NIST SP 800-137

From: VentureBeat

John Koetsier

In the initial rush to the cloud, some companies may have lost site of the  fact that security, efficiency, and continuous monitoring are just as important  in the cloud as in the datacenter. It looks like they’re picking up that theme  now, but perhaps not as swiftly as their customers might like.

A new study by by cloud optimization company Newvem checked 61,545  Amazon Web Services instances which total a yearly spend of over $157 million.  The good news is that cloud users are getting much more savvy about security,  utilization, and optimization.

But there’s still room to improve — a lot of room.

“On average, 37 percent of AWS instances could benefit from increased security policy implementation,” Newvem says. That may  not sound great, but, the company says, “this is an impressive improvement from  the data that we analyzed in April 2012 where 50 percent of AWS instances stood  to improve.”

The security tactics Newvem is referring to range from fairly basic  precautions such as closing un-used IP ports to more global security tactics,  such as properly configuring security groups across multiple services.

That’s critically important to both companies and users, of course, as more  and more of our startups, enterprises, and everything in between  are building their computing infrastructure on the cloud. Amazon doesn’t  disclose how much of its $61  billion in 2012 revenue derives from Amazon Web Services and its other cloud  offerings, but it’s likely in the $2-4 billion range. Microsoft’s Azure, a  relatively late-comer, is already  a billion-dollar business. And Google’s App Engine is just starting to hit  its stride for non-Google projects and services, and is fighting  hard for market share.

So security is a big deal.

There is some good news, however, and the really big improvement lies in how  enterprise and start-up companies are efficiently utilizing their cloud  services.

Amazon, for instance, offers both on-demand instances — chunks of computing  capability — that companies can spin up on short notice, and Reserved Instances  that are held solely for one company’s use. Typically, companies will use  on-demand instances when they don’t know how much capacity they need, and  utilize Reserved Instances when demand has stabilized, to a degree, and is more  predictable. Reserved Instances cost much less per operation, but require a  commitment that could end up costing more.

“Of active Reserved Instances, only 4 percent are underutilized, revealing a  very positive trend that AWS users are taking advantage of RIs to run consistent  workloads that are both cost efficient and properly utilized in line with  business needs,” Newvem says.

Still, however, there are savings to be had by companies who are sticking  with on-demand infrastructure: 78 percent of them could benefit by adopting at  least some level of Reserved Instances for at least part of the workload.

That’s good news for companies. Good news for customers would be that 100  percent of Amazon — and Google and Microsoft — cloud customers have full,  excellent, and comprehensive implementation of cloud security procedures.