Business Of Cloud Computing Workshop Final

Editor's Notes

• #26: Used to be simpler. Every employee got a desktop, every employee got a laptop, consumer IT out-paced enterprise and now every employee wants to connect their mobile device.Cloud enables delivery of very rich applications to a mobile workforce. (expansion of capabilities). –Serious business applications can be had in the Cloud-ERP, CRM, BI. Mobile devices enable ubiquitous connectivity to this capabilities. –Any device, Any Time, Any WhereIntroduces new risks of data loss and threats. Increased threat of IP theft. –Malicious applications can attempt to steal data, create back doors, install malware, send premium text messages,Consumerization trend had added BYOD to the mix. –No longer the CEO and his iPad. Line associate want to connect their devices.Connect personal devices to clouds with company data. –How to wipe the data once device is lost/employee leaves/etc…Segregate personal and company data in BYOD scenarios–How to leave the personal data alone and only wipe company data.
• #27: Your cloud can walk away in your former employees pocket-Data can easily Cannot avoid this disruptive trend. –If it hasn’t come yet, it will come soon. Mobility will be growing at exponential rates in the coming decade.Employees are trying to access corporate systems and cloud from their mobile devices. –Employees want work/life balance an flexibility.Must assess the risk and devise a strategy. –Understand what's at stake and determine a strategy to manage mobility in your organization.Strike a balance between security and productivity-Security can overwhelm an IT dept or hamper user productivity.
• #37: How we do it at MARS-Account Management-Face of IT to the business. Validate requests for solutions. Validate scope. Compare with existing service catalog. Existing solution may fit requirements. Avoid redundancy. Work with IT Expert Centers to engage appropriate resources.Commercial-Group that focuses on vendor management, works closely with legal on contractual terms. Accountability for monitoring vendor SLAs, etc…Termination for cause including immediate for insolvency.Source Code escrow.Ability to bring the SaaS software on premise upon entering Chpt 7 Bankruptcy proceedings.Legal –Reviews contractual agreements, terms, clauses, accountability, pay-backs, etc…Executive Steering Group-Strategic vision, enterprise risk mgmt, approving material riskSenior Mgmt- Functional LeadershipEnterprise Architecture-Assess requests for new solutions against technology and enterprise architecture model(s). Strive for solution standardization. An organization may not want to implement a highly customized solution using SUSE. Security Specialists-Assess security based on questionnaires, interviews, 3rd party reports, etc…determine security threats and recommend controls to mitigate threats. Vulnerable systems, poor patching, poor change control, SaaS solution open to Internet. Make contractual recommendations to Acct Mgmt and Legal.
• #39: How we do it at MARS-Traditional security focuses onsecuring your perimeter.-The cloud is not a moat-Data is often beyond your 4 walls-Data could be spread amongst many data center.-Legal, regulatory and compliance challenges.-How to assess a moving target?-Focus on building assurance through assessments, audits, questionnaires, interviews and transparency.How to define a strategy for assessing Cloud. -Leverage industry Guidance from CSA. Guidance for Critical Areas. Cloud Controls Matrix (maps back to many compliance requirements).-Ask for SOC reports, 3rd party pen and vuln testing. Other assurance reports.-Assess web security against OWASAP top 10, Assess againsat SANS top 25. -Invest time to train your staff in cloud security and build a baseline of understanding.-Interviewing techniques to strive for higher transparency with providers that are very careful not to divulge information.