Dennis Moreau. Security, Compliance and Trust in Cloud: Coupling Issues.

Cloud Computing Conference - Cloud Slam 2009.
Abstract. While cloud computing promises major agility, hosting and implementation advantages for an innovative class of applications and services, it also introduces some new complexities in the areas of validating security posture, assessing regulatory/statutory compliance, establishing coherent trust levels across the service stack and modeling risk across more coupled assets and service composition.
Cloud infrastructures often leverage the asset isolation, resource sharing and provisioning dynamics of virtualization technology. Isolation limits the visibility of security configuration across layers of complex technology, each with emerging vulnerabilities and consequent control and remediation requirements. Intimate resource sharing creates a degree of coupling of both security posture and operational behavior of co-hosted assets. The fluid nature of workload distribution over dynamically provisioned hosting stacks, places new demands on both configuration visibility and security configuration policy alignment.
Evolving regulatory controls for service isolation and inconsistent international privacy control requirements elevate the need for better situation awareness and more comprehensive control over the service hosting stack than in traditional computing environments. Multi-tenancy and application composition, elevate the need for better infrastructure health, security posture and compliance visibility across cooperating participants.
Each of these issues introduces new complexity into efforts to effectively understand risk, support effective governance decisions and implement appropriate control objectives.
This session will establish the technical basis for this complexity and the informational/methodological basis for effectively addressing it in emerging hosting environments.

Video of the session: