Cloud Security Journal

The intent of the blogs is to provide the thought leadership for readers seeking to create a sound strategy for exploiting cloud computing for the enterprise.

Foundational principles of enterprise-class clouds

• To create a real-time enterprise, firms must assemble an IT operation that executes as the business behaves: on demand, ad-hoc and predictable calendar events
• The IT delivery model must accommodate an as-needed/when-needed set of capabilities that deliver information, processing, and collaboration in an on-demand manner
• Operational risk cannot be sacrificed in pursuit of this on-demand IT delivery
• IT is a supply chain of applications, information, content, infrastructure, and facilities
• Sourcing of the IT supply chain can be multidimensional: acquisition, management, and component-level sourcing. For example,
  
  1. Management level: Built internal, bought external/hosted internal, bought external/hosted external
  2. Component level: Infrastructure can be supplemented externally, the development platform can be provided externally, the application and infrastructure can be provided externally
  3. Acquisition: Can be capitalized, opex funded, variable usage expensed, or fixed contract expensed

Part 1: Security and performance
Lessons from Wall Street IT should be incorporated into your enterprise cloud strategy plans. Security and performance in a cloudlike delivery model have been hardened into best practices on Wall Street for some time. The insatiable demand for instantaneous data, rapid decision support, and microsecond latency all happening in the intermediary cloud trading exchanges provides a reference framework that can be repeated in any firm across any industry -- today!

Based on this, we can take from Wall Street three fundamental building blocks for enterprise class security in the cloud as:

• Access/trust acceptance/policy enforcement
• Data transfer security
• Data protection across multitenancy environments

In these terms, two companies (Cisco and Unisys) are providing these capabilities out of the box today.

In building private/trusted cloud models, we learned how to create both a secure and robust delivery channel in the cloud by leveraging Cisco technology. By decomposing the workload transaction lifecycle from the external data sources and market connectivity to traders or trading systems, we were able to identify performance and security design related issues across the transaction path operating through the cloud.

To accommodate this, we incorporated a software/hardware infrastructure ensemble of capabilities from Cisco. By leveraging Cisco Policy Manager and Cisco ACE appliances, we were able to create a trust acceptance channel where CRUD policies and business entitlement could be enforced at wire speed in microseconds. The relevance to the cloud is this is a DMZ zone building block that can be established as an intermediation point for enterprises and the cloud. It creates a cloud intermediary solution that both protects with regulatory granularity and enables performance. (Side note: This model can be used inside the firewall that operates across business units where access, control, and performance are critical for a private cloud delivery model.)

The other lesson we learned is the transfer and access of highly confidential data in a shared environment/multitenant cloud model requires advanced encryption in a performance-oriented capability. Unisys is a firm we collaborate with that provides software technology and integration expertise that scrambles data packets being transferred or in motion and scrambles associated data in a multitenant stored environment with advanced encryption and compression to ensure both performance and security.

The technology enables Unisys to uniquely provide to firms a hybrid solution of cloud management capabilities with a secure IAAS cloud model that allows firms to rapidly leverage cloudlike delivery models.

These technologies and capabilities have been available for some time. The key takeaway from above is for anyone tasked with building cloud models for the enterprise; there are proven technologies and approaches that can be leveraged today in building enterprise-class clouds.

The next blog in this series will focus on the lifecycle management capabilities, and operating model that firms need to incorporate into their enterprise coud strategy to be successful.