Various Issues Around the Potential Integration of Cloud Vendors and cit’s Next Generation Data Center

CIT is in the process of implementing our “Next Generation” datacenter involving plans to abstract out the hardware layer from individual projects instead focusing on providing the computing resources needed to a project independent of specific hardware requirements. This will, in most cases, take the form of a VMWare virtual machine instance provisioned in a blade-based server environment.

This strategy begins to take us in the direction of a “cloud” style of computing where application and service owners are not involved in decisions around what actual hardware their applications and services are running on. It also prepares us to possibly take advantage of supplementing our own resources with commercial resources available from cloud vendors. Such supplementation could take the form of a separate “cloud vendor broker service” where CIT staff manage the acquisition of cloud resources on behalf of campus customers, OR we could integrate our own cloud service with one or more cloud vendors in such a way that customers of our private cloud service may be utilizing resources locally or out on the cloud. This latter paradigm is also referred to as a “hybrid” cloud solution.

Regardless of which model is implemented, a main “benefit” is that local customers need only interface with the local organization thus centralizing the institutional relationship with external cloud vendors. It also affords us the luxury of centralizing decisions made with respect to legal and policy issues that come when one considers hosting institutional data and/or applications in an external environment. In order to be prepared for this, CIT needs to address a multitude of issues in advance instead of trying to find answers to these issues as they come up. We have broken the issues into four main categories:

1. 
   Security issues
   
2. 
   Data issues
   
3. 
   Availability issues
   
4. 
   Contractual issues
   

We’ll examine all of these issues one at a time:

The following issues arise when we consider externally hosted cloud resources that may not allow us access to the logs, hardware settings, etc. we would otherwise have access to when all hardware is local to our environment:

1. 
   Log Issues
   
   1. 
      Is it an issue if we do not have access to logs in the following situations:
      
      1. 
         IaaS – Infrastructure logs?
         
      2. 
         PaaS – Platform AND infrastructure logs?
         
      3. 
         SaaS – Software, Platform AND infrastructure logs?
         
   2. 
      Do we require the ability to perform log-based intrusion detection ?
      
2. 
   Access
   
   1. 
      Who has access to all parts of the service?
      
   2. 
      Who did what, when? (Audit access)
      
3. 
   Best Practices
   
   1. 
      Patching--Is the vendor running the most secure versions of the operating system and supporting applications?
      
   2. 
      Configuration—Are vendor’s systems locked down sufficiently?
      
4. 
   Scanning
   
   1. 
      Do vendors scan their systems themselves?
      
   2. 
      Can we scan our own hosts (hosted in the vendor environment)
      
      1. 
         From Campus?
         
      2. 
         From the Cloud?
         
   3. 
      If vendor scans our hosted systems, do we have access to the results?
      
5. 
   Intrusion Detection
   
   1. 
      We have appliances that look at network traffic here on campus.
      
      1. 
         If we cannot deploy something similar in the cloud, does the vendor perform their own intrusion detection strategy?
         
      2. 
         What does audit require here?
         
      3. 
         What services require this functionality?
         
   2. 
      If virtual switches are used, can be monitor traffic to detect intrusion?
      
6. 
   Risk/Vulnerability assessments
   
   1. 
      Who is responsible for this?
      
7. 
   Sniffing
   
   1. 
      Is network traffic secure from sniffing?
      
   2. 
      Is data storage secure from other tenants?
      

These issues arise when we consider putting institutional data outside the geographic bounds of Cornell University:

1. 
   Ownership
   
   1. 
      Who owns the data when it is hosted on non-Cornell physical resources?
      
   2. 
      In the case of Google, would our data end up accessible via their search engine?
      
   3. 
      Should Cornell be the sole entity responsible for deciding on whether or not to disclose data to law enforcement agencies based on subpoenas?
      
2. 
   Encryption
   
   1. 
      Should all data stored on an external vendor’s storage be encrypted?
      
   2. 
      Should all data on the wire be encrypted?
      
   3. 
      NOTE: encryption of data in storage as well as encryption of network traffic is not always done with local systems at Cornell.
      
3. 
   Key escrow
   
   1. 
      Where encryption occurs, do we escrow encryption key with vendor?
      
   2. 
      If vendor is encrypting do we get copies of the encryption keys?
      
4. 
   HIPPA/FERPA
   
   1. 
      Must vendors commit to be bound by all HIPPA/FERPA requirements?
      
5. 
   Extra/Secure Tier
   
   1. 
      Can Confidential data (as defined in Policy 5.10) exist in an external environment?
      
   2. 
      If so, how do we map our security tiers to vendor requirements?
      
6. 
   Data Destruction
   
   1. 
      What standards of data destruction are required when physical media is taken out of service?
      
   2. 
      What requirements exist for the handling of backup media?
      

These issues come up when considering the availability of an externally hosted service:

1. 
   Network
   
   1. 
      What requirements do we have for a vendor’s network availability?
      
      1. 
         Vendor can likely only guarantee availability/performance to a certain point (likely their primary provider).
         
2. 
   Server
   
   1. 
      Should we limit ourselves to vendors who can guarantee a certain amount of capacity?
      
3. 
   SLAs/Maintenance Windows/Monitoring
   
   1. 
      Is the vendor obligated to tell us of changes in the system?
      
   2. 
      What type of monitoring/notifications do we require?
      
4. 
   Disaster Recovery/High Availability
   
   1. 
      What level of DR must the vendor have in place?
      
   2. 
      What level of HA must the vendor have in place?
      

Contractual issues should be the best understood as Cornell has certainly engaged in many contracts with external vendors for IT services independent of any central cloud initiative. The following questions arise:

1. 
   Contracts should be based, whenever possible, on the CSG Model Contract.
   
2. 
   Vendor contracts should adhere to the guidelines listed in the “Principles of Outsourcing” document.
   
3. 
   “Brokers” local to Cornell will negotiate contract/service terms based on local client needs.