|
|
Sponsored Content
Special Forums
Cybersecurity
IT Security RSS
Exploring the FedRAMP Cloud Computing Security Requirements Baseline
Post 302478730 by Linux Bot on Wednesday 8th of December 2010 06:30:03 PM
12-08-2010
Exploring the FedRAMP Cloud Computing Security Requirements Baseline
The FedRAMP Security Requirements "describes the U.S. Government's proposed Assessment and Authorization (A&A) for U.S. Government Cloud Computing." In chapter 1, the FedRAMP PMO defined the proposed requirements (security controls) for a Low- and Moderate-Impact Cloud Computing environment (although not specifically characterizing any specific applicability to the Cloud Delivery or Service Model). In addition, the FedRAMP (DRAFT) publication draws on the existing NIST standards and guidelines to support the authroization of Cloud Services for the Federal Government. However, the FedRAMP publication limits the scope and tailoring of the control requirements to specifying the control parameters [refer to Section 3.3 within NIST SP 800-53, Rev. 3] and adding some additional Control Requirements and Supplemental Guidance to that which already exists within the Security Control Catalog (refer to NIST SP 800-53, Rev 3 - Appendix F).
In the past, NIST has supplemented NIST SP 800-53 to address "information system that differ significantly from traditional administrative, mission support, and scientific data processing information systems." (Refer to NIST SP 800-53 - Appendix I which establish a security control baseline specific to Industrial Control Systems). Although, Cloud Computing is not a new technology, it is a unique capability with unique security challenges.
The FedRAMP Cloud Computing Security Requirements Baseline section within FedRAMP.net (http://www.fedramp.net/Cloud+Computi...ments+Baseline) will focus on exploring the selected security control baseline as part of the "Proposed Security Assessment & Authorization for U.S. Government Cloud Computing (DRAFT)" to:
If you are interested in contributing your input, register at FedRAMP.net.
More...
In the past, NIST has supplemented NIST SP 800-53 to address "information system that differ significantly from traditional administrative, mission support, and scientific data processing information systems." (Refer to NIST SP 800-53 - Appendix I which establish a security control baseline specific to Industrial Control Systems). Although, Cloud Computing is not a new technology, it is a unique capability with unique security challenges.
The FedRAMP Cloud Computing Security Requirements Baseline section within FedRAMP.net (http://www.fedramp.net/Cloud+Computi...ments+Baseline) will focus on exploring the selected security control baseline as part of the "Proposed Security Assessment & Authorization for U.S. Government Cloud Computing (DRAFT)" to:
- Ensure coverage and applicability within Cloud Computing operating environments and within NIST SP 800-53, Rev. 3;
- Identify and address Cloud-specific security considerations relevant to the objectives of each security control; and
- List relevant references to support implementation and assessment
More...
|
|
4 More Discussions You Might Find Interesting
1. Virtualization and Cloud Computing
Tim Bass
Thu, 15 Nov 2007 23:55:07 +0000
*I predict we may experience less*debates*on the use of the term “event cloud”*related to*CEP in the future, now that both IBM and Google* have made announcements about “cloud computing” and “computing cloud”, IBM Turning Data Centers Into ‘Computing... (0 Replies)
Discussion started by: Linux Bot
0 Replies
2. Virtualization and Cloud Computing
by Eric Knorr, InfoWorld.comSo many vendors have jumped on the cloud computing bandwagon, the phrase already risks jumping the shark. The problem is that “cloud computing” has two distinctly different meanings: The use of commercial Internet-based services, and the architecture for building and... (0 Replies)
Discussion started by: Linux Bot
0 Replies
3. HP-UX
I work for a British based company.
We are looking for a cloud computing provider enabling us to use
HP on Itanium and HP hardware.
anyone know of any?
cheers. (0 Replies)
Discussion started by: bigearsbilly
0 Replies
4. Virtualization and Cloud Computing
Hi,
I am working as Linux system administrator now I want to learn cloud computing too. I tried Googling but couldn't find appropriate information so thought to ask people here.
Can somebody suggest me correct path along with tutorials/PDF/HTMLs?
Really appreciate your help.
thx
Pras (1 Reply)
Discussion started by: prashant2507198
1 Replies
LEARN ABOUT OPENSOLARIS
sckmd
sckmd(1M) System Administration Commands sckmd(1M) NAME
sckmd - Sun cryptographic key management daemon SYNOPSIS
/usr/platform/sun4u/lib/sckmd DESCRIPTION
sckmd is a server process that resides on a high-end system domain to maintain the Internet Protocol Security (IPsec) Security Associations (SAs) needed to secure communications between a Service Processor or System Controller (SC) and platform management software running within a domain. The cvcd(1M) and dcs(1M) daemons use these Security Associations. See ipsec(7P) for a description of Security Associations. The sckmd daemon receives SAs from the Service Processor or SC and installs these SAs in a domain's Security Association Database (SADB) using pf_key(7P). sckmd starts up at system boot time as an SMF service. The FMRI for the sckmd service is: svc:/platform/sun4u/sckmd:default A domain supports only one running sckmd process at a time. ATTRIBUTES
See attributes(5) for descriptions of the following attributes: +-----------------------------+------------------------------------+ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | +-----------------------------+------------------------------------+ |Availability |SUNWsckmx.u, SUNWsckmu.u, SUNWsckmr | +-----------------------------+------------------------------------+ |Interface Stability |Evolving | +-----------------------------+------------------------------------+ SEE ALSO
cvcd(1M), dcs(1M), ipsecconf(1M), ipsecalgs(1M), attributes(5), ipsec(7P), ipsecah(7P), ipsecesp(7P), pf_key(7P) NOTES
The sckmd service is used only on Sun Fire high-end systems and the SPARC Enterprise Server family. It provides a mechanism for exchanging IPsec keys between a domain and its System Controller (SC) or Service Processor. These platforms use IPsec to secure the communications between the SC or Service Processor and certain platform-specific daemons in the domain. Such daemons currently include cvcd(1M) and dcs(1M). The documentation for each platform that supports sckmd describes how to configure its use of IPsec for such communications. Also, the doc- umentation for each specific application describes how to configure its security policies and IPsec options in a manner appropriate for the target platform. Refer to the platform- and application-specific documentation for detailed information. SunOS 5.11 25 Apr 2006 sckmd(1M)