Roland Dobbins Dec 13, 2008

As you indicate, existing Best Current Practices (BCPs) for hosts, OSes, applications, and network infrastructure cover cloud computing models, just as they do non-cloud models.  In a cloud infrastructure, organizations are much more likely to benefit from the implementation of these BCPs by default at the infrastruture level, simply as a self-defense measure by cloud providers in order to keep cloud customer #1 from interfering with cloud customer #2, or external attackers from interfering with either (same as in current non-cloud deployments).

There’s no call to devise or invent any new or unique security mechanisms, processes, or procedures for cloud computing; simply the need, extant already for non-cloud systems, to implement the requisite BCPs to ensure confidentiality, integrity, and availability.  On the regulatory/legislative/compliance front, there certainly is a need for additional clarification and understanding - mainly effort to educate and ensure that implementors and auditors understand that the same principles apply in the cloud, and how they apply.  As you’ve alluded to in previous posts, questions of jurisdiction must be sorted; the reality is that these matters are very much subject to interpret today, it’s just that the cloud paradigm brings them to the forefront of consciousness.

Christofer Hoff Dec 18, 2008

I’d really like to see proof points that there are “less humans” involved in Cloud architectures.  It’s a “squeezing the balloon problem,” the workforce/labor pool simply shifts.

Automation is still not currently at levels that allows for the sort of self-governing architecture…yet.

Further, many of Alistair’s examples cited as sources for his statistics are years out of date.

I talk about this scale/eyeball issue in my response to Alistair’s post here:

http://rationalsecurity.typepad.com/blog/2008/12/alistair-croll-on-cloud-security-the-sky-is-falling-and-apparently-logicfacts-are-too.html

/Hoff

Rizwan Ahmad Feb 12, 2009

this all have been said so by Gartner