NISTがクラウドシステムに対する一般的なアクセス制御のガイダンスを公表していますね。。。

こんにちは、丸山満彦です。

NISTがクラウドシステムに対する一般的なアクセス制御のガイダンスを公表していますね

● NIST - ITL

・2020.07.31 SP 800-210 General Access Control Guidance for Cloud Systems

・[PDF]SP 800-210

結論の最後が結構正直ですね。。。

「異なるデバイスやプラットフォーム間でのアクセスコントロール管理、クラウドの普及に伴う新たな課題など、多くの課題が残されている」

・[HTML]に変換してみた

パブコメ時の投稿はこちら↓

● まるちゃんの情報セキュリティ気まぐれ日記

・2020.04.02 NIST SP 800-210(Draft) General Access Control Guidance for Cloud Systems

---

Abstract

This document presents cloud access control characteristics and a set of general access control guidance for cloud service models: IaaS (Infrastructure as a Service), PaaS (Platform as a Service), and SaaS (Software as a Service). Different service delivery models require managing different types of access on offered service components. Such service models can be considered hierarchical, thus the access control guidance of functional components in a lower-level service model are also applicable to the same functional components in a higher-level service model. In general, access control guidance for IaaS is also applicable to PaaS and SaaS, and access control guidance for IaaS and PaaS is also applicable to SaaS. However, each service model has its own focus with regard to access control requirements for its service.

  

Executive Summary

Cloud systems have been developed over time and conceptualized through a combination of software, hardware components, and virtualization technologies. Characteristics of the cloud, such as resource pooling, rapid elasticity, and pay-as-you-go services, accelerated its wide adoption by industry, government, and academia. Specifically, cloud systems offer application services, data storage, data management, networking, and computing resources management to consumers over a network (the internet in general). Despite the great advancements of cloud systems, concerns have been raised about the offered level of security and privacy. The importance of these concerns becomes more evident when considering the increasing number of users who have adopted cloud services.

This document presents cloud access control (AC) characteristics and a set of general access control guidance for cloud service models—IaaS (Infrastructure as a Service), PaaS (Platform as a Service), and SaaS (Software as a Service). The main focus is on technical aspects of access control without considering deployment models (e.g., public, private, hybrid clouds etc.), as well as trust and risk management issues, which require different layers of discussions that depend on the security requirements of the business function or the organization of deployment for which the cloud system is implemented. Different service delivery models need to consider managing different types of access on offered service components. Such considerations can be hierarchical, such as how the access control considerations of functional components in a lower-level service model (e.g., networking and storage layers in the IaaS model) are also applicable to the same functional components in a higher-level service model (e.g., networking and storage in PaaS and SaaS models). In general, access control considerations for IaaS are also applicable to PaaS and SaaS, and access control considerations for IaaS and PaaS are also applicable to SaaS. Therefore, AC guidance for IaaS is applicable to PaaS and SaaS, and AC guidance for IaaS and PaaS is also applicable to SaaS. However, each service model has its own focus with regard to access control requirements for its service.

---

Table of Contents

             Executive Summary

1           Introduction
1.1        Purpose
1.2        Scope
1.3        Audience
1.4        Document Structure

2           Cloud Access Control Characteristics

3           Access Control Guidance for IaaS
3.1        Guidance for Network
3.2        Guidance for Hypervisor
3.3        Guidance for Virtual Machines
3.4        Guidance for APIs
3.5        Recommendations for IaaS Access Control

4           Access Control Guidance for PaaS
4.1        Guidance for Memory Data
4.2        Guidance for APIs
4.3        Recommendations for PaaS Access Control

5           Access Control Guidance for SaaS
5.1        Guidance for Data Owner’s Control
5.2        Guidance for Confidentiality
5.3        Guidance for Privilege Management
5.4        Guidance for Multiple Replicas of Data
5.5        Guidance for Multi-tenancy
5.6        Guidance for Attribute and Role Management
5.7        Guidance for Policies
5.8        Guidance for APIs
5.9        Recommendations for SaaS Access Control

6           Access Control Guidance for Inter- and Intra- Operation

7           Conclusions

             References

---

7       Conclusions

This document presents an initial step toward understanding access control (AC) challenges in cloud systems by analyzing the AC considerations in all three cloud service delivery models— IaaS, PaaS, and SaaS. Essential characteristics that would affect the cloud’s AC design are also summarized, such as broad network access, resource pooling, rapid elasticity, measured service, and data sharing. Various guidance for AC design of IaaS, PaaS, and SaaS are proposed according to their different characteristics. Recommendations for AC design in different cloud systems are also included to facilitate future implementations. Additionally, potential policy rules are summarized for each cloud system. However, many issues remain open, such as AC management across different devices and platforms, as well as new challenges that have yet to emerge with the wide adoption of the cloud.