovative solutions like cloud
security is critical and at the forefront of to use RACE cloud resources, thereby computing. Feel free to contact us at
cloud computing quickly connecting to the cloud while iatac@dtic.mil with your perspective on
But what, exactly, is cloud complying with DoD requirements.” the cloud debate!
computing; and how do you ensure Munjeet Singh and Troy Giefer remain
information security in the cloud deeply involved with DISA as it
computing environment? Dr. Bret implements cloud solutions, and as a
Michael and Dr. George Dinolt, of the result, their article, “DISA RACE:
Naval Postgraduate School (NPS), Certification and Accreditation for the
address some of these questions in their Cloud,” provides a different perspective
article, “Establishing Trust in Cloud on cloud computing and its advantages.
Computing.” They argue that a lot of As these two articles suggest, there
discovery is necessary before the IA is a lot of debate over cloud computing,
community can fully understand cloud the advantages it offers, and the risks it
computing, its benefits, and more presents. I hope the articles presented in
IAnewsletter Vol 13 No 2 Spring 2010 • http://iac.dtic.mil/iatac 3

4. F E AT U R E S T O R Y
Establishing Trust in
Cloud Computing
by Dr. Bret Michael and Dr. George Dinolt
I n the aptly titled article, “Cloud
Assurance Still Missing,” Allan Carey
wrote, “The security problems that
computing as a vehicle for maintaining
their competitive edge.
A recent technical report published
ff IaaS (Infrastructure as a Service)—
the cloud provides an infrastructure
including (virtual) platforms,
organizations face related to cloud by the University of California, Berkeley, networking, etc. on which
computing are the same as those related states that there is no commonly agreed applications can be placed;
to virtualization—but even more so.” [1] upon definition of cloud computing. [5] ff SaaS (Software as a Service)—
He goes on to say, “Information Instead, a definition is emerging as the the cloud provides software
assurance practitioners already have various organizations that are applications.
most of what is needed to make an developing cloud services evolve their
informed set of decisions about cloud offerings. In addition, there are many Amazon’s Elastic Compute Cloud
computing.” [2] We would argue that the shades of cloud computing, each of (EC2) is an example of these services. [8]
security problems go well beyond the which can be mapped into a Google also provides enterprise-level
use of virtualization in distributed multidimensional space with the integrated application services such as
systems. In this article, we discuss the dimensions being characteristics, service email, appointment calendars, text
need for asking critical questions about models, and deployment models. [6] processing and spreadsheets. [9]
the security implications of cloud Cloud computing is a metaphor for The claimed advantages for an
computing. Answers to our questions giving Internet users a growing enterprise are that it does not require an
are not readily apparent, even though collection of computer system resources investment in computer resources,
viewing computing as a utility, similar and associated software architectures to infrastructure, administration, etc.: the
to that of providing water or electricity provide application services. [7] The purveyor of the cloud provides these
on a for-fee basis, dates back to at least applications include processing and resources. The user or enterprise only
the 1960s. [3] application integration, storage, and pays for the resources “consumed.” In the
As we pointed out in a recent communications services. Cloud Department of Defense (DoD), we have
article, [4] what has changed over time services are typically available on seen the introduction of infrastructure
is the advancement of the underlying demand and are charged on a usage services on demand provided by the
technology, including cheap, fast central basis. Often, what the user sees is an Defense Information Systems Agency’s
processing units (CPUs), low-cost application instead of a particular Rapid Access Computing Environment
random access memory (RAM), computer. The services are commonly (DISA RACE). [10] Where available, the
inexpensive storage, and the high- described as: cost of developing and maintaining
bandwidth standardized ff PaaS (Platform as a Service)­ the
— specialized applications can be shared
communication needed to efficiently cloud provides hardware resources, among the users of that application. In
move data from one point to another. typically virtual machines, which theory, there is an advantage in having
Additionally, considerations, such as the can be loaded with the users, large-scale resources shared among a
economies of scale involved in building operating system and software; large class of users. However, this has yet
very large data centers, nudged to be borne out. [11] There are, of course,
organizations to consider cloud applications that require a large number
of resources. Google Search is one such
4 IAnewsletter Vol 13 No 2 Spring 2010 • http://iac.dtic.mil/iatac

5. example. It appears that Google, with an appropriate level of security should be asking to improve the security
Amazon, and others are attempting to transparency to alleviate customers’ and privacy clouds afford. However, we
leverage their ability to construct such a reservations about the security and can ask fundamental questions like: are
system into other environments. privacy afforded by the cloud. [12] How the current architectures adequate for
We can argue that it is not a matter much transparency is enough? How do building trusted clouds? If not, what
of whether cloud computing will we provide for transparency of cloud types of software system architectures
become ubiquitous but rather what we resources (i.e. determining the cloud in do we need? Consider, for instance, the
can do to improve our ability to provide which customer data resides)? Is there a possibility that an organization might
cloud computing users with assurance tipping point at which additional levels opt to fully outsource its computing
that the cloud services and of transparency would only serve to infrastructure and data center to the
infrastructure provide appropriate help malefactors compromise services cloud, retaining only thin clients within
security functionality. Cloud computing and datacenters? the organization. How do we make the
providers should supply their customers In addition, as users and developers thin client user terminals and the
find new ways of applying cloud communications infrastructure secure?
o
Security Policy
technologies, there will be new
expectations about security and privacy. DoD Enterprise Computing
Provision
I&A Compromise Integrity For instance, Twisted Pair Solutions of What is our motivation for jumping feet
of Service
Seattle proposes to provide cloud first into asking hard questions about
computing resources for state and local cloud computing? The growing
Informal Map agencies to link up disparate public importance of cloud computing makes it
safety radio systems (e.g., police, fire, or increasingly imperative that security,
ambulances)—a novel but difficult-to- privacy, reliability, and safety
Integration & Middleware
predict usage of cloud computing, but communities grapple with the meaning
also a usage that makes the cloud part of of trust in the cloud and how the
Formal (Mathematical) Map mission- and safety-critical systems. [13] customer, provider, and society in
Theorems
(Proof that Spec Satisfies Model) The expectations for security, privacy,
about Policy general gain that trust. Consider the
reliability, and quality of service and so initiative of the DoD Enterprise Services
Top Level System Specification on will be different in some respects for & Integration Directorate to make the
Voice over Internet Protocol (VoIP) radio DoD Storefront Project a reality. The
Semi Formal Map systems than for the cloud’s social Storefront consists of a cloud-based set
(System Satisfies Spec) networking aspects. This raises the of core and specialized applications that
question: how do we manage risk when users can discover through an
we do not fully understand what we are application marketplace and which
Top Level System Implementation
trying to protect or guard against? share an identity management
The fluid nature of cloud computing framework. How will DoD provide
Figure 1 Process for Integrating Security makes it a moving target, even when security for the Storefront? It is more
Into the Cloud trying to determine the questions we than a matter of having an identity
IAnewsletter Vol 13 No 2 Spring 2010 • http://iac.dtic.mil/iatac 5

6. management framework. The obvious maintained within the cloud. Several enterprise providing single sign-on; the
security concerns include data integrity, vendors have formed the Cloud Security enterprise user need only log onto their
data availability, protection of Alliance (CSA). [14] In the report titled home system. Once logged on, the
personally identifiable information, data Security Guidance for Critical Areas of enterprise user can automatically access
protection, data destruction, and Focus in Cloud Computing V2.1, CSA the users’ files and services on Google
communications security. provides its take on some of the security without an additional login. Although
Moving beyond the Storefront issues related to cloud computing. [15] convenient, this functionality increases
concept, as the federal government In the report, security properties the security exposure to not only the
migrates its data and applications to the are described as essentially the same set weakness of the enterprise system, but
cloud, issues regarding cross-domain of properties that a user expects to see also to the weakness of Google’s
resource sharing will arise within the with a self-hosted system. These include infrastructure. If, for example, Google’s
cloud. For instance, how will DoD link the usual: infrastructure has a security flaw, then it
its clouds to those of other agencies? ff Identification/Authentication may be possible for someone in one
Will a DoD user, authenticated to enter ff Privacy enterprise to access accounts from
the DoD cloudsphere, be trusted to ff Integrity another enterprise. On the other hand,
access services owned by the ff Provision of Service. security flaws in the enterprise system
Department of Homeland Security may lead to weaknesses in the access
(DHS)? Is there a need for a federal-wide They view assurance as an audit of controls of the information managed by
cloud infrastructure and common set of the function’s implementation, that is, Google Apps. Additionally, connected
security services? How will data be the cloud systems’ administrators and applications may provide unintended
shared among the various different implementers have used ‘best practices’. connections among users, as was
types of cloud? Other than the notion that encryption is demonstrated with the introduction of
used to protect the data, there is little Google Buzz. [17]
Information Assurance information that defines ‘best practices.’ When each enterprise maintains its
At the Naval Postgraduate School, a There is, however, some form of key own infrastructure, a failure in one
major thrust of our research on cloud management included that provides enterprise may cause failures across the
computing is to investigate the security potentially strong identification/ cloud. Unless an enterprise uses a single
policies, models, and appropriate authentication, as well as some form of cloud from a single vendor, integrating
architectures to provide security for data integrity/recovery facility. The the various applications,
entities/users of cloud computing security architecture proposed is infrastructures, and policies among
resources. Although cloud computing essentially a layered operating system many different clouds and cloud vendors
may appear to provide reasonably well application. It consists of a network layer will be a significant challenge. In fact, it
understood operating system and interposed between application will be a challenge to ensure that the
application resources, cloud resources programming interfaces (APIs) and the different policies do not contradict and
are distributed in space, time, and scale underlying operating system potentially permit access that should
in ways that were never envisioned in infrastructures. ‘Trusted computing’ is not be allowed at the system level.
the operating-system world. The current only mentioned at the hardware/ Ultimately, the proof is in the
architectural approaches, especially operating system level. Additionally, the pudding. Will the cloud vendors be
those concerning security, may not scale CSA paper enumerates several security willing to stand behind the security of
to the much larger cloud computing issues that should be addressed by the their systems? In the case of Amazon’s
approaches. In addition, the approaches cloud-style service provider, but does EC2 and Simple Storage Services (S3)
for assuring operating system security not provide any insight on security services, Amazon suggests that their
functionality are not necessarily policies/models, interfaces or EC2 and S3 infrastructure not be used
appropriate. It is unclear whether the potential solutions. for systems that must satisfy the
current set of services is sufficiently To provide an example of some of Payment Card Industry Security
secure and reliable for use in sensitive the potential issues, Google supports Standards [18], although it has
government environments. Current “Google Apps.” [16] Google Apps applies published a paper on how Amazon Web
security claims are somewhat limited. the usual discretionary access controls Services can be used in a Health
One of the fundamental problems to the resources it provides – files, Insurance Portability and Accountability
with adopting cloud computing is calendars, address lists, etc. To make life Act (HIPAA) compliant environment. [19]
providing not only security resources easier, Google provides tools that In the HIPAA paper, Amazon
but also assurances that those resources integrate their identification and essentially places almost all the
are correctly implemented and authentication systems into the requirements on the “user/enterprise”
6 IAnewsletter Vol 13 No 2 Spring 2010 • http://iac.dtic.mil/iatac

7. to encrypt all the data stored and to lead to new architectures with better platform(s). The enterprise loads
manage its keys. Amazon provides defined, more assured security. operating systems, applications, etc.,
services to log safely into its systems Over the past 30-plus years in the onto the platform(s) and manages all
and provide some data recovery operating system security world, a lot of the interfaces and resources provided.
and integrity. work has been done to provide highly The example below assumes that
In the realm of reliability, prior to assured components with trustworthy multiple platforms will be used.
the breakup, AT&T was required to build systems. Unfortunately, the commercial The security policy visible to the
systems that had an up-time reliability world has ignored a lot of this work. user includes:
of “five nines” (about 5.2 min/yr Recent efforts have focused on the use of ff Identification—A set of platform
downtime). Part of the reason for this separation kernels. For example, Green names issued by the provider
was to ensure services in case of Hills has recently received a National (unique to the enterprise)
national emergency. Current cloud Information Assurance Partnership ff Authentication—A secure channel
based systems are advertised as (NIAP) certificate for its Integrity 178B that can be used to load the
providing “three nines” (almost 9 hrs/yr Separation Kernel. [21] Separation operating system(s) onto the
downtime). [20] kernels provide a minimal set of platforms—the provider is trusted
operating system services on which to ensure that the only
Determining Where Trust other trusted services and applications communication with the platforms
Should be Placed could be built. These may be thought of is from or to the enterprise
Clearly, there are many challenging as slightly more functional than a ff Integrity—The provider should
security issues related to cloud Virtual Machine Monitor (VMM), guarantee that the resources are
computing. In our research, we are although Green Hills and others are “empty” on first use and that none
working on a formal, structured, looking to implement high assurance of the platform resources are
possibly mathematical approach that VMMs using their technology. modifiable by any party other than
will give users and cloud-developers Our approach to the problem the enterprise. This includes any
deeper insight into what should be done, involves separation of ‘virtual’ management functions; it is up to
how it might be achieved, and where the resources. This approach constructs an the enterprise to ensure that any
trust should be placed. This research infrastructure that establishes (or network interfaces are
includes the investigation of reconstructs where appropriate) appropriately protected
implementation structures and resources, identifies and authenticates ff Privacy—The provider should
assurance provisions for “security” in users, and then controls access to the guarantee that there is no third
cloud-based systems. To do this, we will resources. Our focus is to provide a party access to the platform
attempt to provide security model and a security architecture that processor, memory, and/or disk files
architectures and models that satisfy provides the infrastructure that will ff Provision of Service—The provider
the following: accomplish these goals. should provide access to the
ff They are aware of the amorphous resources on demand, per any
nature and scale of the cloud An Example service level agreements between
computing paradigm For instance, consider PaaS. An the enterprise and the provider.
ff They include mathematical models enterprise might wish to run its own
of the security properties that can applications. These applications may There at least two models of this
be used to help analyze those only run on an intermittent basis and/or kind of service:
properties require a large number of resources. 1. Resources are provided on an ad
ff They provide the underpinnings on One way to achieve this is to use a hoc, intermittent basis. In this
which applications/enterprise/user cloud PaaS. version, there is no connection
level security policies/properties We use the term ‘enterprise’ to between consecutive uses of the
can be implemented describe the organization requiring the resources. The enterprise uses the
ff They provide the foundations on platform and ‘provider’ for the resources once. During subsequent
which the implementation organization providing the cloud uses, the enterprise assumes that
assurances can be ascertained. platform resources. The PaaS provider all the previous data does not exist
would provide ‘platforms,’ either ‘real’ as or has been erased by the provider.
Our hope is that the results of the part of a virtual environment (a means The only connection between the
research will provide a framework that for downloading an operating system two usages is that the enterprise
can be at least partially applied to the and for managing the platforms), or as a uses the “same identifiers” to access
current cloud architectures and may possible network interface(s) on the new instances of the resources.
IAnewsletter Vol 13 No 2 Spring 2010 • http://iac.dtic.mil/iatac 7

8. There is no guarantee that the same The security properties then secure systems architectures and secure-
physical resources will be used for become statements about the resources systems design.
each run of the platform(s). and platforms. For example:
2. The enterprise ‘turns off’ the plat- No pair of allocations shares References
form, but in subsequent use after any common VPlatforms or 1. IAnewsletter, vol. 13, no. 1, winter 2010, p. 34.
turning it back on, finds the plat- VPlatformResources. 2. Ibid.
form resources in the same state As depicted in Figure 1, the security 3. M. Campbell-Kelly. “The Rise, Fall, and Resurrection
they were in after being turned off. properties can be modeled on a of Software as a Service: A Look at the Volatile
As expected, the enterprise might collection of the statements above. Each History of Remote Computing and Online Software,”
pay more for this service. In this of the statements should map back to Communications of the ACM, vol. 52, no. 5, pp.
case, the provider must protect the some aspect of the system’s user-visible 28–30, May 2009.
information in the resources security property. We could use our 4. B. Michael. “In Clouds Shall We Trust,” IEEE
between runs from both modifica- statements about the relationships of the Security & Privacy, vol. 7, no. 5, p. 3, September/
tion and access by third parties. entities (sets) we describe to prove October 2009.
There is no guarantee that the same additional properties of the system. 5. M. Armbrust, A. Fox, R. Griffith, A. D. Joseph, R.
physical resources will be used in Following the security model’s H. Katz, A. Konwinski, G. Lee, D. A. Patterson,
each run of the platform. construction, a high-level execution A. Rabkin, I. Stoica, and M. Zaharia. “Above the
model should be constructed and Clouds: A Berkeley View of Cloud Computing,”
Note that in both cases, the validated mathematically to determine EECS Department University of California, Berkeley.
provider provides access to platforms that it satisfies our security model. Technical Report UCB/EECS-2009-28, 10 February
and associated data. The platforms are Next, it is necessary to map our high- 2009, http://www.eecs.berkeley.edu/Pubs/
available to others when the enterprise level model to varied cloud aspect TechRpts/2009/EECS-2009-28.html.
is not using them. Any provider implementations as documented by 6. P. Mell and T. Grance, “The NIST Definition of Cloud
configuration data about the platforms the vendors. Computing,” Version 15, 7 October 2009, http://
must be protected from modification csrc.nist.gov/groups/SNS/cloud-computing/cloud-
and, in the second case above, any Conclusion def-v15.doc.
enterprise information that will be Cloud security is an ill-defined, little- 7. http://en.wikipedia.org/wiki/Cloud_computing.
reused must also be protected. understood area of distributed 8. http://aws.amazon.com.
Informally, a portion of the model computing. However, we believe that 9. http://docs.google.com.
might then take the form of: progress can be made to provide a level 10. http://www.disa.mil/race
ff VPlatform—The set of names of of assurance that accommodates the 11. H. G. Miller and J. Veiga. “Cloud Computing: Will
virtual platforms that will be resources needed to support DoD and Commodity Services Benefit Users Long Term? IEEE
provided to enterprises the federal government’s information ITPro, vol. 11, no. 6, p. 67-69, November/
ff VPlatformType—Whether the processing requirements. n December 2009.
VPlatform resources are persistent 12. http://www.opencloudmanifesto.org.
(type 2 above) or not 13. http://www.fcw.com/Articles/2009/04/16/Cloud-
About the Authors
ff VPlatformResource—The set computing-moving-into-public-safety-realm.aspx.
of resources associated with 14. http://www.cloudsecurityalliance.org.
Dr. Bret Michael | is a Professor of Computer
a VPlatform 15. http://www.cloudsecurityalliance.org/csaguide.pdf.
Science and Electrical Engineering at the Naval
ff Enterprise—The set of enterprises 16. http://www.google.com/apps.
Postgraduate School. He conducts research on the
that use VPlatforms 17. http://www.nytimes.com/2010/02/15/technology/
reliability, safety, and security of distributed
ff Allocation—An association internet/15google.html.
systems. He is an Associate Editor-in-Chief of IEEE
of an Enterprise with a 18. http://www.mckeay.net/2009/08/14/cannot-achieve-
Security & Privacy magazine and a member of the
Platform, VPlatformType and pci-compliance-with-amazon-ec2s3
IATAC Steering Committee.
VPlatformResources. The same 19. http://awsmedia.s3.amazonaws.com/AWS_HIPAA_
Enterprise may have multiple Whitepaper_Final.pdf.
Dr. George Dinolt | is a Professor of Practice
VPlatforms, and VPlatformResources 20. http://www.google.com/apps/intl/en/business/
in Cyber Operations at the Naval Postgraduate
associated with it infrastructure_security.html.
School. His research interests are primarily in the
ff PlatformCloud—A sequence of sets 21. http://www.niap-ccevs.org/cc-scheme/st/vid10119/
high assurance portions of Computer Security. His
of Allocations. maint200
research covers formal methods and the
connections between them and security policies,
8 IAnewsletter Vol 13 No 2 Spring 2010 • http://iac.dtic.mil/iatac

9. I ATA C S P O T L I G H T O N A U N I V E R S I T Y
Pennsylvania State University
by Angela Orebaugh
I n 1855, Pennsylvania State University
(Penn State) was originally founded
on 200 acres in Centre County,
and problems associated with assuring
information confidentiality, integrity
(e.g., social, economic, technology-
ff The Center for Information
Assurance plans, coordinates, and
promotes IA research, education,
Pennsylvania, as an agricultural school related, and policy issues), as well as the and outreach. The faculty
that applied scientific principles to strengths and weaknesses of various coordinators for the center include
farming. Engineering Studies were methods for assessing and mitigating Dr. Chao-Hsien Chu and Dr. Peng
introduced in 1882, making Penn State associated risk. The major provides Liu. The center’s missions are:
one of the nation’s ten largest grounding in the analysis and modeling •• Conduct broad-based research
undergraduate engineering schools. efforts used in information search, on various aspects (theoretical
Today, Penn State has grown into a large, visualization, and creative problem and applied; technical and
geographically dispersed, major solving. This knowledge is managerial; wired and
research institution. Nineteen supplemented through an examination wireless, etc.) of information
campuses, 15 colleges, and one online of the legal, ethical, and regulatory and cyber security
World Campus currently comprise Penn issues related to security that includes •• Educate and train information
State. In Fall 2009, Penn State served analyzing privacy laws, internal control, security professionals through
over 80,000 undergraduates and over regulatory policies, as well as basic degree and continuing
13,000 graduate students, with half of investigative processes and principles. education programs, and to
the student population enrolled at the Such understanding is applied to venues insure that information security
main campus in University Park. that include transnational terrorism, awareness is instilled in all Penn
The National Security Agency (NSA) cyber crimes, financial fraud, risk State students
and the Department of Homeland mitigation, and security and crisis •• Provide assistance and technical
Security (DHS) have designated Penn management. It also includes overviews support to industry, non-profit
State as a National Center of Academic of the information technology that plays organizations, government, and
Excellence in Information Assurance a critical role in identifying, preventing, individuals in the information
Education (CAE/IA) since 2003 and and responding to security-related events. and cyber security area. [1]
National Center of Academic Excellence IST also offers a graduate degree in
in Information Assurance Research Security Informatics, which seeks to ff The Networking and Security
(CAE-R) for 2008-2013. improve the cyber security of Research Center (NSRC) was
The College of Information Sciences individuals and organizations by established in 2003 to provide a
and Technology (IST) offers a bachelor’s creating innovative solutions for research and education community
degree in Security and Risk Analysis detecting and removing cyber threats, for professors, students, and
(SRA). This degree program is intended recovering from cyber attacks, industry collaborators interested in
to familiarize students with the general protecting privacy, enhancing trust, and networking and security. It also
frameworks and multidisciplinary mitigating risks. provides a unique avenue for
theories that define the area of security Penn State includes a number of interaction with industry; the
and related risk analyses. Courses in the research centers focused in cyber and
major engage students in the challenges information security: ww continued on page 15
IAnewsletter Vol 13 No 2 Spring 2010 • http://iac.dtic.mil/iatac 9

10. Cloud Computing for the
Federal Community
by Hannah Wald
T he question is not whether, but when,
the U.S. federal government will
embrace cloud computing. The current
“Cloud computing is a model for enabling convenient,
administration—in particular its Chief on-demand network access to a shared pool of
Information Officer, Vivek Kundra—is
very enthusiastic about this configurable computing resources (e.g., networks,
technology’s potential. Some federal
agencies are already moving into the servers, storage, applications, and services) that can
cloud: the Defense Information Systems
Agency (DISA) is pilot testing a cloud [1]; be rapidly provisioned and released with minimal
the National Aeronautics and Space
Administration (NASA) has announced management effort or service provider interaction.”
plans to develop a cloud that can be
used both internally and for
they survey the landscape and take an documents (i.e., the NIST 800 series).
collaboration with external research
inventory of best practices. They are Alternatively, individual cabinet-level
partners; [2] the Department of the
concerned about the risks inherent in agencies could provide clouds for their
Interior (DOI) has an Infrastructure as a
cloud computing but do not want to “community” of internal divisions, which
Service (IaaS) offering called the
restrict innovation. Pro-cloud civil could serve agencies’ individual
National Business Center Grid
servants believe cloud computing can compliance needs more easily than a
(NBCGrid), with other offerings set to
make federal Information Technology generalized multi-agency cloud. [5]
roll out in the near future; [3] and the
(IT) and services cheaper, easier, and DISA’s Rapid Access Computing
General Services Administration (GSA)
more secure—and it can—provided Environment sets a precedent for this
offers access to various externally
the cloud is implemented and model: it is intended to serve the entire
provided cloud applications through its
managed properly. Department of Defense, which has its
portal site, http://apps.gov. [4]
For many federal agencies, a own set of security standards in
The federal government is not
community cloud would be the best addition to those mandated for civilian
seriously considering cloud computing
service model to use (regardless of the agencies. [6] A third possibility is a
simply because of its hype. Agencies are
exact type of service being provided). “federated” hybrid of agency-specific
finding it increasingly costly and
The GSA, or another provider who is community clouds and a government-
difficult to procure, set up, maintain,
familiar with federal IT needs, could wide community cloud, all with certain
and secure traditional computing
stand up a multi-agency cloud that common standards (i.e., minimal
architectures. This may explain why
facilitates and enforces compliance with security baseline, universal protocols)
bodies such as the National Institute of
government-wide security standards but otherwise tailored to specific purposes.
Standards and Technology (NIST) and
such as those outlined in regulations Understanding the merits of a
the Government Accountability Office
(i.e., Federal Information Security community cloud requires
are holding off on setting rules and
Management Act [FISMA]) or guidance understanding fundamental cloud
standards for cloud computing while
10 IAnewsletter Vol 13 No 2 Spring 2010 • http://iac.dtic.mil/iatac

11. computing concepts, starting with the customer generally has no control using a software offering from one
definition of “cloud computing” over or knowledge of the provided provider and an infrastructure offering
provided by NIST: resources’ exact location but may from another. Commoditization of
“Cloud computing is a model for be able to specify location at a bandwidth allows clients to easily
enabling convenient, on-demand higher level of abstraction leverage distantly located resources—
network access to a shared pool of (e.g., country, state, or data center). something that was difficult only a few
configurable computing resources Examples of resources include years ago—and pay for use of those
(e.g., networks, servers, storage, storage, processing, memory, resources as if they were gas or
applications, and services) that can be network bandwidth, and electricity. Finally, cloud providers are
rapidly provisioned and released with virtual machines. particularly innovative in the services
minimal management effort or service ff Rapid elasticity—Capabilities can they offer and are developing new
provider interaction.” [7] be rapidly and elastically services all the time. [9] Cloud allows
NIST also lists five essential provisioned, in some cases users to leverage IT solutions with an
characteristics of cloud computing: automatically, to quickly scale out unprecedented level of granularity.
ff On-demand self-service—A and rapidly released to quickly An organization can pay an outside
consumer can unilaterally scale in. To the consumer, the cloud provider for data, applications,
provision computing capabilities, capabilities available for operating platforms, raw digital storage,
such as server time and network provisioning often appear and/or processing resources: Data as a
storage, as needed automatically unlimited and can be purchased in Service (DaaS), Software as a Service
without requiring human any quantity at any time. (SaaS), Platform as a Service (PaaS), and
interaction with each service’s ff Measured service—Cloud systems Infrastructure as a Service (IaaS),
provider. automatically control and optimize respectively. [10] A data-mining
ff Broad network access— resource use by leveraging a company providing its customers with
Capabilities are available over the metering capability appropriate to on-demand access to its records of
network and accessed through the type of service (e.g., storage, individual purchase histories is an
standard mechanisms that promote processing, bandwidth, and active example of DaaS; Google Apps are SaaS;
use by client platforms (e.g., mobile user accounts). The provider and a firm offering application development
phones, laptops, and PDAs). consumer can monitor, control, and environments to startups is selling PaaS;
ff Resource pooling—The provider’s report resource usage, thus and a company offering access to raw
computing resources are pooled to providing transparency of the computing resources is selling IaaS.
serve multiple consumers using a utilized service. [8] The split of assurance
multi-tenant model, with different responsibilities between the provider
physical and virtual resources Industry expert Dave Linthicum, and client varies depending on the
dynamically assigned and notes that cloud computing is similar to service. With DaaS and SaaS, the
reassigned according to consumer time-sharing on mainframes, but with provider has control over almost
demand. A sense of location some added features. For example, cloud everything. With PaaS, the client is
independence exists because the clients can “mix and match” solutions responsible for application security, and
IAnewsletter Vol 13 No 2 Spring 2010 • http://iac.dtic.mil/iatac 11

12. Software as a Service (SaaS) incentives and goals, which is not
necessarily the case in cloud computing.
Presentation Modality Presentation Platform In a public cloud, the relationship
between clients and providers is largely
transactional, and the clients do not
APIs know each other. The parties involved
have little basis for trust and may in fact
distrust one another to a certain extent.
Applications
Trust, or lack thereof, is a factor in all
five of the fundamental cloud security
challenges. These challenges all involve
Data Metadata Content
uncertainties about the provider’s
standard of care and how the provider
Platform as a Service (PaaS)
will treat the client (and the client’s data)
in the event of a problem. [12]
Integration & Middleware
ff Data protection
•• Where do data physically reside,
Infrastructure as a Service (IaaS) and does the data’s location
have legal ramifications?
APIs •• Are data safely protected
(i.e., by encryption) while
stationary or in motion within
Core Connectivity & Delivery
and across the cloud?
•• How is availability of data
assured in the cloud?
Abstraction
•• Does the provider take measures
to ensure that deleted data is
Hardware not recoverable?
ff Security control
•• What security controls does the
Facilities cloud provider need to
implement, and how?
•• How are assurance levels
effectively and efficiently
managed in the cloud?
ff Compliance
Figure 1 Provider Assurance Responsibility in Different Types of Service [11]
•• Is the cloud complying with all
the necessary guidance?
everything else is left to the provider. also has certain security advantages. For •• Can the provider substantiate
With IaaS, the client is responsible for example, a desktop computer almost claims that security controls are
everything but physical and (some never complies with an organization’s implemented sufficiently?
aspects of) network security. Regardless security policy “out of the box,” but a ff Multi-tenancy
of the service and inherent allocation of cloud can be configured so every new •• Are my assets vulnerable if
responsibility, cloud clients ultimately virtual machine created therein is another client is exploited by
leave the fate of their information assets compliant. Monitoring certain activities an attack?
in the provider’s hands (see Figure 1). and rolling out updates across a cloud is •• How does the cloud provider
The service provider is responsible relatively easy—unlike doing so across a keep different clients’ data
for maintaining, upgrading, and securing collection of distinct physical machines. separated and inaccessible from
the hardware and software (where However, cloud computing presents other clients?
applicable) on which the service runs. a variety of information assurance (IA) •• If a forensic/electronic discovery
Ideally, this setup allows users to stop challenges. One salient feature of the procedure is conducted on one
worrying about the security of their time-sharing model was trust. The users client’s data, how will the
information assets by leaving them in and owners of the old mainframes were
more competent hands. Cloud computing part of a community with common
12 IAnewsletter Vol 13 No 2 Spring 2010 • http://iac.dtic.mil/iatac

13. provider protect the may not want to answer questions about ignores other kinds of costs. What will it
confidentiality of other its security practices. Cloud SLAs also cost an agency if moving to the cloud
clients’ data? generally absolve the provider of liability compromises its ability to protect
ff Security governance in the event of a security breach. (This is sensitive data or meet mission
•• Who owns/accesses/deletes/ not the case with private and requirements? Agencies need to consider
replicates data in the cloud? community clouds: more on this later.) these kinds of costs as they evaluate
•• How can the client ensure If the transition of federal their information assets for “cloud
policy enforcement? information assets into the Cloud readiness” on a case-by-case basis. [14]
•• How can the client measure Computing Environment (CCE) is Once an agency has decided which
and track service/network inevitable, then how can the federal assets it can safely transition to the
performance? government effectively mitigate the risks cloud, it needs to choose the service
Figure 2 illustrates the layers of the inherent in the cloud? First, government model—or relationship between cloud
cloud and associated layers of security. organizations must decide whether to client and provider—that best fits its
Exacerbating these problems is the move certain assets to the cloud at all. requirements. The four cloud service
fact that contracts with public cloud On the face of it, spending $10 a day for models—public, private, community,
providers almost always take the form of cloud infrastructure seems less costly and hybrid—have different sets of costs
non-negotiable service-level agreements than spending $100 on in-house and benefits (see Figure 3).
(SLA) that severely limit, at best, the infrastructure (not to mention capital The public cloud service model is
client’s ability to see, audit, or control expenditure; it is less costly to start up a probably what many people would
back-end operations in the cloud. A virtual server in a cloud than to set up a consider the archetypal model of cloud
client’s ability to do so would create physical one). However, thinking only in computing. In the public cloud model, a
more difficulties than most providers terms of $10 versus $100 for regular provider sells cloud services to multiple
are willing to deal with. The provider maintenance is dangerous because it unrelated clients, or tenants. They leave
Policy & Procedures Goal: Trusted Environment, Well-Served &
Satisfied Users, Agency Success
Presentation Presentation
Information Data Encryption, database security
Modality Platform
APIs Applications/Service access control,
Applications
static code analysis, WAFs
Applications
Governance, Controls, Stakeholder Satisfaction…
Policy enforcement, rerouting and throttling of services,
validated identity claims, authentication and authorization,
Data Metadata Content Management
security event monitoring, alerting and notification,
contextual dashboard, independent key management
Integration & Middleware
Firewalls, NIDS, Zone base segmentation, dedicated
APIs Network
MPLS/VPN network connections
Secure hypervisor for segmentation,
Core Connectivity & Delivery Trusted Computing
message verification, trusted APIs
Abstraction
Massive scale, contractual constraints on storage locations,
Compute & Storage
controlled and secured server images, encryption
Hardware
Facilities Physical Infrastructure security, physical inventory
*Derived from CSA “Security Guidance for Critical Areas of Focus in Cloud Computing
Technology & Tools
Figure 2 Layers of Cloud Computing Environment (CCE) Security [13]
IAnewsletter Vol 13 No 2 Spring 2010 • http://iac.dtic.mil/iatac 13

14. back-end maintenance and operations most of the economic benefits of of the public cloud because it eliminates
to the cloud provider. This arrangement outsourced cloud service. For a considerable amount of redundant
is very cost-effective and, in theory, lets organizations with less sensitive assets, effort and cost. Members of the client
clients rest easy knowing the security of putting everything in a private cloud community can pay the provider for
their information assets is in good may create unnecessary costs, only what they use, or for the utility and
hands. However, the fundamental cloud inefficiencies, and redundancy. Also, if subscription cost. The latter would still
security challenges mentioned earlier an organization has difficulty securing likely total less than what the client
are most problematic in this model. its information assets in a traditional would have paid to operate its own
If a federal agency were to entrust setup, it is unlikely that transitioning to individual data centers.
its information assets to a cloud a private cloud will solve its problems. The last type of service model is a
provider under the terms of a standard Such an organization would benefit hybrid cloud, which combines two or
cloud SLA, the agency would have from having a trusted service provider more of the service models described
difficulty demonstrating compliance perform these functions. above. An organization could, for
with IA standards mandated by A community cloud is somewhere example, keep sensitive proprietary data
regulations, such as the FISMA. Most on the continuum between the public in its own private cloud and collaborate
public cloud providers would have to and private service models, and it enjoys on projects with industry partners in a
significantly retool their operations to some of the benefits of both. Like a community cloud. For users belonging
help federal agencies meet their IA public cloud, community clouds serve to the organization, these two clouds
obligations. Some providers are multiple tenants. The difference is that would, in effect, be seamlessly
attempting to do so (Amazon’s “virtual the tenants are not strangers but related integrated through a single sign-on
private cloud” is an example [16]), but, entities that share common system. The problem with hybrid clouds
for the time being, public clouds are characteristics and needs. An individual is that they share vulnerabilities in the
inappropriate for anything but the least client community member, multiple system’s least secure areas and present
critical, most low-risk federal members working cooperatively, or a new vulnerabilities. For instance, if it is
information assets. dedicated provider can operate easy for a user to switch between clouds
A private cloud can be operated by community clouds. Unlike public clouds, on his or her desktop computer, it is also
the same organization that uses it, or a community clouds are built and easy for that user to make a mistake and
dedicated provider can operate the operated on the clients’ terms: they can expose sensitive data. In addition,
cloud on the organization’s behalf. A be constructed to facilitate compliance integrated clouds mean integrated complex
private cloud, when managed properly, with standards that all clients use. Of all systems, which by definition are rife
is the most secure type of cloud service the cloud models, the community cloud with potential security vulnerabilities.
model because it is directly controlled is most similar to time-sharing in terms Returning to the central point of
by its client. Private clouds also make of the level of trust between all this article, a federal community cloud
more efficient use of physical IT assets stakeholders. This type of cloud also can provide a guaranteed IA baseline for
than traditional data centers, but lack offers many of the economic advantages its clients, whether they are
departments within an agency or
multiple agencies. It can reduce the cost
Compliance/regulatory laws mandate of providing effective security and
on-site ownership of data
Pros
eliminate significant redundancy. It can
Security and privacy also be fully accountable to its clients
and their oversight bodies (i.e., Office of
Reduce costs Latency & bandwidth guarantees
Management and Budget, Congress).
Absence of robust SLAs The clients and their oversight bodies
Resource sharing is more efficient
can have a reasonable level of visibility
Management moves to cloud provider Uncertainty around interoperability, into, and control over, cloud operations.
portability & lock in
All primary stakeholders could work
Consumption based on cost
Availability & reliability together to set policy and address
Faster time to roll out new services problems. Last but not least, federal
Dynamic resource availability Inhibitors community clouds can be used to
facilitate intra- and inter-agency
for crunch periods
cooperation within the framework of
the Federal Enterprise Architecture.
Setting up a community cloud and
Figure 3 Advantages and Disadvantages of Cloud Computing From a Federal Perspective [15] governance structure that will
14 IAnewsletter Vol 13 No 2 Spring 2010 • http://iac.dtic.mil/iatac