Cloud Seeding
- 1. IT/Network Operations concepts and strategies to improve the production of your Cloud. Q4 2017
- 2. Colorado Cloud Alliance Security Summit: 11/09/2017 Joe Dietz – Network Security Professional [email protected] (303) 257-8614 cell https://www.linkedin.com/in/joe-dietz-961105/ Alumni of CCM, County College of Morris—NJ 1986 Alumni of RIT, Rochester Institute of Technology—NY 1988 Current Certifications: GCIA – SANS 2000 CISSP – ISC2 2003 CNSE – Palo Alto Networks 2015 CCSK – CSA 2017 Activities: Volunteer in faith based nonprofits Skiing, IMSA Scrutineer, Car guy Disclaimer: This presentation represents my opinions and thoughts and not that of my employer… “…just joe…”
- 3. Local User Groups & Events: Colorado/Denver User Groups: • CSA Cloud Security Alliance • InfraGard • InfraGard nfoSec Working Group • ISSA – South Tech Center • OWASP • Palo Alto User Group Denver Events: • SnowFROC -- OWASP • IT Summit • Interface • IT Roadmap • RMISC • Secure World • CSA Summit Participate in the SANS GIAC Advisory Board – Email Distribution Encourage all to continue to learn and stay current on security best practices. ( A drinking club with a Cloud Security Problem… )
- 4. When was the first hybrid car manufactured? ? Leaf Prius Other
- 5. We have been here before... 1896 Armstrong Phaeton first gas/electic hybrid, also had an electric start Toyota Prius – 1997; Nisson Leaf -- 2009; Chevy Volt – 2010 Cloud computing is the result of the evolution and adoption of existing technologies and paradigms. The goal of cloud computing is to allow users to take benefit from all of these technologies, without the need for deep knowledge about or expertise with each one of them. – Wikipedia.org
- 6. Silver iodide can improve production…
- 7. Organizations are like snowflakes… Every company is different and no two cloud initiatives are the same… Why move to the cloud…? Elasticity Agile, time to market with new products Save $s; reduce TCO Born in the cloud Compliance How successful are your cloud initiatives? Like the Internet, Cloud can be the great equalizer, allowing SMB to compete and surpass traditional enterprises
- 8. Private/Hybrid cloud --consumer runs a cloud environment / service within their enterprise or uses private cloud offering from the cloud providers (typically extending the internal network into a service providers hosting center). Source: CSA Guide CCSK
- 9. Top Down C-Level Directive…TCO Our competition is doing it...we need 100+ apps moved into the “cloud” in the next 18 months…
- 10. Bottom Up Agile – DevOps Teams A Partner has prototype in cloud; like to point the app at production “intranet” data sources
- 11. The perception is Cloud is easy… Push a button or swipe a card on a portal and start saving $s…
- 12. Businesses Can’t Afford to Ignore Hidden Public Cloud Costs -- Josh Rhine October 20, 2017 Let’s stop acting like public clouds aren’t expensive. …What happens, for most businesses, is changes in application and infrastructure use patterns lead to high costs, unexpected fees and similar expenses that add up well beyond your initial pricing expectations. The solution, according to InfoWorld, is to establish a greater degree of governance and oversight within corporate cloud plans so your company can understand costs and predict expenses with greater accuracy. http://lumecloud.com/top-5-reasons-aws-public-cloud-kinda-sucks/
- 13. Build a VPN to Cloud Provider…xyz
- 14. DevSecOps The closer you get to SaaS the less “standard” security visibility becomes Traditionally SysAdms and NetAdms were responsible for operations security—SecOps. Traditional tools are typically Server and Network based…example: how to you have SaaS send logs to SIEM? Multi-cloud is the goal, but tools are different…uhg! “Operations” Security is not typically part of developers DNA…
- 15. Cloud Seed The cloud is sometimes represented as a hassle-free option, easy to migrate to and easy to use. This is true - to a degree. With a well-planned migration and experienced staff orchestrating the move, shifting your organization over to Office 365,(insert your favorite cloud/app) can be fairly straightforward. Source: Five Pillars to Optimize O365 Readiness by Eric Shupps, MVP & Metalogix
- 16. Cloud Seed… While it is clear that Office 365, (insert your favorite cloud/app) has enormous benefits for today’s enterprise, moving to the platform still requires considerable planning and preparation. For organizations that already use Microsoft SharePoint, the move will require complex data migration, helping employees adapt to the new environment and require your company to change the way it works in many aspects. Source: Five Pillars to Optimize O365 Readiness by Eric Shupps, MVP & Metalogix
- 17. Enter “Cloud” Manages Service Providers aka Cloud Service Brokers Public cloud infrastructure as a service (IaaS) delivers compute, storage and network resources in a self-service, highly automated fashion. The leading public cloud IaaS providers also offer platform as a service (PaaS) capabilities and other cloud software infrastructure services as part of an integrated IaaS+PaaS offering. Yet such services do not completely eliminate the need for IT operations management. Customers still need expertise to choose the right service elements and to configure them appropriately, and they retain responsibility for the guest OS, middleware and applications that run on their IaaS compute instances. Furthermore, cloud IaaS introduces new challenges in governance and financial management. Customers often want cloud IaaS assistance from a third party, either on a short-term tactical basis or as part of a long-term infrastructure management strategy. Consequently, an ecosystem of managed and professional service providers has arisen to provide services on top of public cloud IaaS offerings. These managed service providers (MSPs) are a type of cloud services broker (CSB). Gartner Magic Quadrant for Public Cloud Infrastructure Managed Service Providers, Worldwide Published: 02 March 2017 ID: G00314772 Analyst(s): Lydia Leong, Gregor Petri, Michael Warrilow, Mike Dorosh, Ron Blair
- 18. Selecting a Cloud Use CSA Cloud Control Matrix to help select… Corporate culture may lean toward one cloud provider over another. Licensing or contracts may drive your company towards one cloud over another. Service model / types: SPI SaaS, PaaS, IaaS; EaaS, SecaaS, BDaaS, LaaS…others?
- 20. Cloud Seeds Moving services to the cloud is a form of outsourcing; the golden rule of outsourcing is “understand up-front and plan for how to exit the contract”. Source: CSA Guide CCSK Consider app portability? Moving from Azure to AWS or running in both etc..multi-cloud environments… Security and compliance is a shared responsibility model. The CSP is responsible for securing the Cloud infrastructure, while the cloud user is responsible for securing what goes into the cloud, be that data or an app. Source: CSA Guide CCSK
- 21. Clouds can dissipate… Cisco discontinued its “Intercloud” cloud offering – March 2017. Intercloud was introduced in Q1 2014. “Intercloud Services is based on the OpenStack open-source cloud software, like the public cloud that HP launched and then killed. Dell mulled launching an OpenStack-based cloud but backed away form the plans. Rackspace, which helped develop OpenStack, decided to stop providing commodity cloud services based on OpenStack and pivot toward managed cloud in 2014. So Cisco’s choice is not unprecedented. What it is another indication of is the power of the biggest cloud providers, particularly AWS. --Google, IBM & Microsoft round out the leaders in this space. … Cisco -- For the last several months we have been evolving our cloud strategy and our service provider partners are aware of this.” Source: https://venturebeat.com/2016/12/13/cisco-confirms-its-killing-intercloud-public-cloud-in-march-2017/
- 22. Select the Apps Select the apps or were you told move these apps because they are expensive to run etc…TCO Vetting legacy applications for Cloud is extremely important and can be difficult. “Capped apps” might not be the best choice for cloud…although it is attractive on paper. Move test/dev to cloud for “DevOps” continuous integration… production on traditional network. Traditional cloud requirements, do apps need to take advantage of Elasticity or resource bursting? Is the “data” the app uses appropriate for the cloud? Add encryption? Compliance GDPR…etc Performance adding 50-75ms in network latency impact your apps and users? Cloud Seed Which is the hardest app to transition to the Cloud? From an infrastructure perspective it is The first…
- 23. Cloud Seeds Data Link & IDG Cloud Survey Q4’ 2016 “…Interestingly nearly 40% of organizations with public cloud experience report having moved public cloud workloads back to on premises, mostly due to security and cost concerns…” Source: http://www.idgenterprise.com/resource/research/2016-idg-enterprise-cloud-computing-survey/ Reality is: not all apps are good candidates for cloud…???
- 24. 2017 Forbes https://www.forbes.com/paloaltonetworks/cloud-confident/#76e5e93b5bc5 On average 70% of compute still resides in traditional datacenter. -- Colorado CSA Meeting -- CenturyLink Cloud Sales Q2 2017.
- 25. Approaches to Cloud… Extend the datacenter: Dedicated Circuits, MPLS, MSP Build IPSec VPNs or leverage SD-WAN Network design needed in the cloud, IP space etc… Enable the edge: Facilitate SaaS in your DMZ Oauth tokenization, SSO, IAM Federations Proxy like DMZ application gateways and API connectors Fog Data Services
- 26. Extend the Datacenter -- Internet
- 27. Cloud Seed As folks depend more and more on cloud, the network performance of shared Internet access is not able to meet business expectations. Mature hybrid cloud deployments therefore are moving to dedicated connections to major cloud providers. (source, …just Joe’s… reading.) Wait a second…I thought we were moving to the cloud to get out of having private dedicated IT and Network resources…what the…! ( ..from an IaaS perspective…)
- 28. Extend the Datacenter -- Circuits
- 29. Cloud / SD-WAN
- 30. Cloud Seed – Be mindful Network Complexity is Creating its Own Vulnerability: While increases in malware are a major threat to both enterprises and service providers, network complexity is creating its own vulnerability. According to a survey sponsored by network test equipment provider Ixia, the average enterprise is using six different cloud services while network segmentation is increasing. However, 54% of enterprises are monitoring less than half of those segments and less than 19% of companies believe their IT teams are adequately trained on the wide array of network appliances they are managing. Ixia anticipates that key security topics this year will be network visibility into every segment, IoT monitoring, and AI (artificial intelligence). –2017 IXIA
- 31. Operational considerations Scale Size of the corporate infrastructure Size of the cloud initiative Cloud Computing Security and Risk Assessment – from ENISA stats focused on SME not Large Enterprises— hmm… IP v4 address conflicts, RFC 1918? Q3 2017, AWS has started to support IPv6 in the cloud. Finally!
- 32. Approaches to Cloud… Enable the edge: Facilitate SaaS in your DMZ Oauth tokenization, SSO, IAM Federations Proxy like DMZ application gateways and API connectors Fog Data Services
- 34. Agile Hybrid Edge/DMZ Copyright © 2017, Skyport Systems Inc. All rights reserved.
- 35. Clouds are constantly changing… December 2016 Amazon adds “artifact” https://aws.amazon.com/blogs/security/introducing- aws-artifact-speeding-access-to-compliance-reports/ …until legal cases involving cloud incidents have become more common place and commonly accepted best practice guidelines exist, analysis results for cloud security incidents incur the risk of not standing up in court. Source: CSA Guide CCSK
- 36. Where you can more Information… SANS Reading Room ISC2.org BrightTalk.com has tons of Cloud webinars Association & Vendor Webinars How Hybrid Clouds Connect to Your Network; Understanding and Mitigating the Risks of VPN-to-Cloud and Cloud Application Gateways – Michael Beesley https://go.skyportsystems.net/2017-09-21-webinar-uws-2lp.html Join your local CSA chapter CSA CCSK Interoperability and Portability -- CSA Security Guide CCM Cloud Control Matrix 3.x Join CSA on LinkedIn ~Blogs, you mileage may vary Gartner, Forrester , Frost & Sullivan Books, hmm, not so much, as things change so quickly…
- 37. Related reading: Meta-Cloud Services – on prem CAM – CenturyLink Application Manager aka Elasticbox – cloud app mgmt / orchestration Cisco Cloud Center aka CliQr – cloud app management Morpheus – cloud app management RiverMeadow -- cloud migration DivvyCloud Utilization bots tCell – plugin/wrapper per app WAF-ish CSP’s like lumecloud.com etc… Cisco Fog for IoT and Analytics AWS CloudFormation Apache Mesos/Marathon Docker containers on steroids--Kubernetes and the commercial spinoffs Is Kubernetes the holy grail of cloud interoperability? October 25th, 2017 Cisco announces support for Kubernetes with ACI Evolving beyond multi-pod and multi-site deployment models, ACI will soon be available within public cloud environments, including Amazon Web Services (AWS), Google Cloud Platform and Microsoft Azure
- 38. Today’s SuperCloud Hybrid… Modern Hybrid SuperCar -- Koenigsegg Regera
- 39. The Sun is always shining, its just your perspective on the “Cloud”… ;-) Respect others, their opinions and be kind to one another… Thank You for your time… …just Joe…
Editor's Notes
- #2: Good Morning and thank you for taking your time to be here today… NEWS For the next 40 minutes or so, I would like you to consider that you have tuned into a your favorite local weather station. The accuracy of this forecast or presentation may vary depending on where you live. And I think it is safe to say, in the context of the CSAsummit, that today it will be mostly “cloudy”. We will review traditional IT/Network Infrastructure, that if implemented right, can enable successful hybrid cloud initiatives. With the short time we have, I hope the “sound bytes” presented stir your interest and inspire further discussion and reading in the area of cloud computing.
- #3: This presentation represents my opinions and thoughts and not that of my employer… Slides are available on the CSAcolorado.org website…or contact me… Lets have a conversation…please do ask questions during the presentation. Many of the themes in this presentation are backed up by third party references—not just joe’s opinions.
- #4: “Cloud Seeding…” == nuggets of information…I hope you are able to refer back to this presentation… Information in this presentation is a combination of my own experiences, attending conferences, experience shared by my peers, general white paper, blog reading and webinars. Hopefully will have saved you some time collecting this information… All this ties back to the quest for great craft beer. SnowFROC (Front Range OWASP Conference) is Denver's premier application security conference and is taking place Thursday March 8th 2018. The location of this event is The Cable Center on the University of Denver campus near I-25 and University.
- #5: Let’s talk Hybrids; Operational challenges when implementing Hybrid Cloud is the focus of this presentation, yet not exclusively…some aspects do touch on PaaS and SaaS Traditional Companies: Unless your company was born in the cloud, we are all dealing with Hybrid environments.
- #6: Sold for a fee-inclusive price of $483,400 at the Bonhams Amelia Island sale on Thursday, March 10, 2016… This presentation is mainly from the perspective of established enterprises. Comments tend to focus on Hybrid cloud initiatives. There are new manufacturing techniques that enable us to build better hybrid cars and clouds… 1912 Cadillac was the first car manufacturer to offer electric starter in their cars.. Wiki: First clouds… AWS EC 2006 Azure 2010 Nasa Nebula 2008 – open source
- #7: Usually silver iodide “smoke” is dispensed from planes. What industries care about cloud seeding…other than ski resorts…Energy Companies and Water Districts Statistics show that Cloud Seeding improves snow production ~5-10% ; Cloud seeding is still more theory than fact. Dr Jeff French has a project to change that…last week. SNOWIE project University of WY Dr. Jeff French ATMOSPHERIC SCIENCE http://www.9news.com/weather/this-project-could-answer-if-changing-the-weather-through-technology-is-possible/488620797 As snow and rain need a nucleus of dust to be productive; digital clouds need “networks” of some flavor to be productive. I will be inserting “Cloud Seeds” or quotes and information I hope you will find useful in these slides. Source Google: Science. According to the World Meteorological Organization's International Cloud Atlas, over 100 types of clouds exist! But although there are so many variations, each one can be divided into one of ten basic types depending on its general shape and height in the sky. Dust” is necessary to create rain/snow…ice begin forming when water vapor condenses on micrometer-sized particles of dust floating in the atmosphere. The dust particles grow to millimeter-sized droplets, which are heavy enough to begin falling. As they fall, the droplets accumulate more and more moisture, until they become the large snowflakes or raindrops that we see here on the ground.
- #8: Prototyping tends to move quickly, but moving Clouds initiatives to production operations can be frustrating. Successful cloud initiative are challenging to get right. Weather forecasters have tools and experience to help with accuracy in forecasting. As the tools improve , like weather satellites etc…the weather forecast accuracy has improved. As Cloud management and orchestration tools improve it should help forecasting successful cloud initiatives.
- #9: Ask the audience for show of hands… Scale 1-5 who has a 5, who had 3 or 4 and I wont ask how the rest went. What worked and what still needs work…? No two cloud initiatives are the same, even within a company. They likely have different compliance and regulatory issues to deal with.
- #10: This slide is somewhat data or oversimplified…there really is no dotted line… ;-) One theme, consider if we still need traditional skill sets like network architecture to enable cloud. Add multi-cloud to the hybrid definition… Add on prem private cloud provided by Azure and others… Rarely is it an either or; normally both. The key tends to be--what data is involved, governance, compliance and regulatory restrictions.
- #11: Cloud projects tend to come from two direction… How do Cloud initiatives get started? Top down: $$$$$ TCO; project that suggested moving 100+ apps to the cloud. After vetting the apps for cloud about two dozen were actually candidates for the cloud and performance issue limited which could move out of the 25. Some with true agile environments might chuckle at the 18month time frame… ;-)
- #12: This is typically new techniques and applications vs. legacy apps… Bottom up: pressures form the business to move quickly to market with new products and mobile products; later we will dive into the network architecture that will enable Cloud Center and CAM—from CenturyLink Want to use CliQr aka Cisco Cloud Center or CAM Cloud App Manager -- CTL PaaS DevOps; look mom no OS to manage ;-) SAP Hana PaaS & other SaaS gateways or API connectors
- #13: No matter which direction the cloud initiatives come from, like most IT projects, things tend to be over simplified…$$$ savings??
- #14: Example of a contrasting view that cloud can save you $; Like VMware, if not managed correctly, cloud “sprawl” will create budget overruns. Corp Governance to keep costs in check vs. allowing for development creativity… http://lumecloud.com/ as an example of an AWS competitor’s view on cloud; not going to go into these hidden costs in this presentation but a tickler/seed for further reading
- #15: The first request that IT/Network operations will receive from folks is simply build us a VPN… The VPN is straight forward enough to create… Opening Pandora's box if you do not have supporting infrastructure deployed. We need the supporting IT infrastructure to make sure we are meeting InfoSec and Governance policies regarding Data, Access, Logging etc… Are the DevOps teams following tradition DMZ governance and policies?
- #16: Dev-Sec-Ops ? Few things to consider… How much can we enable our development teams to take on? No matter who is tasked with providing or managing the security at your company, cloud security is a Shared Security Model. SIEM security information and event management DevOps owning Security? Still a struggle for the industry as it is still not part of a developers DNA. Many traditional development teams do not make network, firewall or load balancing infrastructure decisions… IT, Network and Security architects are still needed to design the cloud enclave or DMZ--or you need really expensive talented highbrow SecDevOps folks
- #17: Remember “We have been here before…”; be methodical in approaching your cloud projects and initiatives and you will likely save yourself from struggling with pitfalls.
- #18: Point out that this is a well known and standard applications…and it is still a challenge, what about portability… Using SharePoint today…what is involved if you move to Google tomorrow… How do we improve our operations teams, so they and the infrastructure are ready for cloud?
- #19: On the topic of planning…if it were easy, there would not be CSBs Hybrid Cloud for established IT shops is not trivial…there is a lot to learn and a lot to be gained by a successful cloud deployment. Security and Visibility need to have parity with traditional corporate governance, compliance, policies and controls. Traditional MSPs like AT&T just announced Cloud Services Broker offerings in Q4 2017.
- #20: XaaS folks have some other typs of “aaS”? Anyone using FedRAMP? Can you share? PCI: Payment Card Industry; SPI == SaaS PaaS IaaS, LAMP == Linux Apache Mysql, Php; HIPAA; Health Insurance Portability and Accountability Act Platform, Infrastructure; Platform as a Service -- Azure, Software as a Service – SalesForce; Infrastructure as a Service -- AWS, Environment as a Service – IBM SkyTap; EaaS == Enterprise as a Service; IDaaS; BDaaS BigData as a Services; LaaS: Lab as Service; Just because the cloud has a compliance rating like PCI does not mean your app does…you still own that part of PCI. Capped apps? DevOps considerations? Hadoop? LAMP? Big Data, AI etc… Governance & Compliance considerations, PCI, HIPAA, FedRAMP etc
- #21: Top cloud providers from Forbes hot off the press…MS#1 and IBM#3 IBM highly successful emphasis on transforming its vast array of software expertise and technology from the on-premises world to the cloud. … helping big global corporations convert legacy systems to cloud or cloud-enabled environments
- #22: Think of this in some ways as if you were opening your own new private datacenter…that is a well known activity.
- #23: Product can also be discontinued… Clouds are changing at an unprecedented rate; offering new products and techniques to solve complex IT challenges. What happens when a CSP discontinues a product?
- #24: Do you select the apps you want to move to the cloud before you select a cloud??? Network latency is often overlooked… “Answer: The First…” from an infrastructure perspective, you need to have your ducks in a row, security parity between on cloud and private on prem etc… Data is king of the cloud… If you don’t do a good job of vetting your apps for the cloud…next slide General Data Protection Requirements How is your data going to get to the cloud, SSH, SFTP, TLS, IPSEC VPN or dedicated circuit? How are you going to create your corporate standard system images in the cloud? Can it be automated or how much can be automated? Consider PaaS or SaaS…? What if some apps live in one cloud or even another cloud, but no master account to help control “cloud sprawl”? CliQr is good at managing the apps but not he cloud infrastructure. How does moving to the cloud impact your current operations processes, like change control? How do you grant access to cloud resources private/public? Corporate vs. Customer How will you keep track and audit data that is in the cloud?
- #25: What happens if you don’t get the planning right…based on this stat, this is more common than we would like All apps don’t fit in the cloud…this is not because the cloud didn’t work but the apps were not vetted well. Also, things like cloud licensing structures and response times to on prem my be counter productive to cloud.
- #26: The goal is to shed light to increase the success of hybrid cloud projects… Data point 70% …Forbes Likely moving to a 60% Cloud 40% on premise private Hybrid Cloud…these numbers may vary based on where you live ;-)
- #27: Two major approaches to cloud are to extend the data center and enable the edge…you might do some of both. Fog ( Cisco ) IoT related streaming data
- #28: VPN connectivity is a good place to start extend the datacenter to the cloud…if you have supporting infrastructure… Companies have done a good job of providing for services in an on premise DMZ…I would encourage your next DMZ to be in the cloud. Stretch or drag the DMZ from a network perspective to a cloud provider. Parity: Purchase DDoS protections from your ISP for your traditional DMZ and IGW…does Cloud DDoS offer parity? How and can they be integrated? Does it matter?
- #29: Read this slide…excellent points!
- #30: So what does “dedicated” connectivity look like… This is fine for “private”…but will you consume “public” same as folks outside the organization.
- #31: Leverage DIA and traditional infrastructure… Still need tradition infrastructure or networks for the SD-WAN overlay…SD-WAN includes VPN/DIA SD-WAN Generic white box hardware Layer 7 routing decisions Services chaining, LB or FW IPSEC is its first language
- #32: Be mindful, networks can be a source of problems;
- #33: Still need IT/Network operations to build the initial underlying infrastructure… Wait, I don’t need network admins anymore its all in the cloud…you mean my app team gets to manage the FW in the cloud via DevOps? Yikes? European Union Agency for Network and Information Security (ENISA) is a centre of expertise for cyber security in Europe. The Agency is located in Greece with its seat in Heraklion Crete and an operational office in Athens. Update (7/13/2017): Since this post was published, IPv6 supported has been extended and now supports 15 Regions and Multiple AWS Services.
- #34: How do we enable the business to be more agile…Setup an environment to enable DevOps and get out of the way. ;-) Two major approaches to cloud are to extend the data center and enable the edge…you might do some of both. Fog ( Cisco ) IoT related streaming data Building blocks & Visibility – think back to enabling the DMZ Authentication Security Logs IT processes, trouble tickets, trouble shooting, change control etc… Governance –translate our on premise processes to the cloud…?
- #35: “Be the Cloud…” Everyone should get started building a “hello mom…” app in the cloud. This will highlight all the governance, compliance and InfoSec challenges that need to be dealt with before you have a Top down move 100+ apps initiative. SaaS in “your” DMZ…get back into the application proxy business…CASB,(cloud access security brokers) We are all good at exposing things to our customers via a traditional DMZ…websites and apps… CASB tries to fill the gap to empowering seem less hybrid cloud environments—changing quickly… Key architecture…compare web proxy and xml proxy for exposing “internal” APIs Consider exposing APIs, securely in your DMZ…API proxy, API or XML gateways and API connectors….owned, enable, empower the DevOps initiatives. Why? Consider the time to create a network path between you and your partner…VPN, dedicated circuit, FW changes…change control. Now consider if the DevOps team had a proxy…say XML gateway of sorts to securely expose data apps outside the traditional datacenter…you may be your own consumer of this… Use SIEM logs as another example.
- #36: How Hybrid Clouds Connect to Your Network; Understanding and Mitigating the Risks of VPN-to-Cloud and Cloud Application Gateways – Michael Beesley https://go.skyportsystems.net/2017-09-21-webinar-uws-2lp.html
- #37: Lastly, clouds are evolving and are very dynamic. New features are added quarterly…
- #38: Cloud technology is changing so fast I am not sure traditional books are the best place to get current information. If anyone has some good Cloud book titles to share please to send them along… Underscore the VPN-less architecture of API gateways in the DMZ.
- #39: Tarball Docker Kubernetes; Kubernetes allow for infrastructure scheme designs…like load balancers and firewall rules. The next level of Orchestration…. Anyone using Cisco ACI in their datacenter today? Note the Cisco Announcement above… Cisco ACI = Application Centric Infrastructure https://blogs.cisco.com/news/aci-anywhere
- #40: Who needs a car like this…? Who wants a car like this…? SUV NetFlix is the “cloud” supercar…most companies will never need this car…but by being diligent and methodical in analyzing your needs your hybrid/car/cloud will be productive. Most companies will end up with a more practical form of car/cloud such as a truck/van or SUV. The dust particles that the moisture formed on were delivered in the rain drops to your car. Car tip, don’t try and save water, and wash your car while it has rain drops on it…as it will scratch the paint finish ;-) Always rinse the car first and always use a high quality soap…never use dish soap to wash you car as it will remove the wax.
- #41: If you are not yet involved with the CSA, I was sitting where you were a year ago… Colorado CSA CCSK study groups…mention Mohamed Malki CCSK was a bit more on policy side vs. technical or implementation guide.