Cloud Computing - Overview of Information Assurance Concerns and Opportunities

Cloud computing is an emerging trend which has progressed to the point of serious adoption in both public and private sector organizations, yet it remains a relatively immature paradigm, one which dictates a revision to the traditional characterization of risk in information technology environments. As a means of an introduction to those changes, this paper offers an overview of the information assurance aspects of cloud computing with a focus on potential security advantages and pitfalls. While many of the security concerns associated with cloud computing are shared with traditional computing models, this paper will focus on those issues unique to cloud computing or that are exacerbated by it. The intended audience is anyone who is considering the adoption of cloud computing and who needs to understand the security risks and potential opportunities cloud computing provides as part of a risk management process. Cloud computing is an evolving concept and various definitions have been offered, some with widely varying scope. However, boiled down to the basic concepts and simply stated, cloud computing can be described as a style of computing in which dynamically scalable and often virtualized resources are provided as a service over the network. 1 Examples of cloud computing delivery models vary from infrastructure as a service (IaaS) where one can lease capabilities such as storage or computing resources (e.g., Amazon Simple Storage Service and Elastic Compute Cloud), platform as a service (PaaS) where one can lease an application development environment (e.g., The Microsoft Azure Services Platform) and software as a service (SaaS) which offers network based applications (e.g., Facebook, Google docs). The figure at the right illustrates how these various classes of cloud computing offerings build upon one another and offers additional examples from the commercial space. SaaS Software as a Service: Builds upon PaaS to offer complete applications customizable by the user to a limited degree and utilizing a security model developed by the provider. PaaS Platform as a Service: Builds upon IaaS to offer development environments which are leveraged by the user to build custom applications. IaaS Infrastructure as a Service: Includes the foundational elements such as storage, operating system instances, networking, and identity management upon which development platforms and applications can be layered.