Head In The Cloud Feet On The Ground
Things to remember when choosing a cloud PACS in the federal government
- By Kevin Kozlowski
- Oct 01, 2012
More government agencies are taking their physical access
control system (PACS) to the cloud, and it’s easy
to see why. The cloud simplifies what otherwise can be
an arduous operation. Even the National Institute of
Standards and Technology, in its recent “Definition of Cloud Computing,”
identifies cloud computing in terms of its simplicity. Cloud
operations, it notes, require “minimal management effort or service
provider interaction.”
But in the rush to claim a spot in the cloud to enhance HSPD-
12 and PIV services, agencies would benefit by looking at the bigger
picture. While a simple cloud solution is good, a cloud solution that
is both simple and secure is even better.
The Benefits
Cost savings alone lure many information technology officers. Thanks
to Software-as-a-Service (SaaS), the expense and hassle of dedicated
application server and workstation maintenance, upgrades, repairs
and specialized personnel effectively become the responsibility of the
solution host. With these savings, enterprises are able to reconfigure
budgets so that more money is allotted for things such as operations.
They also can more efficiently use IT and server resources, potentially
sharing them for a more collaborative enterprise.
Centralization is likewise appealing, particularly to multi-tenant
and multi-facility enterprises. Managing a separate server room or
system at each facility is a far cry from efficient. Cloud deployment
allows these enterprises to use minimal physical IT resources to support
the maximum level of IT demand—whether that be through a
private or hybrid cloud.
And let’s not forget scalability. Agencies can enjoy the benefits of
the cloud regardless of their size. Should these agencies expand, the
cloud can allow their PACS to grow with minimal disturbance.
These benefits are significant. To many enterprises, they are too
appealing to pass up. But this is only half the story.
A Simpler, More Secure Cloud
Distracted by the obvious advantages of cloud PACS, enterprises
must take the time to ensure that the cloud solution they choose is
complete and secure. To do its part, the federal government has established
an accreditation process for cloud providers called the Federal
Risk and Authorization Management Program (FedRAMP). While
FedRAMP is a step forward for standardization, a robust, viable cloud
solution is one that mixes the benefits of reliability and cost savings with the promise of security and streamlined operations.
With the assumption that all cloud PACS are created equal, some
agencies may overlook an even simpler—and more secure—solution.
Secure Infrastructure
First, agencies should do well to ask vendors if their cloud PACS
infrastructure is engineered as a complete solution—designed to
serve the entire enterprise equally. A solid infrastructure supporting
an agency’s PACS cloud solution can eliminate unforeseen challenges
such as the complexity and costs associated with elaborate
integration efforts.
Using seamless infrastructure can simplify this aspect of cloud
PACS. For example, solution providers that upgrade an entire team
of readers with the click of a button eliminate the need to service individual
readers one by one and thereby showcase the benefits of an
enterprise cloud solution. Likewise, the inconvenience and difficulty
this work could present for an enterprise’s operations is removed.
In the move from a local server solution to a cloud PACS or SaaS,
enterprises should ensure that they don’t trade one means of simplicity
for another source of complication.
Authentication
By the same token, nothing undermines the benefit of simplicity and
the single purpose of a PACS like the threat of fraud. For that reason,
viable PACS cloud solutions in the federal government should be capable
of strong authentication. With a tool as sophisticated as the PIV
card, agencies should utilize the technology, which is called for in
HSPD-12, OMB M11-11 and FICAM.
Agencies should deploy strong authentication that reinforces
facility security with each access control transaction. Information
should not be cached or reused for days at a time, creating an unnecessary
security risk.
In short, cloud PACS in the federal government should use PIV
and PIV-I credential authentication that:
- Verifies that the credential is genuine, cryptographically validating
that the credential is not counterfeit or fraudulent by performing a
challenge-response exchange for every single reader transaction.
- Verifies origin to ensure that the issuers are trusted and legitimate.
- Confirms that the credential data has not been altered; the system
should verify that the unique ID and all information on a user’s
card were not altered and that the certificate is signed and trusted.
- Confirms certificate status by using a Certificate Revocation List
(CRL) or Online Certificate Status Protocol (OCSP) Responder to
confirm that the certificate is active.
The introduction of fraud to an access control system can complicate
the operation and undermine the end goal of a PACS. Strong
authentication enables enterprises to identify fraudulent credentials
and prevent unauthorized access with each transaction. Some vendors
offer one or two of the criteria but not all four, which is a shortsighted
approach.
Opting for a cloud PACS solution is, without argument, an upgrade.
However, the benefits are limited if that solution is not supported by a
solid, holistic infrastructure and also protected from fraud.
After all, only a secure enterprise cloud solution is truly simple.
This article originally appeared in the October 2012 issue of Security Today.