The Standard

This section describes how the details about the Deployment Model can be requested and provided:

• The Security Measure text below is an example how cloud security standards can request Cloud Service Providers (CSP) to deliver the Deployment Model Patterns. The measure text also stipulates minimal requirements about the content of the Patterns (what needs to be addressed and described).
• The Implementation Guidance below provides further explanations and provides details regarding the Deployment Model. More importantly, the structure of the Patterns is defined (in Table 2). In this example, four Patterns (sentences) are considered to be sufficient for characterizing the cloud service’s Deployment Model. The expressions in square brackets need to be replaced by the Cloud Service Provider (CSP) to characterize the cloud service under consideration. For each of the four required Pattern, an example is given that characterizes a specific cloud service (a Private Cloud offering in our example). Such sentences are expected to be delivered as user’s guide by the Cloud Service Provider (CSP).
• It is important to note that different cloud security standards can develop different solutions. The required content, the structure and format may differ between them. That’s why this Zero Outage Industry Standard only describes the concept and provides example. Nevertheless, each standard shall define unique requirements to be met by the Cloud Service Providers (CSP).
• A Rationale is also given which shall explain why this Security Measure (requirement for the Cloud Service Provider, CSP) is defined and part of the cloud security standards.

Note that the Security Measure text is formulated as a statement and not as a requirement using terms like shall, should etc. in order to avoid different interpretations of the level of bindingness.

The remaining part of this section provides an example specification requiring the Cloud Service Provider (CSP) to deliver Deployment Model patterns.

Security Measure: Design and implementation in line with Deployment Model Pattern The cloud computing service is designed and implemented according to predefined Deployment Model Patterns. These Patterns describe characteristics of the cloud computing service’s Deployment Model. As a minimum the following is defined: The Patterns characterize the contracting parties of the Cloud Service Provider which purchase and consume the service and the level of trustworthiness of these parties for the Cloud Service Provider. The Patterns also indicates how many parties are utilizing the same cloud service instance. The Patterns furthermore specify the type of connectivity used by the parties to access the cloud computing services and characterize the location of the cloud computing components.

Implementation guidance:

• The Patterns are simply a set of rules or of statements that characterize a specific implementation.
• This security measure requires a) the definition of Deployment Model Patterns and b) that these Patterns are adhered to during design, implementation and for planning the cloud’s operations.
• Different Deployment Models differ in their risk and compliance profile. Different Deployment Models may also require implementing security features in a different way.
• Table 1 in Section 4.1 shows three Deployment Models together with the “on-premise” solution for the sake of comparison. For each Deployment Model some characteristics are given that can help to develop the Deployment Model Patterns and/or compile existing material accordingly. Note that the term “user” primarily refers to the contracting party of the Cloud Service Provider (organizations and not to the individuals) accessing the cloud.
• Table 2 in this section below shows how the different Deployment Models can be characterized by Deployment Model Patterns. Four Patterns are shown (using the characteristics from Table 1), each with an example for a Private Cloud offering. It may be necessary to define more or less Patterns and to add more details. The numbered lines contain four templates where the texts in brackets need to be replaced. This is done once for each Pattern in the lines below each giving an example how such a Pattern may look like.

Table 2: Characterizing Cloud Deployment Models by four Patterns and examples for a Private Cloud offering (both illustrative)

• Remark on Pattern No. 1: The closer the relation between the user organization (customer of CSP) and the IT service provider (CSP)
  • the better security responsibilities can be aligned,
  • the better security issues can jointly be solved, and
  • the more likely possible abuse of the cloud service can be excluded.
• Remark on Pattern No. 2: A cloud computing instance, dedicated to and used by one user organization only, entails a lower risk and perhaps also a higher level of control for the user organization in comparison with a cloud computing instance used by many unknown and maybe unreliable parties.
• Remark on Pattern No. 3: Obviously, risk exposure is different and depend on the way the users are connected to the cloud computing core service. The chosen connectivity is often a direct consequence of Pattern 1 and 2.
• Remark on Pattern No. 4: In many cases, the cloud computing core service resides in datacenters of the CSP. But there are also models where the technology is located in the user organization’s datacenter (e.g., in case of using hyper-converged systems). Obviously, physical protection and connectivity are different which is affecting the IT security and risk profile.
• The Deployment Model Pattern are used during design, implementation and for planning the cloud’s operations. Whenever required, security measures (defined in this document) are implemented in a way that the Patterns are observed or implemented.
• The Deployment Model Pattern are part of the service description document. The structure of the Patterns described above eases the comparison of different cloud computing services.
• Implementing a specific Deployment Model also entails technical modifications.

Rationale: Different Deployment Models may require implementing security features in a different way. The Deployment Model Patterns ensure that the cloud computing core service is designed, implemented and planned for operations in a way that access, connectivity, functionality etc. are exactly in line with the Deployment Model’s characteristics.