Between Oct. 31st and Nov. 16th, we collected input on what should be
the focus for V3 of Cloud Computing Use Cases White Paper (
http://su.pr/2Be9pA
). The consensus is that we focus on security issues for V3,
discussing Service Level Agreements (SLAs) as needed. Clearly any
security policies will use a SLA to spell out the responsibilities of
the cloud provider and the rights of the consumer, but I don't think
we should try to put everything SLA related into V3.
It's also important that we figure out where we can add value to the
cloud security papers and work that has been done already. For those
who were following the comments, you saw Nils Puhlmann's post, where
the Cloud Security Alliance is in the process of publishing a second
version of their paper. Obviously we don't want to repeat work that's
already been done elsewhere. It is important that the work being done
in various communities be linked and a common message be developed to
eliminate any confusion on Cloud Computing.
So, to get the discussion going, some questions:
* How does the cloud change your approach to security? One security
expert I know says the cloud doesn't introduce any new security
challenges, but it makes it more important than ever that you address
them appropriately.
* What are the security issues for transporting data between consumers
and the cloud? Does SSL address them? (I would say no.)
* What are the security issues for storing data in the cloud, whether
it's in a cloud storage system or a cloud database?
* What are the security issues for processing data in the cloud,
whether it's using a cloud-based application or running in a cloud-
based VM?
In order to consolidate the comments, can you provide your comments to
the Cloud Computing Use Cases White Paper discussion group at
http://su.pr/2Be9pA.
Thanks very much and looking forward to your input as part of the
contributions to the V3 development !