Twitter Feed
Vivek Kundra to Speak at NRO Showcase
On the 17 & 18 June, the National Reconnaissance Office (NRO) will present the premiere Innovative Solutions Showcase. Titled “Unleashing the Crowd in the Cloud: Igniting the Innovation Insurgency“, this event…
Secure Cloud Computing on Federal News Radio
Last week the Trezza Media Group, Flyzik Group and Federal News Radio combined to produce an outstanding Federal Executive Forum on Secure Cloud Computing. Moderated by Jim Flyzik, panelist included:…
My Meeting with Mr. Vivek Kundra
Earlier this week I had the distinct pleasure and opportunity to have a private meeting with Mr. Vivek Kundra. Although my time with him and Mr. Gary Washington (OMB/Egov &IT Internal…
Comments for Mr. Kundra (Thank you for the input!)
A little over a week ago I put out a request to my readers to help me with my meeting with Vivek Kundra. The response has been awesome!! thank you…
Congratulations to Roger Baker !!
My congratulations goes out to Roger Baker ! I first met Roger a little over a year ago when he interviewed me for my present job at Dataline. At that…
NDU (IRM) and DoD CIO (NII) Co-Hosting Cloud Computing and Cyber Security Symposia
I’m proud to announce two important coming events. The Information Resources Management (IRM) College and the Office of the Assistant Secretary of Defense (Networks and Information Integration)/DOD CIO are co-hosting…
Please Help Me Plan My Meeting With Mr. Vivek Kundra !!
A couple of weeks ago, I was offered a chance to meet Mr. Vivek Kundra at the Eisenhower Executive Office Building in downtown Washington, DC. Needless to say, I was…
President Obama’s 2010 Budget Highlights Cloud Computing
President Obama’s 2010 Budget (pp. 157-158) has highlighted cloud computing as a key tool for improving innovation, efficiency and effectiveness in Federal IT. ” Cloud-computing is a convenient, on-demand model…
Federal Cloud Computing Heating Up !
As fellow blogger Reuven Cohen mentions in his post, Federal cloud computing is indeed heating up: Vivek Kundra held a US Federal Government Cloud Computing Summit yesterday The Federal CIO…
USA.gov “Flips the switch” to Cloud Computing
Last weekend, USA.gov shifted to a cloud computing platform. This move is expected to reduce infrastructure expenses by 90% and drastically improve flexibility. “‘We are flipping the switch tomorrow to…
In my first post of this series, “Cloud migration part one: An overview,” I provided a high-level summary of how enterprises should migrate applications to the cloud. In this installment, the focus is on enterprise data and why your organization may need to review and reclassify its data before moving anything to the cloud.
Security evolves with cloud
Cloud computing has done more than change the way enterprises consume information technology. It’s also changing how organizations need to protect their data. Some may see this as an unintended consequence, but the headlong rush to save money by migrating applications to the cloud has uncovered long-hidden application security issues. This revelation is mostly due to the widespread adoption of “lift and shift” as a cloud migration strategy. Using this option typically precludes any modifications of the migrating application. It can also result in the elimination of essential data security controls and lead to grave data breaches.
Manage deployment
Today, the cloud has quickly become the preferred deployment environment for enterprise applications. This shift to using other people’s infrastructure has brought with it tremendous variability in the nature and quality of infrastructure-based data security controls. It is also forcing companies to shift away from infrastructure-centric security to data-centric information security models. Expanding international electronic commerce, ever tightening national data sovereignty laws and regional data protection and privacy regulations such as GDPR. These issues have combined to make many data classification schema untenable. Cloud Security Alliance and the International Information Systems Security Certification Consortium (ISC2) both suggest that corporate data may need to be classified across at least eight categories, namely:
- Data type
- Jurisdiction and other legal constraints
- Context
- Ownership
- Contractual or business constraints
- Trust levels and source of origin
- Value, sensitivity and criticality
- The obligation for retention and preservation
Classify data
Moving to classify data at this level means that one of the most important initial steps of any cloud computing migration must be a review and possible reclassification of all organizational data. By bypassing this step, newly migrated applications simply become data breaches in wait. At a minimum, an enterprise should:
- Document all key business processes destined for cloud migration.
- Identify all data types associated with each migrating business process.
- Explicitly assign the role of process data owner.
- Assign each process data owner the task of setting and documenting the minimum required security controls for each data type.
Update policies
After completing these steps, companies should review and update their IT governance process to reflect any required expansion of their corporate data classification model. These steps are also aligned with the ISO 27034-1 framework for implementing cloud application security. This standard explicitly takes a process approach to specifying, designing, developing, testing, implementing and maintaining security functions and controls in application systems. It defines application security not as the state of security of an application system but as a process to apply controls and measurements to applications in order to manage the risk of using them.
In part three of this series, I’ll discuss application screening and related industry best practices to help you determine:
- The most appropriate target application deployment environment
- Each application’s business value, key performance indicators and target return-on-investment
- Each application’s migration readiness
- The appropriate application migration strategy
Cloud Computing
- CPUcoin Expands CPU/GPU Power Sharing with Cudo Ventures Enterprise Network Partnership
- CPUcoin Expands CPU/GPU Power Sharing with Cudo Ventures Enterprise Network Partnership
- Route1 Announces Q2 2019 Financial Results
- CPUcoin Expands CPU/GPU Power Sharing with Cudo Ventures Enterprise Network Partnership
- ChannelAdvisor to Present at the D.A. Davidson 18th Annual Technology Conference
Cybersecurity
- Route1 Announces Q2 2019 Financial Results
- FIRST US BANCSHARES, INC. DECLARES CASH DIVIDEND
- Business Continuity Management Planning Solution Market is Expected to Grow ~ US$ 1.6 Bn by the end of 2029 - PMR
- Atos delivers Quantum-Learning-as-a-Service to Xofia to enable artificial intelligence solutions
- New Ares IoT Botnet discovered on Android OS based Set-Top Boxes