Cloud Basic

CLOUD COMPUTING FOR

U.S. GOveRNMeNT PROFeSSIONALS

CLOUD

BASICS

ChAPteR 3

SeCURIty In

the CLOUD

http://www.microsoft.com/govcloud

MICROSOFT U.S. GOveRNMeNT

CLOUD BASICS: CHAPTER THREE

KeePIng the

BAD gUyS Off

Of yOUR CLOUD

02-002

Cloud computing may seem risky because you cannot secure its perimeter—

where are a cloud’s boundaries? In addition, many government agencies must

comply with regulatory statutes, such as the Health Insurance Portability and

Accountability Act (HIPAA), the Sarbanes-Oxley Act of 2002 (SOX), and the

Federal Information Security Management Act (FISMA).

Yet your organization can move forward with cloud computing, even while

security standards are being defined. The National Institute of Standards and

Technology likens the adoption of cloud computing to that of wireless technology.

Agencies learned how to protect their wireless data—and they will do the same

with cloud computing.i

It comes down to this: Federal, state, and local agencies vary in their security and

regulatory compliance needs, and you know your needs best. You must look carefully at how well cloud providers protect key functions and sensitive data.

2

MICROSOFT U.S. GOveRNMeNT

CLOUD BASICS: CHAPTER THREE

yOUR Own

PRIvAte CLOUD

02-002

Agencies with sensitive information and workloads would probably never

want all of their data in a public cloud. Private clouds offer the scalability and

shared resources of cloud computing on your terms—and on your turf, if you

can afford it. To achieve true cloud scalability in a private cloud, you must

forecast demand to support the requisite degree of excess capacity and then

invest accordingly.

Some agencies have the need and the budget to do so. Within the U.S.

Department of Defense (DOD), for example, groups can obtain access to

the private cloud created by the Defense Information Service Agency. Called

Rapid Access Computing environment (RACe), it enables DOD...