After FedRAMP: Trust, but verify

Securing the cloud is complicated business -- there are 125 security controls in Federal Risk and Authorization Management Program baseline for low-impact-level cloud services, and 325 for moderate-impact uses.  Yet while the FedRAMP approach is based largely on intergovernmental trust -- agencies considering a cloud service rely on the provisional authority to operate granted by FedRAMP's Joint Authorization Board or another sponsoring agency -- officials close to the process say it's critical to build trust with the providers as well.

Speaking at the June 17 MeriTalk Cloud Computing Brainstorm in Washington, D.C., FedRAMP manager Matthew Goodrich stressed that a FedRAMP seal of approval alone is not enough to secure a system.

“Agencies do have their own responsibilities once you use the cloud service provider,” he said.  And while "it's a beast to get through all the documentation," agencies need to better understand both the systems they're using and the providers behind them.  “If you don’t have that information, you can’t trust [the system].”

Frank Konieczny, Air Force chief technology officer for the Office of Information Dominance and CIO for the Office of the Secretary, agreed.  The major concerns continue to be the security, integrity and availability of data in the cloud, he said. 

"When we have [data] on premise it's a little bit easier because we feel like we own it, we can manage it, we can push things around pretty quick, we can give priority to things as we need," Konieczny said.  "However, when we go to the [cloud service provider], liability becomes an issue."

He noted that open lines of communication, clarity on exactly where data resides and immediate updates when something seems amiss are the key to successful cloud initiative.  “From a user viewpoint, we also want to make sure that our contracts are [written] in such a way that we want to be able to reach out to the cloud provider and demand various things from them, such as ... we need to know within 24 hours if you think you had an incident occur,” Konieczny said, “not three days later when you validate that incident.”

FedRAMP continues to find ways to build that initial trust with agencies by looking deeper at system owners, rather than the system itself, to better understand who exactly is being trusted and held responsible to ensure that security, according to Goodrich.

Michaela Iorga, the National Institute of Standards and Technology's senior security technical lead for cloud computing, said her agency is working closely with Goodrich and the FedRAMP team to develop a new risk management model that will help agencies better understand their responsibilities when moving to the cloud.  She said NIST also had put together a Security Working Group consisting of nearly 800 worldwide members in order to accelerate government agency needs and secure migration to the cloud.

NIST is also working on a "cloud overlay" for Special Publication 800-53 -- the government's guidelines for security and privacy controls for federal information systems -- that would SP 800-53's hundreds of controls in the context of a cloud, and correlate them with the functioning capability the cloud service is actually supporting.  This way, Iorga explained, NIST can provide implementation guidance, better support FedRAMP’s assessment efforts and eventually automate the Service Level Agreements that agencies should demand from a cloud service provider.

A critical concept for agencies to understand is that of trust boundaries, Iorga said.

Traditional federal information systems have clearly defined perimeters, she noted, but since the cloud environment is elastic by design, it is important to understand the system at its core and know where the data can go. NIST's current proposal, she said, includes a trust system that supports the mission and data of the agency with the concept of boundaries as elastic as the system.

According to Goodrich, NIST’s approach is the next step for agencies once they're secured a FedRAMP-approved cloud service -- or one that's on track to be FedRAMP-approved by the time the project deploys.  “NIST is working on taking that customer responsibility and really defining for agency customers what they actually need to do to complete that total security package.”

NIST is also exploring a structured representation of the security controls catalog, Iorga said, so that when providers report what they’ve implemented, agency assessors can use that as a template for different providers.  The catalog would be stored in a searchable database and made available to agencies through FedRAMP, to help automate the process of fully understanding the provider’s package.

“We are trying to provide tools," Iorga said. "We are trying to provide guidance of how to leverage, and even how to support, FedRAMP’s reporting of what the providers implemented."

NOTE: This article was updated on June 23 to correct an editor's error regarding security controls.  There are 325 controls for FedRAMP's moderate-impact baseline, not for NIST's SP 800-53.