Let the cloud buyer beware

In discussions with senior executive leadership and other decision makers, simply referencing “the cloud” without all parties understanding of the vast differences among various cloud solutions and the unique requirements and risks of each can be cause for real concern.

The potential benefits of cloud computing are well known, and many vendors broadcast these benefits to sell their cloud solutions or services. While proponents of the cloud will often point to the “Cloud First” policy to try to force the adoption of cloud technologies, this policy was intended to ensure agencies consider the use of cloud computing, but it does not require moving to the cloud where it does not make sense or is not cost effective to do so.

If the cloud is discussed broadly, it is very possible that incorrect assumptions and conclusions will be made.  When discussing potential cloud computing options, it is imperative that the specific service and deployment models are referenced versus using “the cloud” as a generic term or mixing use cases. Vendors often leverage the popularity of cloud computing and other customers’ success stories using a completely different model than the one being considered.

As an example, let’s consider the “community cloud” option, a deployment model that is intended to be provisioned for exclusive use by a community of consumers consisting of organizations that have shared concerns. Unfortunately, the potential cost savings that come with the economies of scale of large community cloud implementations mean that it is usually in the vendor’s best interest to make the community as large and inclusive as possible. As a result, the larger the community, the less likely it is that the member organizations truly share the same interests and concerns. Below are a number of risks and constraints that need to be considered when evaluating a government community cloud offering:

Processing and storage of controlled unclassified information (CUI).  Government community cloud solutions may be authorized to process and store only a subset of government data. For example, Microsoft’s Government Community Cloud (GCC) is now certified at the Department of Defense’s Level 2, which includes all data cleared for public release and information not classified as CUI or critical mission data, according to the Department of Defense Cloud Computing Security Requirements Guide. Level 4 information, which has not been approved for processing or storage on the GCC, refers to unclassified information that under law or policy requires protection from unauthorized disclosure as established by Executive Order 13556 or other mission critical data.

Inspection of encrypted communications.  As noted in a recent GCN article, the Trusted Internet Connection (TIC) initiative requires that federal agencies have the ability to inspect and analyze encrypted traffic entering and leaving their TIC boundary. However, the largest government community cloud providers do not support breaking open the encryption they use to secure the traffic. A compromise in the external community cloud environment would be able to bypass agency controls and inspection mechanisms and directly connect to the agency network without agency visibility of the malicious activity. 

A valuable target for adversaries. Every organization that joins a government community cloud adds to the aggregate net worth of existing tenants, increasing the bull’s-eye for adversaries. While cloud providers have controls in place to provide some mitigation, determined and properly financed nation-states and advanced persistent threats will be able to bypass controls through a zero-day exploit or unpatched vulnerabilities.

FedRAMP baseline may not meet all requirements.  While the Federal Risk and Authorization Management Program is an important baseline of security controls, it may not meet all of the requirements of mature government security organizations.

Shared tenant environment including non-federal government customers. Using a shared infrastructure with organizations that may have less stringent security standards and requirements puts the more mature organizations at elevated risk.

Background investigation requirements. Employees and outsourced third-party resources responsible for administering, monitoring and securing government community cloud systems and data usually are required to pass only a “moderate” background investigation and checks, which may not meet agency requirements.

Agency penetration testing, vulnerability assessments or audits. Agencies are not permitted to directly participate or define the tests/scans/frequency they require because the community cloud is a shared environment where every tenant gets the same service. Instead, the cloud service providers internally coordinate penetration testing and vulnerability scans on their schedule and with the scope/resources they choose to meet the FedRAMP requirement. 

Cloud computing decisions are much more complex than simply deciding whether or not to go to the cloud. Such decision must be based on the intended functionality, user base, data sensitivity and other organizational characteristics. It is imperative that the needs of each individual agency or organization be carefully evaluated to determine which cloud service and deployment model, if any, is appropriate. If senior executive leadership and decision makers are sold on “the cloud” without an understanding of the various service models, deployment models and architectural considerations, the results may be the opposite of what was intended, including an increase in costs, increased security risks and an IT team having to scramble to find a way to implement a cloud solution that does not fit.