Cloud Computing
Architecture, IT Security, & Operational Perspectives
Steven R. Hunt
ARC IT Governance Manager
Ames Research Center
Matt Linton
IT Security Specialist
Ames Research Center
Matt Chew Spence
IT Security Compliance Consultant
Dell Services Federal Government
Ames Research Center
August 17, 2010
Agenda
 Introductions
» Steve Hunt
 What is cloud computing?
» Matt Chew Spence
 How can NASA benefit from cloud computing?
» Matt Chew Spence
 How is NASA implementing cloud computing?
» Matt Linton
 How does NASA secure cloud computing?
» Matt Linton
 Q&A
» Presentation Team
Extended Presentation
 FISMA & Clouds
» Matt Chew Spence
» Steve Hunt
 Assessment, Authorization, & FedRAMP
» Steve Hunt
Agenda
OBJECTIVE: Overview of cloud
computing and share vocabulary
 Introductions
» Steve Hunt
 What is cloud computing?
» Matt Chew Spence
 How can NASA benefit from cloud computing?
» Matt Chew Spence
 How is NASA implementing cloud computing?
» Matt Linton
 How does NASA secure cloud computing?
» Matt Linton
 Q&A
» Presentation Team
Extended Presentation
 FISMA & Clouds
» Matt Chew Spence
» Steve Hunt
 Assessment, Authorization, & FedRAMP
» Steve Hunt
What is Cloud Computing?
Cloud Computing – NIST Definition:
“A model for enabling convenient, ondemand network access to a shared
pool of configurable computing
resources (e.g., networks, servers,
storage, applications, and services)
that can be rapidly provisioned and
released with minimal management
effort or service provider interaction”
What is Cloud Computing?
Conventional Computing
vs.
Cloud Computing
Conventional
Cloud











Manually Provisioned
Dedicated Hardware
Fixed Capacity
Pay for Capacity
Capital & Operational
Expenses
 Managed via Sysadmins
Self-provisioned
Shared Hardware
Elastic Capacity
Pay for Use
Operational Expenses
Managed via APIs
What is Cloud Computing?
Five Key Cloud Attributes:
1.
2.
3.
4.
5.
Shared / pooled resources
Broad network access
On-demand self-service
Scalable and elastic
Metered by use
What is Cloud Computing?
Shared / Pooled Resources:
 Resources are drawn from a common pool
 Common resources build economies of scale
 Common infrastructure runs at high efficiency
What is Cloud Computing?
Broad Network Access:
 Open standards and APIs
 Almost always IP, HTTP, and REST
 Available from anywhere with an internet
connection
What is Cloud Computing?
On-Demand Self-Service:
 Completely automated
 Users abstracted from the implementation
 Near real-time delivery (seconds or minutes)
 Services accessed through a self-serve
web interface
What is Cloud Computing?
Scalable and Elastic:
 Resources dynamically-allocated between
users
 Additional resources dynamically-released
when needed
 Fully automated
What is Cloud Computing?
Metered by Use:
 Services are metered, like a utility
 Users pay only for services used
 Services can be cancelled at any time
What is Cloud Computing?
Three Service Delivery Models
IaaS: Infrastructure as a Service
Consumer can provision computing resources within
provider's infrastructure upon which they can deploy and
run arbitrary software, including OS and applications
PaaS: Platform as Service
Consumer can create custom applications using
programming tools supported by the provider and
deploy them onto the provider's cloud infrastructure
SaaS: Software as Service
Consumer uses provider’s applications running on
provider's cloud infrastructure
• Virtual
Machines
• Virtual Networks
• Auto Elastic
• Continuous
Integration
IaaS
PaaS
• Built for Cloud
• Uses PaaS
SaaS
What is Cloud Computing?
Service Delivery Model Examples
Amazon
Google
Microsoft
Salesforce
SaaS
PaaS
IaaS
Products and companies shown for illustrative purposes only and should not
be construed as an endorsement
What is Cloud Computing?
Cloud efficiencies and improvements
 Cost efficiencies
 Time efficiencies
 Power efficiencies
 Improved process
control
 Improved security
 “Unlimited” capacity
$
Proces
s
Proce
ss
Process
•
Burst capacity (overprovisioning)
• Short-duration projects
• Cancelled or failed missions
•
• Procurement
Network connectivity
• Standardized, updated base images
• Centrally auditable log servers
• Centralized authentication systems
• Improved forensics (w/ drive image)
Agenda
OBJECTIVE: Discuss requirements,
use cases, and ROI
 Introductions
» Steve Hunt
 What is cloud computing?
» Matt Chew Spence
 How can NASA benefit from cloud computing?
» Matt Chew Spence
 How is NASA implementing cloud computing?
» Matt Linton
 How does NASA secure cloud computing?
» Matt Linton
 Q&A
» Presentation Team
Extended Presentation
 FISMA & Clouds
» Matt Chew Spence
» Steve Hunt
 Assessment, Authorization, & FedRAMP
» Steve Hunt
How can NASA benefit from cloud computing?
Current IT options for Scientists
Requirements*
Science-scale
application
development
Very large data
set processing
Missions
Compute
intensive
processing
Timely sharing of
results with
collaborators and
the public
Current Options*
BUILD IT
Build my own IT infrastructure
that may/may not comply with
Federal/Agency IT security
standards.
BUY IT
Go through a lengthy
procurement and provisioning
process for basic IT services
DO NOTHING
The current basic IT services
model is cost prohibitive and I
cannot afford to process my data
and share with collaborators and
the public at large.
* Requirements and Options documented in over 30+ interviews
with Ames scientists as part 2009 NASA Workstation project.
How can NASA benefit from cloud computing?
Scientists direct access to Nebula cloud computing
Mission Objectives
MISSION
Explore, Understand, and Share
OCIO
INNOVATION
USE CASES
Aeronautics
Process
Large
Data
Sets
Exploration
Run
Compute
Intensive
Workloads
Science
Scale-out for
one-time
events
High Compute
Space Ops
Store
mission &
science
data
Require
infrastructure
on-demand
Vast Storage
Shared Resource
High Speed
Networking
Mission Support
Share
information
with the
public
How can NASA benefit from cloud computing?
Excellent example
of how OCIOsponsored
innovation can be
rapidly
transformed into
services that
address Agency
mission needs
Super
Computer
TARGET
COMPUTE
PLATFORM
Server-based
compute resources
Desktop
Offer scientists services to address the gap
High-end
Compute
Vast Storage
High Speed
Networking
How can NASA benefit from cloud computing?
ROI and ARC Case Study
POWER: Computers typically require 70% of their
total power requirements to run at just 15%
utilization.
*15% utilization based on two reports from Gartner Group, Cost of Traditional
Data Centers (2009), and Data Center Efficiency (2010).
How can NASA benefit from cloud computing?
ROI and ARC Case Study
 Operational Enhancements:
» Strict standardization of hardware and infrastructure
software components
» Small numbers of system administrators due to the
cookie-cutter design of cloud components and
support processes
» Failure of any single component within the Nebula
cloud will not become reason for alarm
» Application operations will realize similar efficiencies
once application developers learn how to properly
deploy applications so that they are not reliant on any
particular cloud component.
Agenda
OBJECTIVE: Overview of how NASA
is implementing cloud computing
 Introductions
» Steve Hunt
 What is cloud computing?
» Matt Chew Spence
 How can NASA benefit from cloud computing?
» Matt Chew Spence
 How is NASA implementing cloud computing?
» Matt Linton
 How does NASA secure cloud computing?
» Matt Linton
 Q&A
» Presentation Team
Extended Presentation
 FISMA & Clouds
» Matt Chew Spence
» Steve Hunt
 Assessment, Authorization, & FedRAMP
» Steve Hunt
How is NASA implementing cloud computing?
How is NASA implementing cloud computing?
How is NASA implementing cloud computing?
How is NASA implementing cloud computing?
Nebula Principles
 Open and Public APIs, everywhere
 Open-source platform, apps, and data
 Full transparency
» Open source code and documentation
releases
 Reference platform
» Cloud model for Federal Government
How is NASA implementing cloud computing?
Nebula User Experience
Nebula IaaS user will have an experience
similar to Amazon EC2:
 Dedicated private VLAN for instances
 Dedicated VPN for access to private VLAN
 Public IPs to assign to instances
 Launch VM instances
 Dashboard for instance control and API access
 Able to import/export bundled instances to
AWS and other clouds
Products and companies named for illustrative purposes only and should not be
construed as an endorsement
How is NASA implementing cloud computing?
Architecture Drivers
 Reliability
 Availability
 Cost
 IT Security
How is NASA implementing cloud computing?
Shared Nothing
 Messaging Queue
 State Discovery
 Standard Protocols
Automated
• IPMI
• PXEBoot
• Puppet
How is NASA implementing cloud computing?
Nebula Infrastructure Components
 Cloud Node
 Network Node
 Compute Node
 Volume Node
 Object Node
 Monitoring / Metering / Logging / Scanning
How is NASA implementing cloud computing?
Cloud Node
LDAP
Data
Store
Redis KVS
Puppet
RabbitMQ
PXE
Ubuntu OS
Nova
Cloud
Node
How is NASA implementing cloud computing?
Compute Node
Project VLAN
Running Instance
LibVirt
Brctl
KVM
802.1(q)
Puppet
PXE
Ubuntu OS
Nova
Compute
Node
How is NASA implementing cloud computing?
Volume Node
Exported Volume
Nova
Volume
Node
AoE
Puppet
LVM
PXE
Ubuntu OS
How is NASA implementing cloud computing?
Object Node
Nova
Object
Node
Nginx
Puppet
PXE
Ubuntu OS
How is NASA implementing cloud computing?
Network Node
Project
VLAN
Brctl
Public
Internet
IPTables
Puppet
802.1(q)
PXE
Ubuntu OS
Nova
Network
Node
How is NASA implementing cloud computing?
Pilot Lessons Learned
- Automate Everything
 No SysAdmin is perfect
 99% is not good enough
 NEVER make direct system changes
 When in doubt - PXEBoot
How is NASA implementing cloud computing?
Pilot Lessons Learned
- Test Everything
 KVM + Jumbo Frames
 Grinder
 Unit Tests / Cyclometric Complexity
 TransactionID Insertion (Universal Proxy)
How is NASA implementing cloud computing?
Pilot Lessons Learned
- Monitor Everything
 Ganglia
 Munin
 Syslog-NG + PHPSyslog-NG
 Nagios
 Custom Log Parsing (Instance-centric)
Agenda
OBJECTIVE: Overview of technical
security mechanisms built into Nebula
 Introductions
» Steve Hunt
 What is cloud computing?
» Matt Chew Spence
 How can NASA benefit from cloud computing?
» Matt Chew Spence
 How is NASA implementing cloud computing?
» Matt Linton
 How does NASA secure cloud computing?
» Matt Linton
 Q&A
» Presentation Team
Extended Presentation
 FISMA & Clouds
» Matt Chew Spence
» Steve Hunt
 Assessment, Authorization, & FedRAMP
» Steve Hunt
OBJECTIVE: Overview of technical
security mechanisms built into Nebula
Technical Security Overview
• Issues with Commercial Cloud Providers
• Overview of Current Security Mechanisms
• Innovations
How does NASA secure cloud computing?
Commercial Cloud Provider Security Concerns
» IT Security not brought into decision of how & when
NASA orgs use clouds
» IT Security may not know NASA orgs are using
clouds until an incident has occurred
» Without insight into monitoring/IDS/logs, NASA
may not find out that an incident has occurred
» No assurances of sufficient cloud infrastructure
access to perform proper forensics/investigations
» These issues are less likely with a private cloud like
Nebula
How does NASA secure cloud computing?
IT Security is built into Nebula
 User Isolation from Nebula Infrastructure
 Users only have access to APIs and Dashboards
» No user direct access to Nebula infrastructure
 Project-based separation
» A project is a set of compute resources
accessible by one or more users
» Each project has separate:
• VLAN for project instances
• VPN for project users to launch, terminate,
and access instances
• Image library of instances
How does NASA secure cloud computing?
Networking
 RFC1918 address space internal to Nebula
» NAT is used for those hosts within Nebula
needing visibility outside a cluster
 Three core types of networks within Nebula:
» Customer
• Customer VLANs are isolated from each
other
» DMZ
• Services available to all Nebula such as
NTP, DNS, etc
» Administrative
How does NASA secure cloud computing?
Security Groups
 Combination of VLANs and Subnetting
 Can be extended to use physical
network/node separation as well (future)
How does NASA secure cloud computing?
Project A
Public IP
Space
RFC1918
Space
(10.1.1/24)
DMZ
Services
External
Scanner
I
N
T
E
R
N
E
T
C
L
O
U
D
B
R
I
D
G
E
A
P
I
S
Project B
(10.1.2/24)
(LAN_X)
Operations Console
(custom)
S
M
R
Security Scanners
(Nessus, Hydra, etc)
Log Aggregation,
SOC Tap
Event Correlation
Engine
How does NASA secure cloud computing?
Firewalls
 Multiple levels of firewalling
» Hardware firewall at site border
» Firewall on cluster network head-ends
» Host-based firewalls on key hosts
» Project based rule sets based on Amazon
security groups
How does NASA secure cloud computing?
Remote User Access
 Remote access is only through VPN (openVPN)
 Separate administrative VPN and user VPNs
 Each project has own VPN server
How does NASA secure cloud computing?
Intrusion Detection
 OSSEC on key infrastructure hosts
» Open source Host-based Intrusion Detection
 Mirror port to NASA SOC tap
 Building 10Gb/sec IDS/IPS/Forensics device
with vendor partners
How does NASA secure cloud computing?
Configuration Management
 Puppet used to automatically push out
configuration changes to infrastructure
 Automatic reversion of unauthorized changes
to system
How does NASA secure cloud computing?
Vulnerability Scanning
 Nebula uses both internal and external
vulnerability scanners
 Correlate findings between internal and
external scans
How does NASA secure cloud computing?
Incident Response
 Procedures for isolating individual VMs,
compute nodes, and clusters, including:
» Taking snapshot of suspect VMs, including
memory dump
» Quarantining a VM within a compute node
» Disabling VM images so new instances
can’t be launched
» Quarantining a compute node within a
cluster
» Quarantining a cluster
How does NASA secure cloud computing?
Role Based Access Control
 Multiple defined roles within a project
 Role determines which API calls can be
invoked
» Only network admin can request non-1918
addresses
» Only system admin can bundle new images
» etc
How does NASA secure cloud computing?
Innovation - Security Gates
 API calls can be intercepted and security
gates can be imposed on function being called
 When an instance is launched, it can be
scanned automatically for vulnerabilities
 Long term vision is to have a pass/fail launch
gate based on scan/monitoring results
How does NASA secure cloud computing?
Vision - Security as a Service
 Goal - Automate compliance through security
services provided by cloud provider
 Security APIs/tools mapped to specific controls
» Customers could subscribe to tools/services to
meet compliance requirements
 When setting up new project in cloud
» Customers assert nature of data they will use
» Cloud responds with list of APIs/tools for
customers to use
 Currently gathering requirements but funding
needed to realize vision
How does NASA secure cloud computing?
Vision - Security Service Bus
 Goal - FISMA compliance through continuous
real-time monitoring and situational awareness
» Security service bus with event driven
messaging engine
» Correlate events across provider and multiple
customers
» Dashboard view for security providers and
customers
» Allows customers to make risk-based security
decisions based on events experienced by
other customers
 Funding Needed to Realize Vision
How does NASA secure cloud computing?
Nebula Open Source Progress
 Significant progress in embracing the value of
open source software release
» Agreements with SourceForge and Github
» Open source identified as an essential component of
NASA’s open government plan
 Elements of Nebula in open source release
pipeline
» Started Feb 2010. Hope for release in June.
» Working toward continual incremental releases.
» Exploring avenues to contribute code to external
projects and to accept external contributions to the
Nebula code base.
Agenda
 Introductions
» Steve Hunt
 What is cloud computing?
» Matt Chew Spence
 How can NASA benefit from cloud computing?
» Matt Chew Spence
 How is NASA implementing cloud computing?
» Matt Linton
 How does NASA secure cloud computing?
» Matt Linton
 Q&A
» Presentation Team
Extended Presentation
 FISMA & Clouds
» Matt Chew Spence
» Steve Hunt
 Assessment, Authorization, & FedRAMP
» Steve Hunt
Q&A
Extended Presentation
Agenda
OBJECTIVE: Overview of Nebula C&A
with Lessons Learned
 Introductions
» Steve Hunt
 What is cloud computing?
» Matt Chew Spence
 How can NASA benefit from cloud computing?
» Matt Chew Spence
 How is NASA implementing cloud computing?
» Matt Linton
 How does NASA secure cloud computing?
» Matt Linton
 Q&A
» Presentation Team
Extended Presentation
 FISMA & Clouds
» Matt Chew Spence
» Steve Hunt
 Assessment, Authorization, & FedRAMP
» Steve Hunt
FISMA & Clouds
FISMA Overview
 Federal Information Security Management Act
– Requires all Gov’t computers to be under a security plan
–Mandates following NIST security guidance
–Required controls depend on FIPS-199 sensitivity level
–Requires periodic assessments of security controls
–Extremely documentation heavy
–Assumes one organization has responsibility for majority of
identified security controls
 FISMA is burdensome to cloud customers
–Customers want to outsource IT Security to cloud provider
FISMA & Clouds
FISMA Responsibilities in Clouds
 Clouds are a “Highly Dynamic Shared Management
Environment”
» Customers retain FISMA responsibilities for aspects of a
cloud under their control
» Responsibilities vary depending on level of control
maintained by customer
» Customer control varies relative to service delivery model
(SaaS, PaaS, or IaaS)
 Need to define & document responsibilities
» We parsed 800-53 Rev3 controls per service delivery model
 Nebula currently only offers IaaS
» We parsed all three service models for future planning
FISMA & Clouds
Customer FISMA Responsibilities for Cloud
Customer FISMA
responsibilities Increase
as Customers have more
control over security
measures
PaaS
SaaS
IaaS
OS Config Mgmt
Anti-Malware
SW Install Controls
OS specific Controls
etc
Software Licenses
Developer Testing
App Configuration Management
Software Development Lifecycle
Cloud
Customer
Security
Responsibility
Identifying data types
Ensuring data appropriate to system
User/Account Management
Personnel Controls
62
FISMA & Clouds
IaaS Customer Security Plan Coverage Options
 At inception little guidance existed on cloud computing control
responsibilities & security plan coverage
 FedRAMP primarily addresses cloud provider responsibilities
» Other than control parsing definitions Customers are given little
guidance on implementing and managing FISMA requirements in a
highly dynamic shared management environment
 We have developed the following options:
Option
Customer Owned
Facilitated
Agency Owned
Description
Customer responsible for
own security plan with no
assistance from provider
Customer responsible for
own security plan using
NASA template
Agency or Center level
“Group” security plans
associated with Cloud
providers serve as
aggregation point for
customer.
Issues
• None to Providers
• Burdensome to
customers
• May still be burdensome
to customers.
• Not scalable unless
automated.
• May be burdensome to
Agency or Center.
• Requires technology to
automate input and
aggregation of customer
data.
FISMA & Clouds
Current NASA Requirements/Tools may Impede
Cloud Implementation
 Default security categorization of Scientific and Space Science
data as “Moderate”
» Independent assessment required for every major change
• Currently requires 3rd party document-centric audit
• Not scalable to cloud environments
 e-Authentication/AD integration required for all NASA Apps
» NASA implementations don’t currently support LDAP/SAMLbased federated identity management
 Function-specific stove-piped compliance tools
» STRAW/PIA tool/A&A Repository/NASA electronic forms
» Can’t easily automate compliance process for new apps
64
FISMA & Clouds
Emerging Developments in FISMA & Clouds
 Interagency Cloud Computing Security Working Group
is developing additional baseline security requirements
for cloud computing providers
 NIST Cloud Computing guidance forthcoming?
 Move towards automated risk models and security
management tools over documentation
 On the bleeding edge - changing guidance &
requirements are a key risk factor (and opportunity)
65
FISMA & Clouds
Nebula is Contributing to Cloud Standards
 Federal Cloud Standards Working Group
 Fed Cloud Computing Security Working
Group
» Federal Risk & Authorization Management
Program (FedRAMP)
 Cloud Audit project
» Automated Audit Assertion Assessment &
Assurance API
 Providing Feedback to NIST and GAO
 GSA Cloud PMO
66
Agenda
OBJECTIVE: Overview of how Nebula
concepts may integrate with FedRAMP
 Introductions
» Steve Hunt
 What is cloud computing?
» Matt Chew Spence
 How can NASA benefit from cloud computing?
» Matt Chew Spence
 How is NASA implementing cloud computing?
» Matt Linton
 How does NASA secure cloud computing?
» Matt Linton
 Q&A
» Presentation Team
Extended Presentation
 FISMA & Clouds
» Matt Chew Spence
» Steve Hunt
 Assessment, Authorization, & FedRAMP
» Steve Hunt
FedRAMP
Federal Risk and Authorization
Management Program
 A Federal Government-Wide program to provide
“Joint Authorizations” and Continuous Monitoring
» Unified Government-Wide risk management
» Authorizations can be leveraged throughout
Federal Government
 This is to be an optional service provided to
Agencies that does not supplant existing
Agency authority
FedRAMP
Independent Agency Risk Management of Cloud Services
Federal Agencies
…
: Duplicative risk
management efforts
: Incompatible agency
policies
: Acquisition slowed by
lengthy compliance
processes
…
Cloud Service Providers (CSP)
: Potential for inconsistent
application of Federal
security requirements
FedRAMP
Federated Risk Management of Cloud Systems
Federal Agencies
…
FedRAMP
Risk Management
• Authorization
• Continuous
Monitoring
• Federal Security
Requirements
: Risk management cost
savings and increased
effectiveness
: Interagency vetted
approach
: Rapid acquisition
through consolidated
risk management
…
Cloud Service Providers (CSP)
: Consistent
application of Federal
security requirements
FedRAMP
FedRAMP Authorization process
Agency X has a need
for a new cloud based
IT system
Agency X gets
security requirements
for the new IT system
from FedRAMP and
adds requirements if
necessary
Agency X releases
RFP for new IT
system and awards
contract to cloud
service provider
(CSP)
Agency X submits
request to FedRAMP
office for CSP To be
FedRAMP authorized
to operate
CSP is put into FedRAMP
priority queue
(prioritization occurs
based on factors such as
multi-agency use, number
of expected users, etc.)
FedRAMP
FedRAMP Authorization process (cont)
CSP and agency
sponsor begin
authorization
process with
FedRAMP office
CSP has
independent
assessment of
security controls
and develops
appropriate reports
for submission to
FedRAMP office
FedRAMP office
adds CSP to
authorized system
inventory to be
reviewed and
leveraged by all
Federal agencies
CSP, agency
sponsor and
FedRAMP office
review security
requirements and
any alternative
implementations
FedRAMP office
coordinates with
CSP for creation of
system security
plan (SSP)
FedRAMP office
reviews and
assembles the
final authorization
package for the
JAB
JAB reviews final
certification
package and
authorizes CSP to
operate
FedRAMP
provides
continuous
monitoring of CSP
FedRAMP
Issues & Concerns
 FedRAMP doesn’t provide much guidance for customer
side … e.g. Agency users of cloud services
 Current NIST guidance oriented primarily towards “Static
Single System Owner” environments
 Lack of NIST guidance for “Highly Dynamic Shared
Owner” environments … e.g. Virtualized Data Centers &
Clouds
» SSP generation & maintenance
» Application of SP 800-53 (security controls)
» Application of SP 800-37 (assessment & ATO)
» Continuous Monitoring
 Guidance may be forthcoming but NIST is resource
constrained
FedRAMP
Potential Solution
 Agency/Center level Aggregated SSPs:
» Plan per CSP … e.g. Nebula, Amazon,
Google, Microsoft … etc.
» Plan covers all customers of a specific CSP
» Technology integration may be needed with
SSP repository to dynamically update SSP
content via Web Registration site.
» Or … SSP may be able to point to dynamic
content entered and housed on Web
Registration site ... maintained in Wiki type
doc.
Presentation Title
—74—
March 5, 2010
Q&A