I am working for a company which works with PHI, HIPAA, PCI and other highest sensitivity data. Their current security architecture uses hardware network monitoring tools to monitor the network connections between servers to detect security incidents and other abnormal traffic. They are looking to migrate their applications to the various cloud providers and are wondering how to do something similar there. Are there ways to guarantee network links are exclusively used only by specified hosts or components in the cloud? How would we monitor these connections, or can we only monitor requests coming in to our servers or applications? Is it just a case of trusting the provider's security claims and blaming them if there is a breach? Or can we maintain responsibility and control and should we? What are some other cloud specific security challenges that we might not be considering and how do we mitigate those? Thank you for any good info or references.
Are there ways to guarantee network links are exclusively used only by specified hosts or components in the cloud?
This depends on your cloud provider. Most cloud providers will allow this if for instance you want them to build a full private cloud for them. If you are looking for this option to provide security in terms of availability by offering connectivity from multiple data centers, then yes you could ask them. But do note this comes with a price tag.
How would we monitor these connections, or can we only monitor requests coming in to our servers or applications?
You could opt to procure IDS/IPS or WAF systems (virtual or physical) to monitor these lines. Note that in the end you are working with a cloud provider to save cost on maintenance or provide scalability, so most likely the cloud provider will have access to it
Is it just a case of trusting the provider's security claims and blaming them if there is a breach?
Probably they have their ass covered with regard to such demands and they will put blame on you.
What are some other cloud specific security challenges that we might not be considering and how do we mitigate those?
The most issues I see in the real world is with regard to hosting information in certain countries. For instance banking information from Switzerland and Luxembourg can only be hosted in those respective countries and no where else. The one fabulous thing about cloud computing is that you can have geographical failover, which means distributing your data across countries. So if you have requirements in place that require you to not distribute information to certain countries (e.g. in Europe many companies do not want to have their information sent to datacenters in the US) than you need to make those clear as well to your hosting provider.
Finally I would like to add these comments:
First you need to understand why you want to move things to the cloud. Is this for more flexible computing, less hardware maintenance, reduced costs for operating a data center, etc... or is it because someone saw that the "cloud" (did you know cloud can be replaced with just "somewhere on the internet") is cool and decided to move everything there because he heard other people were doing it.
If you do require flexible computing and scalability it might make more sense to build your own cloud infrastructure so you have full control of your environment.
Many people believe cloud computing is about automagically getting cost reduction by not having to host your own hardware, but it's at its core not different from using a managed hosting provider.
Cloud computing at its core is about scalability, flexibility and availability. If you require these properties it makes sense to move your applications into a cloud environment, if you don't then you need to reconsider.