Cloudware Security - Guide to Cloud Computing for Business and Technology Managers - page 403

While the discussion has separated network security from data security,
the reality is that they should be considered together when planning the
security strategy. A risk assessment will determine which parts of the system
must be encrypted, and if transport encryption is required, then the data
must be sensitive enough to protect, so storage encryption will be required
also. The extent of this security will be determined by what the likely risk of
data leakage will be, as a trade-off against reduced network performance.
Another major shift in security thinking for cloud deployments is created
by the dynamic environment of virtualization. Traditional approaches to IT
security assume a static infrastructure that expands in a planned, orderly
way. If more storage is required, it is designed, incorporated into the overall
security strategy, and then implemented. Security policies are amended if
need be, and new procedures commissioned accordingly. Usually, the data
store is deep within a hardened security perimeter. In terms of off-premise
data centers, this is certainly the case.
19.3.4 Instance Security
However, the agile, collaborative environment of the cloud, which exposes
internal services for external consumption, which dynamically provisions
extra compute and storage resources on demand, is a more challenging beast
to tame. An enterprise must now be more concerned with instance security.
The secure data store is now a virtual entity, composed of a number of secure
repositories that are associated with individual service instances. Whereas
the scope of a traditional security model was that of the system to be secured,
the scope is now limited to a particular instance but also is multiplied by the
number of instances that are executing at any one time. It follows that cen-
tralized management of security is more complex, and more of the security
controls require delegating to the individual services themselves. Instance
security is provided in the following ways:
1. Instance-level firewall: : Typically, the cloud provider will provide a
firewall for each VLAN that is present. This firewall serves to virtu-
ally separate the traffic between user's respective VLANs. Bearing
in mind the caveat mentioned earlier that the physical separation
of traffic is not implemented with VLANs, it is necessary to ensure
that each instance has a firewall to marshal only authorized traf-
fic into the associated virtual machine. As this relates to applica-
tion security, it is clearly not the responsibility of the cloud provider
and therefore may require extra in-house expertise developing on
the part of the consuming enterprise. Individual instance firewalls
are controlled on a fine-grained basis, and it is likely that different
instances will present different requirements. However, this is the
maintenance cost of ensuring that only the appropriate data are
passed onto each instance.