Security to Obscurity

One of the questions I have been regularly asked by colleagues and customers alike is how do I know which of the growing band of “enterprise” cloud service providers is providing a secure cloud infrastructure, how are they doing it and are they doing it well. At this stage cloud providers treat some of the answers as proprietary or confidential and getting at the detail is almost impossible. But is this the correct way for cloud providers to engage with potential customers and security professionals alike?

Recently Microsoft announced to the world its new Government Cloud Offering which offered security and privacy enhancements over the public cloud. All well and good with a smattering of security credentials (ISO27001, FIPS140-2, FISMA) but what does this mean in practice for this particular offering and more importantly what security is being provided to Job Public cloud customers. And does FIPS140-2 just mean implementing SSL Certificates or does it mean specialist HSM protected cryptographic key management controls?

Likewise last June Unisys launched their “Unisys Secure Cloud“  the focus being that it is protected with their patent pending Stealth technology. But what of firewalls, IDS/IPS, Access Controls etc and where is the independant technical validation of Stealth within this environment?

I’m sure similar could be said of all the enterprise cloud providers looking to take advantage of the numerous world wide Cloud marketing campaigns. The problem is with this lack of transparency comes lack of trust and confidence. If the only way to get visibility into this level of detail is to engage in protracted due diligence by potential customers of individual cloud providers then the cost savings offered up through cloud services is going to be swallowed up by consultants, technical advisers and lawyers.

In this age of compliance obligations no company will be able to migrate its computing services to the cloud without the assurance levels that first hand knowledge of the technical, logical and physical controls in place at the Cloud provider will give.

I suggest therefore that We need a new approach to Cloud security assurance that takes a similar path to approved public domain encryption algorithms. In this case security is in the secrecy of the cryptographic key and not the secrecy of algorithm. The translation for cloud is that the security should be in the proper implementation of the controls and not the controls themselves. If this can be achieved then there would be no reason for a Cloud provider to openly publish their security architecture and controls to the world thus enabling customers to identify those cloud providers that take security seriously and those that don’t. My guess is that those who don’t would be less likely to publish in the first place.

So my challenge to cloud providers – which one is prepared to be the first to openly publish their security architecture and controls enabling customers to make an informed decision about which cloud provider to go with.