NIST Cloud Computing Security Reference Architecture

1 1 NIST Special Publication 500-299 1 2 3 4 NIST Cloud Computing 5 Security Reference Architecture 6 7 8 9 10 11 NIST Cloud Computing Security working group 12 NIST Cloud Computing Program 13 Information Technology Laboratory 14 15 16 17 18 19 2 This page left intentionally blank 20 21 Page 3 Reports on Computer Systems Technology The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the economy and public welfare by providing technical leadership for the nation s measurement and standards infrastructure.

2 ITL develops tests, test methods, Reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective Security and privacy of sensitive unclassified information in Federal computer systems. This document reports on ITL s research, guidance, and outreach efforts in Information Technology and its collaborative activities with industry, government, and academic organizations.

3 DISCLAIMER This document has been prepared by the National Institute of Standards and Technology (NIST) and describes standards research in support of the NIST Cloud Computing Program. Certain commercial entities, equipment, or material may be identified in this document in order to describe a concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that these entities, materials, or equipment are necessarily the best available for the purpose.

4 Page 4 Acknowledgements NIST gratefully acknowledges the broad contributions of the NIST Cloud Computing Security working group (NCC SWG), chaired by Dr. Michaela Iorga. Dr. Iorga was principal editor for this document with assistance in editing and formatting from Hannah Wal d, Technical Writer, Booz Allen Hamilton, Inc. The following list (in alphabetical order by last name) includes contributors1 and internal reviewers who previously agreed to be acknowledged in this document. The list will be updated when we receive more confirmations from our members.

5 CONTRIBUTORS: Wayne W. Armour, Independent Consultant Nadeem Bukhari, Kinamik Data Integrity William Butler, PhD., Capitol College Graduate School of Information Assurance Alvaro A. Cardenas, Fujitsu Laboratories of America Pw Carey, Compliance Partners, LLC Kyle Coble, Department of Homeland Security Vince Grimaldi, Independent Consultant Muhammad F. Islam, PhD candidate, George Washington Univ. & Booz Allen Hamilton, Inc. Jerry Kickenson, SWIFT Juanita Koilpillai, Electrosoft Services, Inc.

6 Prabha Kumar, PhD., Department of Defense Chief Information Office Nancy M. Landreville, PhD., EmeSec (under-contract Dep. of Veteran Affairs) & UMD Anne L. Lee, PhD., Air Force - Space and Missile Systems Center Cheng-Yin Lee, Independent Consultant Chan Lim, IBM Ketan Mehta, Booz A llen Hamilton, Inc. Keyun Ruan, PhD., University College Dublin & EADS , XENSIX Inc. Arnab Roy, Fujitsu Laboratories of America Michael A. Salim, American Data Technology, Inc. Ken E. Stavinoha, PhD.

7 , Cisco Systems INTERNAL REVIEWERS: Wayne W. Armour, Independent Consultant Jerry Kickenson, SWIFT Juanita Koilpillai, Electrosoft Services, Inc. Michael A. Salim, American Data Technology, Inc. 1 Contributors are members of the NCC SWG who dedicated substantial time on a regular basis to research and development in support of this document. Page 5 Ken E. Stavinoha, PhD., Cisco Systems Steven Woodward, Cloud Perspectives OTHER ACTIVE MEMBERS: Richard J Blake, General Services Administration Ron Martin, Open Security Exchange Sundararajan Ramanathan, Capgemini NOTE: All views expressed in this document by our contributors are their personal opinions and not those of the organizations with which they are affiliated.

8 Page 6 Table of Contents EXECUTIVE SUMMARY ..10 1 INTRODUCTION ..12 AUDIENCE ..12 OBJECTIVES ..13 SCOPE ..14 STRUCTURE OF THE DOCUMENT ..15 USING THE DOCUMENT ..16 2 BACKGROUND ..18 REVIEW OF THE FEDERAL Cloud Computing STRATEGY ..18 APPROACH ..19 RISK MANAGEMENT ..22 The Risk Management Framework ..22 Managing the Risk Inherent in Cloud Services ..26 ASSUMPTIONS, CLARIFICATIONS AND DEFINITIONS ..28 Cloud Computing Service and Deployment Models ..28 Service Models .. 28 Deployment Models .. 29 Cloud Ecosystem.

9 30 Cloud Consumer ..32 Cloud Provider ..32 Primary Cloud Provider Example .. 33 Intermediary Cloud Provider Example .. 33 Cloud Broker ..34 Differentiating Business and Technical Broker 35 A Cloud Brokerage Example .. 36 Cloud Carrier ..37 Cloud Auditor ..37 Business Models and NIST Reference Architecture ..38 Security Conservation Principle ..39 3 Security Reference Architecture : DATA ANALYSIS METHODOLOGY ..42 DATA COLLECTION ..43 DATA AGGREGATION AND VALIDATION ..44 DERIVING THE Security RESPONSIBILITIES FOR THE INTERMEDIARY PROVIDER AND TECHNICAL BROKER.

10 46 MAPPING Security COMPONENTS TO Security CONTROL FAMILIES ..47 EMPIRICAL DATA ANALYSIS AND THE GENERIC HEAT MAP ..49 4 Security Reference Architecture : FORMAL MODEL ..52 OVERVIEW OF THE FORMAL MODEL ..52 CONSUMER - ARCHITECTURAL COMPONENTS ..55 Secure Cloud Consumption Management ..56 Secure Business Support .. 58 Secure Configuration .. 58 Secure Portability and Interoperability .. 59 Secure Organizational Support .. 60 Secure Cloud Ecosystem Secure Functional Layer .. 61 PROVIDER ARCHITECTURAL COMPONENTS.