1540-7993/12/$31.00 2012 IEEE Copublished by the IEEE Computer and Reliability Societies July/August 2012 3

From the editors

John ViegaEditor in Chief

Cloud Security: Not a Problem

T heres a lot of fear, uncertainty, and doubt around cloud security. Accord-ing to the 2012 Cisco Global Cloud Network-ing Survey, 72 percent of IT professionals cite data protection security as a major obstacle to cloud deployments.

According to Gartner, a leading IT analyst firm, less than 1 percent of enterprise email deployments in 2008 were cloud based, but by 2020, 50 percent are expected to be. Itd be a shame if misconceptions and sloppy thinking slow this down. Little differs between cloud and traditional applications:

Resource outsourcing. At least some comput-ing resources are controlled by someone else, and those resources live somewhere else. Infrastructure, operations, and physi-cal security are a concern.

Multi-tenancy. While not a strict prerequi-site for the cloud by most peoples defini-tion, its still one of the things that makes many cloud deployments special.

Scale. Because cloud applications often host many tenants, they sometimes scale far beyond what traditional applications require in terms of data and request rates, depending on the technologies under the hood.

The first two have obvious security implications. In fact, multi-tenancy is widely cited as a big security concern: people are afraid the boundaries between application and data might break down and lead to a breach in confidentiality or integrity.

With outsourcing, the primary difference in the cloud model is that most customers dont control the key resources they might if they were hosting the application themselves. But all the same security approaches weve been developing for decades apply here. For instance, we can make sure the right controls are in place for reducing attack surface, ensur-ing adequate authentication and authorization, and detecting and responding to breaches.

If cloud customers want to understand the security posture of the applications theyre using, they must rely on their cloud vendor to

provide visibility into its controls and practices. Many vendors are starting to provide that trans-parency by publishing controls to their custom-ers, but this varies on a case-by-case basis.

As for multi-tenancy, probably the biggest technical problem centers on data securitydata needs to be as secure as possible while still being easy to use and access. The obvious answer to this problem is encryption, but this presents a few practical challenges.

How do we perform effective key manage-ment? Do we escrow keys in the cloud, even if theyre encrypted? If so, that just moves the problem without solving it. The cloud trend seems to be toward two-factor authentica-tion with passwords and mobile phones. But theres still a disappointing lack of pervasive, strong authentication.

How can we encrypt data while still keep-ing it usable? For example, an important requirement for email archiving solutions is search. Using traditional encryption, data must be decrypted before it can be searched. Many customers wont want the keys kept server side alongside the application. And in reality, per-formance needs could result in caching signifi-cant data in memory, unencrypted. Another alternative is to ship the encrypted data to the customer for decryption and search, which is a huge bandwidth and latency issue.

Both academics and industry have been working on server-side private search, in which search can be performed without decrypting the data. This comes with some missing func-tionality (such as efficient wildcard search), but this technical challenge is largely solved.

I t doesnt make sense to compare cloud secu-rity to noncloud security, especially from a technical perspective. The bottom line is that we can only make valid comparisons for a spe-cific cloud and a specific noncloud deployment. The answer to all cloud security and resilience questions ends up being it dependsbased on the relative qualities of physical security, workforce security, infrastructure security, and application security.