Reference Model
of Cloud Computing
Public Carrier’s View
Vladimir Belenkovich
April, 14, 2010
SG-17 meeting
Thursday, April 15, 2010
Sources
• Open Cloud Manifesto, Spring 2009
http://www.opencloudmanifesto.org/
• Cloud Computing definition
NIST, version 15
• Cloud Standards Summit, July 2009, OMG
http://cloud-standards.org
Thursday, April 15, 2010
Document
Security Guidance
for
Critical Areas of Focus
in
Cloud Computing V2.1
Prepared by the
Cloud Security Alliance
December 2009
Thursday, April 15, 2010
explained in detail below.
Figure 1 - NIST Visual Model of Cloud Computing Definition
Copyright © 2009 Cloud Security Alliance
Thursday, April 15, 2010
14
many different consumers.
Multi-tenancy can also take on different
definitions depending upon the cloud service
model of the provider; inasmuch as it may
entail enabling the capabilities described above
at the infrastructure, database, or application
levels. An example would be the difference
between an IaaS and SaaS multi-tenant
implementation.
Cloud Architecture domain
Cloud deployment models place different
importance on multi-tenancy. However, even
in the case of a private cloud, a single
organization may have a multitude of third
party consultants and contractors, as well as a
desire for a high degree of logical separation
between business units. Thus multi-tenancy
concerns should always be considered.
Figure 6 - Mapping the Cloud Model to the Security Cloud
Control &
ComplianceModel
Model
Reference
Once this gap analysis is complete, per the Understanding
requirements of the
anyrelationships
regulatory or other
and compliance
mandates, it becomes much easier to determine
what needsbetween
to be done
in order
to feed back into a
dependencies
Cloud
Computing
risk assessment framework; this, in turn, helps
to determine
the gaps and ultimately
models
is criticalhow
to understanding
Cloud risk
should be addressed: accepted, transferred,Computing
or mitigated.security risks. IaaS is the
foundation of all cloud services, with PaaS
It is important to note that the use of cloud computing as an operational model does not inherently
building upon IaaS, and SaaS in turn building
provide for or prevent achieving compliance. The ability to comply with any requirement is a
upon PaaS as described in the Cloud Reference
direct result of the service and deployment model utilized and the design, deployment, and
Model diagram. In this way, just as capabilities
management of the resources in scope.
are inherited, so are information security issues
and risk.
It isprovides
important
to illustrations
note that of the generic
For an excellent overview of control frameworks
which
good
control framework alluded to above, see the Open Security Architecture Group’s ‘landscape’ of
Figure - Cloud
Reference
Model
security
architecture
patterns documentation, or the always useful and recently updated NIST
Figure
6
Mapping
theModel
Cloud Model
the Security
Control
Compliance Model
Thursday,
April
15,
2010
Figure 6 - Mapping the Cloud
to thetoSecurity
Control
& &Compliance
Model
Presentation
Modality
Presentation
Platform
APIs
Applications
Data
Metadata
Content
Integration and Middleware
Cloud details
APIs
Core connectivity
SaaS
Abstraction
Hardware
Facilities
Thursday, April 15, 2010
PaaS
IaaS
Let’s get rid of
hierarchy
SaaS
Presentation
Modality
IaaS
PaaS
Core connectivity
Presentation
Platform
APIs
Integration and
Middleware
Applications
Abstraction
Hardware
Facilities
Thursday, April 15, 2010
APIs
Data
Metadata
Content
Let’s move it around
PaaS
Integration and Middleware
APIs
SaaS
IaaS
Core Connectivity
Presentation Modality
Presentation Platform
APIs
Abstraction
Applications
Hardware
Facilities
Thursday, April 15, 2010
Data
Metadata
Content
Let’s remove some
details
PaaS
Integration and Middleware
SaaS
IaaS
Core Connectivity
Applications
Abstraction
Hardware
Facilities
Thursday, April 15, 2010
Data
Metadata
Content
Methodology needed
• Trusted service cloud
• Service methodology merged with security
methodology
• Standards reuse
Thursday, April 15, 2010
NGOSS Methodology
• M.3050.0-4 eTOM
• M.3190 Shared Information and Data (SID)
• Role models, stakeholders
• TNA - Technology Neutral Architecture
• Business view ➔ System view ➔
Implementation view ➔ Performance view
Thursday, April 15, 2010
Simple rule of thumb
Standards reusability is the only way to cope
with the complexity spell.
Thursday, April 15, 2010
Thank you!
vbelenkovich@gmail.com
Skype: vbelenkovich
Thursday, April 15, 2010