NordVPN Promotion

Home / Blogs

FedRAMP: Critical to Cost-Effective Cloud Computing Cybersecurity

Protect your privacy:  Get NordVPN  [ Deal: 73% off 2-year plans + 3 extra months ]
10 facts about NordVPN that aren't commonly known
  • Meshnet Feature for Personal Encrypted Networks: NordVPN offers a unique feature called Meshnet, which allows users to connect their devices directly and securely over the internet. This means you can create your own private, encrypted network for activities like gaming, file sharing, or remote access to your home devices from anywhere in the world.
  • RAM-Only Servers for Enhanced Security: Unlike many VPN providers, NordVPN uses RAM-only (diskless) servers. Since these servers run entirely on volatile memory, all data is wiped with every reboot. This ensures that no user data is stored long-term, significantly reducing the risk of data breaches and enhancing overall security.
  • Servers in a Former Military Bunker: Some of NordVPN's servers are housed in a former military bunker located deep underground. This unique location provides an extra layer of physical security against natural disasters and unauthorized access, ensuring that the servers are protected in all circumstances.
  • NordLynx Protocol with Double NAT Technology: NordVPN developed its own VPN protocol called NordLynx, built around the ultra-fast WireGuard protocol. What sets NordLynx apart is its implementation of a double Network Address Translation (NAT) system, which enhances user privacy without sacrificing speed. This innovative approach solves the potential privacy issues inherent in the standard WireGuard protocol.
  • Dark Web Monitor Feature: NordVPN includes a feature known as Dark Web Monitor. This tool actively scans dark web sites and forums for credentials associated with your email address. If it detects that your information has been compromised or appears in any data breaches, it promptly alerts you so you can take necessary actions to protect your accounts.

In September 2009, the Obama Administration announced the Federal Cloud Computing Initiative. As the government’s CIO explained, cloud computing “has the potential to greatly reduce waste, increase data center efficiency and utilization rates, and lower operating costs.” The Federal Risk and Authorization Management Program (FedRAMP) addresses the key elements of a cloud computing framework for federal agencies.

Federal use of “shared pool of configurable computing resources” does, however, present special cybersecurity challenges—particularly with regard to continuous monitoring.

As many officials inside and outside government are painfully aware, “security authorizations have become increasingly time-consuming and costly both for the Federal Government and private industry.” Cloud computing offers a path to substantially improving cybersecurity cost-effectiveness, but only if security approvals can be shared by the cloud’s users.

Right now, for an agency to obtain the needed sign-offs to use cloud-based computing is an expensive and redundant process. As GSA explained in testimony before Congress, “one of the most significant obstacles to the adoption of cloud computing is security. ... agencies need to have valid certification and accreditation (C&A) process and a signed Authority to Operate (ATO) in place for each cloud-based product they use. While vendors are willing to meet security requirements, they would prefer not to go through the expense and effort of obtaining a C&A and ATO for each use of that product in all the federal departments and agencies.”

In response to the need for practical, cost-effective cloud computing security, GSA led the effort to create the interagency FedRAMP. In basic terms, FedRAMP’s purpose is give cloud service providers a process for obtaining an Authority to Operate (ATO) that can be shared across agencies.

An “authorize once, use many” approach to security authorization is essential if cloud computing is going to achieve needed cost-effectiveness goals. As a senior GSA official explained on the Innovation in the Business of Government blog, FedRAMP “would allow joint authorizations and continuous security monitoring services for Government and Commercial cloud computing systems intended for multi-agency use.”

GSA further explained that,

Our aim is that FedRAMP provide the framework for a standard and secure approach to Assessing and Authorizing (A&A) cloud computing services and products. It would allow joint authorizations and continuous security monitoring services for Government and Commercial cloud computing systems intended for multi-agency use.

The implications of this are huge. Implementation time for FedRAMP certified vendors would be dramatically cut—instead of its taking months to get a security authorization, it could take weeks. Additionally, the cost in granting an Authority to Operate from an agency perspective could be minimal—potentially only the time it takes to review the FedRAMP authorization.

FedRAMP’s first major accomplishment was the publication for public comment of Proposed Security Assessment and Authorization for U.S. Government Cloud Computing. The document includes a chapter focused on continuous monitoring which explains,

FedRAMP is designed to facilitate a more streamlined approach and methodology to continuous monitoring. Accordingly, service providers must demonstrate their ability to perform routine tasks on a specifically defined scheduled basis to monitor the cyber security posture of the defined IT security boundary. While FedRAMP will not prescribe specific toolsets to perform these functions, FedRAMP does prescribe their minimum capabilities. Furthermore, FedRAMP will prescribe specific reporting criteria that service providers can utilize to maximize their FISMA reporting responsibilities while minimizing the resource strain that is often experienced.

In short, FedRAMP provides the guidance necessary for efficient continuous monitoring in federal cloud computing environment. FedRAMP is a key initiative to help realize major savings and allows agencies to tap into emerging technologies faster.

The conclusion is clear, FedRAMP is essential to the federal government achieving secure, cost-effective cloud computing. The program must continue for major cost savings across agencies and improve compliance based on the NIST Risk Management Framework (RMF).

For more information, please see http://www.thecre.com/fisma/.

Filed Under

Comments

Comment Title:

  Notify me of follow-up comments

We encourage you to post comments and engage in discussions that advance this post through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can report it using the link at the end of each comment. Views expressed in the comments do not represent those of CircleID. For more information on our comment policy, see Codes of Conduct.

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

Related

Topics

Threat Intelligence

Sponsored byWhoisXML API

Cybersecurity

Sponsored byVerisign

DNS

Sponsored byDNIB.com

Brand Protection

Sponsored byCSC

Domain Names

Sponsored byVerisign

New TLDs

Sponsored byRadix

IPv4 Markets

Sponsored byIPv4.Global

NordVPN Promotion