The Open Data Center Alliance (ODCA) Security Monitoring usage model supports and depends heavily on work being done at the Cloud Security Alliance and CloudAudit. Both of these groups are made up primarily of vendors or vendor employees who supply security services and products or who have a vested interest in promoting the idea that the public cloud is safe and secure.
The Security Monitoring usage model (SM) was first published in June 2011 and was updated on March 1, 2012 as revision 1.1. What’s new is a small section that is designed to help enterprise IT managers create an RFP that helps enforce the guidelines put forward tin the SM usage model.
I took a look at the RFP tool, which you can access here. The tool is simple to use…perhaps overly so. There are just three questions posed in the security section: is the product open, can it interface with a SIEM (security information and event management) tool, and are there APIs? Despite the rather blunt approach taken by the ODCA RFP generator, the questions are a good starting point from which IT managers can build in more detail.
As I re-read the Security Monitoring requirements, I got a feeling that implementing these invasive monitors (the customer getting information from the provider) could be fairly problematic. While I agree that cloud providers should demonstrate that they have security measures in place, customers must agree to hold any discovered weakness in confidence for some period of time in order for a remediation effort to be mounted.
I think there is a lot more to be figured out in terms of how security posture is reported to customers.
The ODCA Security Monitoring usage model is worth reading in depth. Organizations that work with regulated data will likely find some very good questions to ask their cloud suitors in the pages of this slim, but densely packed document. Just be ready to hold the findings close to the vest so that nefarious actors aren’t given a hand up in compromising the cloud.
Table of Contents for my June 2011 inaugural coverage of the ODCA: 1. IT Users Band Together: a brief introduction to the ODCA 2. Virtual Machine Interoperability 3. Carbon Footprint 4. Security Monitoring 5. Security Provider Assurance 6. Regulatory Framework 7. Standard Units of Measure for IaaS 8. Service Catalog 9. I/O Controls