There’s general agreement that standards are needed for cloud computing – so much agreement, in fact, that at least eight different groups have stepped up and are trying to fill the void.
As the range of groups involved suggests, the work has just begun, including on standards related to security. “It will be about two years before a comprehensive set of standards for cloud computing will be available,” predicts Qualys's Puhlmann.
One challenge is that companies just don’t have a long-enough history with cloud computing to create firm standards, or they work with only one or two cloud vendors so it’s difficult to generalize from their experiences. “A lot of work still has to be done before the industry understands where the security holes will come from with cloud computing,” says Paul Simmonds of the Jericho Forum.
AREAS OF EMPHASIS
Jericho Forum and Cloud Security Alliance cite 14 areas that need standards:
- Application security
- Business continuity and disaster recovery
- Compliance and audit
- Data center operations management
- E-discovery
- Encryption and key management
- Governance and enterprise risk management
- Identity and access management
- Incident response, notification, and remediation
- Information life-cycle management
- Physical security
- Portability and interoperability
- Storage
- Virtualization
In May, the Jericho Forum said it would work with the vendor-led Cloud Security Alliance , to promote best security practices for the cloud. Jericho Forum members include AstraZeneca, Boeing, BP, Eli Lilly, and KLM, as well as IT vendors such as IBM, Qualys, Hewlett-Packard Co. (NYSE: HPQ), Motorola Inc. (NYSE: MOT), and Symantec Corp. (Nasdaq: SYMC).
The two groups are driving development of standards in a wide range of areas including audit, applications, cryptography, governance, network security, risk management, storage, and virtualization.
There are at least six other groups working on cloud computing standards: the Open Cloud Manifesto, the Cloud Computing Interoperability Forum, CloudCamp, the Cloud Computing Use Cases Group, the Distributed Management Task Force, and the Object Management Group.
At the Jericho Forum and Cloud Security Alliance, step one is identifying the differences between on-premises security and cloud security, and examining what existing standards mesh with cloud operations.
Eventually, they expect to drive standards that let companies securely integrate different vendors’ cloud computing services and be assured that their information is safe in the cloud. Says Puhlmann, “If we find existing standards that work for cloud security, we will use them.”
— Paul Korzeniowski
Next Page: All the Flavors of Cloud Computing
Digg
Del.icio.us
Reddit
Email This
TWEET THIS
