Open Data Center Alliance, Part 4--Security Monitoring

Cameron Sturdevant Cameron Sturdevant is the executive editor of Enterprise Networking Planet. Prior to ENP, Cameron was technical analyst at PCWeek Labs, starting in 1997. Cameron finished up as the eWEEK Labs Technical Director in 2012. Before his extensive labs tenure Cameron paid his IT dues working in technical support and sales engineering at a software publishing firm . Cameron also spent two years with a database development firm, integrating applications with mainframe legacy programs. Cameron's areas of expertise include virtual and physical IT infrastructure, cloud computing, enterprise networking and mobility. In addition to reviews, Cameron has covered monolithic enterprise management systems throughout their lifecycles, providing the eWEEK reader with all-important history and context. Cameron takes special care in cultivating his IT manager contacts, to ensure that his analysis is grounded in real-world concern. Follow Cameron on Twitter at csturdevant, or reach him by email at
By Cameron Sturdevant  |  Posted 2011-06-17 Print this article Print

security monitoring

Usage Model diagram from the ODCA Security Monitoring recommendations released late last month

The Open Data Center Alliance (ODCA) Security Monitoring Usage Model supports and depends heavily on work being done at the Cloud Security Alliance and CloudAudit. Both of these groups are made up primarily of vendors or vendor employees who supply security services and products or who have a vested interest in promoting the idea that the public cloud is safe and secure.

In the words of CloudAudit, "The goal of CloudAudit is to provide a common interface and namespace that allows cloud computing providers to automate the Audit, Assertion, Assessment, and Assurance (A6) of their infrastructure (IaaS), platform (PaaS), and application (SaaS) environments and allow authorized consumers of their services to do likewise via an open, extensible and secure interface and methodology." Security monitoring definitely takes two to tango, and it seems that the vendor organizations and the ODCA are listening to the same tune. If Bob want to rent cloud resources from Alice that are protected from a malicious man-in-the-middle, then they need a common framework that enables private communication about the security of the compute environment.

One of the main goals of the ODCA Security Monitoring usage model is the creation of standard reporting from the cloud provider to the cloud consumer that enables convenient integration with enterprise reporting systems.

Among the more interesting usage requirements is the ability of the cloud provider to supply "dedicated capabilities with specific resources and reserved for specific customers." Ouch. The ODCA acknowledges that this would likely be a premium service that would cost more and at the same time likely limit some of the key benefits of cloud computing including scalability.

The ODCA Security Monitoring usage model is worth reading in depth. Organizations that work with regulated data will likely find some very good questions to ask their cloud suitors in the pages of this slim, but densely packed document.

Table of Contents for the Series:

1. IT Users Band Together: a brief introduction to the ODCA 2. Virtual Machine Interoperability 3. Carbon Footprint 4. Security Monitoring 5. Security Provider Assurance 6. Regulatory Framework 7. Standard Units of Measure for IaaS 8. Service Catalog 9. I/O Controls |

Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel