Why Have DoD Impact Levels for Cloud Compliance?

Short answer: WE SHOULDN’T.

The real answer is somewhat longer because there are both technological and sociological issues at play.

Few people knew what the original true designs were behind the DoD Cloud Security Requirements Guide (CC SRG) and the Secure Cloud Computing Architecture (SCCA) but we can make some pretty safe assumptions:

· Trying to not be RMF while also not interfering with RMF

· Create a construct that uniquely fits cloud computing

· Be enough like legacy to feel familiar but still be different

Despite its valiant goals, the CC SRG is built on concepts that are not relevant for modern cloud computing initiatives. Dedicated tenancy, single customers, and full management console access are all concepts that do not and should not be applied to all cloud computing initiatives.

Problem

The bigger issue is that the document left A LOT open to interpretation. This is particularly true in the mapping of those requirements to RMF controls. Moreover, they established these requirements without a means to assess their implementations. While RMF doesn’t spell out each control intent (unless you dive into CCI’s), the NIST SP 800-53 has 800-53A to help guide an assessor/auditor through and sets expectations.

The CC SRG not only has no equal to 800-53A but doesn’t adequately spell out the intentions of the individual requirements to those that aren’t already trained in cloud security. This leaves a huge amount of ambiguity with architects, engineers, assessors, and AOs. All effected parties are left to their own interpretations, causing confusion. There are points to be made that this ambiguity provides flexibility in implementation and opens conversation between those building the environments and those authorizing it. In reality this isn't a benefit. These channels of communication between engineers, program offices, and assessors are often opened too late or not at all. We as an industry can't let a few exceptions disprove the common case.

Then there are the 4 Horsemen of the CC SRG: CAP, CSSP, VDMS, VDSS. These are constructs based on legacy principles that don’t map to modern cloud deployments very well. Not only are they not cost-effective, they bring a great deal of unnecessary latency and performance degradation.

Solution

While RMF isn’t perfect, it has evolved into its current state for a reason. It’s flexible and it covers a huge swath of use cases and cyber surface area. More often than not, it’s the execution of the process that is the blocker rather than the technicals of the framework.

This brings us to a better solution…

The Cloud Computing Overlay.

This is how every system use-case of significance is applied to the framework already. Classified systems, National Security Systems, Nuclear, Intelligence, PII… all have their own overlays. RMF already has mechanisms in place for implementing and populating control sets with overlays.

So why not create a cloud computing overlay??

Benefits

A Cloud Computing overlay would adjust control sets to feel less RMFy; it’s still familiar with engineers, assessors, and AOs; and would allow for legacy, cloud,?and?hybrid systems. It removes enough ambiguity to be useful, while allowing tailoring to take care of unnecessary restrictions. It would also allow for these systems to match them with the other overlays without confusion.

How does this replace the SRG Impact Levels?

·?????IL4 = Cloud Computing overlay + PII overlay (which already exists)

·?????IL5 = Cloud Computing overlay + National Security overlay (which already exists)

·?????IL6 = Cloud Computing overlay + Classified overlay (which already exists)

What about the 4 Horsemen of the SRG?

RMF already has controls in place that address all of the components of the VDMS and VDSS. The Continuous Monitoring (CM) family would be modified by the Cloud Computing overlay to address CSSP requirements which, honestly, wouldn’t be much of a modification. The same goes for the CAP. There are a number of controls in place that already address this need; the cloud computing overlay would simply be a modification of those controls to meet the requirement and intention of a Cloud Access Point.

The Cloud Computing Overlay, folks. It should be a thing.