Cloud computing: A data-centric business model

Amazon’s Jeff Bezos on Cloud Computing

By G C Network | June 18, 2008

Amazon’s Jeff Bezos on Cloud Computing How and when Amazon began its cloud computing effort.Why Amazon has become an innovator with Amazon Web Services and how it relates to their…

Dataline, IBM, Google, Northrop Grumman on Cloud Computing

By G C Network | June 17, 2008

My company, Dataline LLC, in cooperation with IBM, Google and Northrop Grumman Mission Systems, is sponsoring an educational series entitled “Cloud Computing in a Netcentric Environment“. The series will be…

EMC Studies Cloud Computing Security

By G C Network | June 17, 2008

Storage firm EMC has joined the Daoli Trusted Infrastructure Project which conducts research into “trust and assurance” in cloud computing environments. The team’s research will focus on cloud computing, trusted…

The Cloud Computing Marketplace

By G C Network | June 17, 2008

For explaination and details see Understanding the Cloud Computing/SaaS/PaaS markets: a Map of the Players in the Industry by Peter Laird, Kent Dickson, and Steve Bobrowski from Oracle. Update: Please…

Key cloud computing concerns by CXO’s

By G C Network | June 16, 2008

Key cloud computing concerns by CXO’s attending the Enterprise 2.0 Conference in Boston were addresed in a June 9th panel of executives from Google, Amazon Web Services (AWS), and Salesforce.com.…

IBM Cloud Computing Center

By G C Network | June 13, 2008

On June 5th, IBM announced it will establish the first Cloud Computing Center for software companies in China, which will be situated at the new Wuxi Tai Hu New Town…

EUCALYPTUS – An Open Source Cloud Computing Platform

By G C Network | June 13, 2008

Elastic Utility Computing Architecture for Linking Your Programs To Useful Systems (EUCALYPTUS) is a new project that seems to be trying to put an “open source” flavor to cloud computing.…

The Honorable John G. Grimes Speaks about Cloud Computing

By G C Network | June 12, 2008

Today I had the pleasure of hearing The Honorable John G. Grimes, Assistant Secretary of Defense for Networks and Information Intergration and Department of Defense CIO, speak on some key…

Amazon leads Google into the cloud (So what else is new)

By G C Network | June 12, 2008

In this May 1, 2008 Globe and Mail Update article, Mathew Ingram provides an excellent comparison of Amazon and Google’s cloud computing initiatives. Bottom line: Amazon leads the pack with…

Web 2.0 Expo – What is Cloud Computing?

By G C Network | June 11, 2008

For some interesting views, take a look at these video interviews on what is cloud computing. These were done during the recent Web 2.0 Expo, April 22-25 in San Francisco,…

According to the National Institute of Standards and Technology:

“Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications and services) that can be rapidly provisioned and released with minimal management.”


While this definition is broadly accepted and has, in fact, been my adopted standard for years, it only describes technical aspects of cloud computing.

The amalgamation of technologies used to deliver cloud services is not even half the story. Above all else, the successful employment requires a tight linkage to the economic and business models of the enterprise. Critical components for any transition to cloud include:

  •         Enterprise economic model
  •         Organizational goals (financial and operational)
  •         Enterprise operational model
  •         Relevant operational processes
  •         Relevant operational resources
  •         Process relevant data
  •         Data classification (e.g. severity of enterprise damage if the data is used improperly)
  •         Risk identification and management
  •         Security controls
  •         Process automation

Taking all of these components in total, cloud computing is a business model for propelling an enterprise towards its economic and operational goals. This is why cloud computing transitions cannot be left as a task for the information technology team.

The most central aspect of any business is data because data is the fuel for all business processes. The custodian of this data is the business owner. The technical aspects of cloud computing are only tools for the provisioning, manipulating and storing of data. Decisions on all aspects of any cloud computing deployment must therefore be purposely driven by business process owners. The IT Team acts as the trusted technology advisor to and the technology execution arm of the business process owners. On the flip side, the business process owner must act as the trusted business advisor to and business execution arm of the IT Team. This defines why collaboration is essential in the delivery of a cloud computing solution. It also explains why the object of this collaboration must be business data.

Data-centric collaboration explicitly addresses how an organization handles each business data-type throughout its lifecycle. In recommending industry best practices for security, the International Information System Security Certification Consortium, would recommend the use of the data security lifecycle:

Figure 1- Secure data lifecycle, Official (ISC)2 Guide to the CCSP, Domain 2
  • Create: The generation of new digital content or the alteration/updating/modifying of existing content. This phase can happen internally in the cloud or externally and then the data is imported into the cloud. The creation phase where data classification and encryption is implemented. During this lifecycle phase, data can be vulnerable to attackers if access control list are not well implemented or enforced. Correct threat scanning processes and data classification are also critical.
  • Store: The act of committing digital data to a storage repository typically occurs nearly simultaneously with creation. Controls such as encryption, access policy and backups should be implemented to avoid data threats.
  • Use: Data is viewed, processed, or otherwise used in some sort of activity, not including modification. Data in use is most vulnerable because it is might be transported into unsecure location. Controls such as DLP (digital loss prevention), IRM (information rights management) and database and file access monitors should be implemented in order to audit data access and prevent unauthorized access.
  • Share: Information is made accessible to others. Not all data should be shared, and not all sharing should present a threat. Since shared data is no longer in control of the organization, this is a very challenging phase to perform securely. Technologies such as DLP can be used to detect unauthorized sharing, and IRM technologies can be used to maintain control over the information.
  • Archive: Data leaves active use and enters long-term storage. Cost vs. availability trades based on business considerations must drive data access procedures. Regulatory requirements must also be addressed.
  • Destroy: The data is removed from the cloud provider. Destruction options are driven by usage, data content and applications. Data destruction can mean logical erase of pointers or permanently data destruction using physical or digital means.

The handling of each datatype should also be defined in terms of:

  • The actors that potentially have access to the data;
  • Potential locations for the data;
  • The types of security controls present in each potential location; and

Allowable functions in each potential location include:

Figure 2-  Identifying the functions, Official (ISC)2 Guide to the CCSP, Domain 2
  • Access: View/access the data, including copying, file transfers, and other exchanges of information;
  • Process: Perform a transaction on the data: update it, use it in a business processing transaction, etc.; and
  • Store: Store the data (in a file, database, etc.).

Figure 3- Mapping key data functions to the data security lifecycle. Official (ISC)2 Guide to the CCSP, Domain 2 

The data-centric approach is crucial as more enterprises adopt the hybrid cloud model. According to Gartner, nearly half of all large enterprises will have hybrid cloud deployments by the end of 2017.  Dell, in fact, lists security and management as one of five essential consideration for hybrid cloud saying that, “Customers can now manage their own encryption keys when using a public cloud data store, and vendors like Dropbox, OneDrive and others can integrate with IT systems so that data is transparently encrypted on its way from users’ workstations to public cloud services without any additional steps on the part of the end user.”

A data-centric business model abandons the typical infrastructure-centric security model by adopting an explicit assumption that the IT infrastructure cannot be trusted to protect business data. Embedded in that assumption are also requirements for the encryption of all data-at-rest, data-in-motion and, if possible, data-in-use. An effective transition to cloud computing demands the adoption of a data-centric business model and the equally important broad use of encryption technologies.

This post was written as part of the Dell Insight Partners program, which provides news and analysis about the evolving world of tech. Dell sponsored this article, but the opinions are my own and don’t necessarily represent Dell’s positions or strategies.

Cloud Musings

( Thank you. If you enjoyed this article, get free updates by email or RSS – © Copyright Kevin L. Jackson 2015)

Follow me at https://Twitter.com/Kevin_Jackson
Posted in

G C Network