Good points in a post by Hoff "Cloud Providers and Security “Edge” Services – Where’s The Beef?", (emphasis added)
Yesterday I had a lively discussion with Lori MacVittie about the notion of what she described as “edge” service placement of network-based WebApp firewalls in Cloud deployments. I was curious about the notion of where the “edge” is in Cloud, but assuming it’s at the provider’s connection to the Internet as was suggested by Lori, this brought up the arguments in the post above: how does one roll out compensating controls in Cloud?
The level of difficulty and need to integrate controls (or any “infrastructure” enhancement) definitely depends upon the Cloud delivery model (SaaS, PaaS, and IaaS) chosen and the business problem trying to be solved; SaaS offers the least amount of extensibility from the perspective of deploying controls (you don’t generally have any access to do so) whilst IaaS allows a lot of freedom at the guest level. PaaS is somewhere in the middle. None of the models are especially friendly to integrating network-based controls not otherwise supplied by the provider due to what should be pretty obvious reasons — the network is abstracted.
For access control purposes, security is fairly straightforward, its a game of subjects (like users, user agents, claims, and web services), objects (like resources, URIs, data, and service providers) and what Hoff calls metastructures (like identity and policy). Security is a word that is meaningless by itself, you always have to qualify it: data security, application security, network security and so on. So when people talk about "edge" security, what is it they propose to "secure" an edge device? That's fine as far as it goes, but its important to note that providing security services to device on the edge doesn't do much of anything to either side of the edge. Too often people assume that securing the edge means everything "inside" the edge is also "secure" but this is smoke and mirrors for auditors not security for your enterprise assets.
Whenever you evaluate security and especially Cloud security, its important to enumerate the subjects, objects and metastructures that you are extending security services to, instead of just describing some security service in the abstract. This problem is a pandemic in information security the whole point of SOAP is that it was a firewall friendly protocol designed to go through the firewall, that was 10 years ago, yet today information security still relies on SSL and network firewalls as primary protection mechanisms (what are they protecting?).
Usenix LISA Training : Security in the Cloud (Hands-on) by Gunnar Peterson, Arctec Group
Who should attend: Security and software architects; anyone who needs to make design decisions for securing cloud technologies.
November 6, Baltimore