Security in Cloud Computing Not So Different from Security in Telco
During a recent “Cloud Computing in Telecom” SCOPE workshop, presenters and attendees expressed considerable interest in cloud security. Presenter Rao Vasireddy of Alcatel-Lucent, who advocated using “secure by design” principles to secure the cloud, talked to Leslie Guth from SCOPE about his presentation.
LG: What specifically causes concern in cloud security for users and service providers?
RV: According to recent industry research, 72% of organizations are “extremely concerned” or “very concerned” about security in the cloud environment (2010 research firm TheInfoPro). Concerns range from phishing and data loss and recovery to regulatory compliance and everywhere in between.
LG: What are the security concerns when deploying a Telecom application in the cloud?
RV: It is often believed that security in cloud computing is completely different than security in a traditional Telco environment. But this is not necessarily true. Many security issues are the same for cloud computing as for traditional IT technologies (e.g. phishing, data loss).
LG: Could you give us a few examples of cloud computing security issues?
RV: Sure. Cloud computing security issues include shared technology vulnerabilities, data loss or leakage, malicious insiders, hijack traffic, insecure API, nefarious use of service or abuse cases and unknown risk profiles. These all pose serious threats to secure cloud computing.
LG: What security concerns are specific to the telecom environment?
RV: Security concerns in a telecom environment range from secure management, control, and user data/sessions to secure infrastructure, services, and applications. Secure IT, operations and development along with compliance and security by design are also specific to the telecom environment.
LG: You mentioned securing the cloud can be done in much the same way that traditional Telco environments are secured. Could you elaborate on this?
RV: The complex issues of security in a cloud environment need to be simplified with an objective to establish a security baseline by leveraging current practices, standards and well-known security attributes as metrics. For example, key security attributes include access control, authentication/authorization, data confidentiality, privacy, data integrity, data confidentiality and non-repudiation. These metrics can be analyzed to determine where shortcomings or security gaps exist and how countermeasures can be applied.
The “secure by design” process has been useful in the development and maintenance of Telco equipment and solutions. The process has a proven track record in the development and operations of telecom and enterprise solutions. It can be used and adapted by leveraging cloud computing security standards and best practices and lessons learned in the telecom space, for example, leveraging practices such as implementing hardening access privileges.
LG: What are some of the specific attributes of the “secure by design” process that are important to note?
RV: The “secure by design” process removes or reduces the risk opportunity, sets the perimeter wherever you choose, creates resilience, creates transparency in security, makes access control context-sensitive, certifies the systems and meets compliance regulations.
As an addition, telecom can also leverage traditional cloud computing configurations such as Software as a Service (SaaS), which delivers online services providing traditional and custom on-demand applications; Platforms as a Service (PaaS), an open development platform that allows application developers to build or modify SW for faster and cheaper TTM; and Infrastructure as a Service (IaaS) which facilitates the sell transport, CDN, computing resources on a pay-per-use basis.
LG: What particular aspects of telecom synergy could be leveraged?
RV: Peering, settlement, SLA’s, customer support, multi-vender interoperability, global footprint and mobility can all be leveraged.
LG: Why would the telecom industry want to enter the cloud market and how can “security by design” mitigate the risks?
RV: The telecom industry has new challenges and opportunities. Cloud computing is a new opportunity for telecom, while creating security in this environment is a new challenge.
The need for security in the cloud environment is strong due to an increased need for regulatory compliance, a need to provide a guarantee of security and privacy to protect sensitive corporate data and consumer privacy, and a need to offer a reliable, available service.
“Security by design” is attractive because standards and compliance are built in. Standards enable organizations to build security programs in a consistent and effective manner. “Security by design” standards allow for strong information security organization, unambiguous and up-to-date security policies and awareness, identification of critical assets and risk management, an adaptable information security architecture, security that is integrated in all phases of the product lifecycle, a testable business continuity program, and standards-based security programs.
“Security by design” allows the creation of resilience and transparency and it allows for secure assets, data, and users, anytime, anywhere.
LG: What steps should be taken before employing telecom security standards in cloud computing?
RV: First, it is important to identify potential impacts on standards development and priorities for standards needed to promote and facilitate cloud computing. Also, it is essential to investigate future study items and related actions for fixed and mobile networks and analyze how interoperability can be explored in cloud computing.
Potential impacts on standards development need to be identified. These may include NGN including mobile and overlaying platforms; transport layer technologies; terminals and application aspects over broadband networks; ICT and climate change; management and control including signaling; interface of networks and interoperability; quality of service and security; and distributed media-rich processing and intelligent media coding.
LG: How would you summarize the connection between telecom and security technologies?
RV: In short, telecom and security technologies have a symbiotic relationship. Telecom has a proven track record of security, scalability, reliability, operations, and customer trust. “Security by design” is key to telecom and cloud security. Synergy between cloud and telecom security is driven by common customer and business issues as well as technology and standards.
Thanks to Rao Vasireddy of Alcatel-Lucent for participating in this interview.
SCOPE Alliance’s recent “Cloud Computing in Telecom” workshop was an important step toward what will be an ongoing security in cloud computing in telecom discussion. We look forward to continuing this discussion as we explore the opportunities that cloud computing can offer users and service providers. We invite those who are interested in this topic to visit the SCOPE website at www.scope-alliance.org and let us know your specific area of interest to help further this discussion.
SCOPE Alliance will be publishing a white paper on this topic in 2011.