	Cloud Computing Is a Form of Shared Computing with Several Service and Deployment Models

Cloud computing is a new form of delivering IT services that takes  advantage of several broad evolutionary trends in information technology,  including the use of virtualization. A public cloud is  available to any paying customer and is owned and operated by the service  provider. A hybrid cloud is a composite of the deployment models. Cloud Computing Has Both Positive and Negative Information Security Implications

The adoption of cloud computing has the potential to provide benefits  related to information security. The use of virtualization and automation in  cloud computing can expedite the implementation of secure  configurations for virtual machine images. Other advantages relate to  cloud computing’s broad network access and use of Internet-based  technologies. Additional advantages relate to the potential economies of scale and  distributed nature of cloud computing. The self-service aspect of cloud computing may also  provide benefits. In addition to benefits, the use of cloud computing can create numerous  information security risks for federal agencies. In response to our survey,  22 of 24 major agencies reported that they are either concerned or very  concerned about the potential information security risks associated with  cloud computing. Several of these risks relate to being dependent on a  vendor’s security assurances and practices. Multitenancy, or the sharing of computing resources by different  organizations, can also increase risk. Although there are numerous potential information security risks related  to cloud computing, these risks may vary based on the particular  deployment model. For example, NIST states that private clouds may have  a lower threat exposure than community clouds, which may have a lower  threat exposure than public clouds. Several industry representatives stated  that an agency would need to examine the specific security controls of the  vendor the agency was evaluating when considering the use of cloud  computing. Federal Agencies Have Begun Efforts to Address Information Security Issues for Cloud Computing, but Specific Guidance Is Lacking and Efforts Remain Incomplete

Federal agencies have begun to address information security for cloud  computing; however, they have not developed the corresponding  guidance. These agencies identified  measures they are taking or plan to take when using cloud computing. Most agencies have concerns about ensuring vendor compliance and  implementation of government information security requirements. Several Governmentwide Cloud Computing Information Security Initiatives Have Been Started, but Key Guidance and Efforts Have Not Been Completed

While several governmentwide cloud computing security activities are  under way by organizations such as the Office of Management and Budget  (OMB) and the General Services Administration (GSA), significant work  remains to be completed. In  addition, OMB has not yet defined how information security issues, such  as a shared assessment and authorization process, will be addressed in  this strategy. Accordingly, we recommended that OMB  establish milestones for completing a strategy for implementing the cloud  computing initiative and ensure the strategy addresses the information  security challenges associated with cloud computing, such as needed  agency-specific guidance, controls assessment of cloud computing service  providers, division of information security responsibilities between  customer and provider, a shared assessment and authorization process,  and the possibility for precertification of cloud computing service  providers. NIST Is Coordinating Activities with CIO Council but Has Not Established Cloud-Specific Guidance

NIST is responsible for establishing information security guidance for  federal agencies to support FISMA; however, it has not yet established  guidance specific to cloud computing or to information security issues  specific to cloud computing, such as portability and interoperability, and  virtualization. Federal agencies have taken steps to address  cloud computing security, but many have not developed corresponding  guidance. Until federal guidance and processes that specifically address  information security for cloud computing are developed, agencies may be  hesitant to implement cloud computing, and those programs that have  been implemented may not have effective information security controls in  place.
Why GAO Did This Study

Cloud computing, an emerging form of computing where users have access to scalable, on-demand capabilities that are provided through Internet-based technologies, reportedly has the potential to provide information technology services more quickly and at a lower cost, but also to introduce information security risks. Accordingly, GAO was asked to testify on the benefits and risks of moving federal information technology into the cloud. This testimony summarizes the contents of a separate report that is being released today which describes (1) the models of cloud computing, (2) the information security implications of using cloud computing services in the federal government, and (3) federal guidance and efforts to address information security when using cloud computing. In preparing that report, GAO collected and analyzed information from industry groups, private-sector organizations, and 24 major federal agencies.

What GAO Found

Cloud computing has several service and deployment models. The service models include the provision of infrastructure, computing platforms, and software as a service. The deployment models relate to how the cloud service is provided. They include a private cloud, operated solely for an organization; a community cloud, shared by several organizations; a public cloud, available to any paying customer; and a hybrid cloud, a composite of deployment models. Cloud computing can both increase and decrease the security of information systems in federal agencies. Potential information security benefits include those related to the use of virtualization and automation, broad network access, potential economies of scale, and use of self-service technologies. In addition to benefits, the use of cloud computing can create numerous information security risks for federal agencies. Specifically, 22 of 24 major federal agencies reported that they are either concerned or very concerned about the potential information security risks associated with cloud computing. Risks include dependence on the security practices and assurances of a vendor, and the sharing of computing resources. However, these risks may vary based on the cloud deployment model. Private clouds may have a lower threat exposure than public clouds, but evaluating this risk requires an examination of the specific security controls in place for the cloud's implementation. Federal agencies have begun efforts to address information security issues for cloud computing, but key guidance is lacking and efforts remain incomplete. Although individual agencies have identified security measures needed when using cloud computing, they have not always developed corresponding guidance. Agencies have also identified challenges in assessing vendor compliance with government information security requirements and clarifying the division of information security responsibilities between the customer and vendor. Furthermore, while several governmentwide cloud computing security initiatives are under way by organizations such as the Office of Management and Budget and the General Services Administration, significant work needs to be completed. For example, the Office of Management and Budget has not yet finished a cloud computing strategy, or defined how information security issues will be addressed in this strategy. The General Services Administration has begun a procurement for expanding cloud computing services, but has not yet developed specific plans for establishing a shared information security assessment and authorization process. In addition, while the National Institute of Standards and Technology has begun efforts to address cloud computing information security, it has not yet issued cloud-specific security guidance. Until specific guidance and processes are developed to guide the agencies in planning for and establishing information security for cloud computing, they may not have effective information security controls in place for cloud computing programs. In the report being released today, GAO recommended that the Office of Management and Budget, the General Services Administration, and the Department of Commerce take steps to address cloud computing security, including completion of a strategy, consideration of security in a planned procurement of cloud computing services, and issuance of guidance related to cloud computing security. These agencies generally agreed with GAO's recommendations.