dtechnClouologyassociatepart2
0 likes101 views
The document discusses principles for managing cloud services, including IT service management principles and managing service levels in a cloud environment. It covers key areas of control for IT governance and business-IT alignment when outsourcing to the cloud. It also discusses elements that need to be in place for IT governance, such as service level management, reporting systems, clear service level agreements (SLAs), audit standards, and certification standards the provider should have. The document then summarizes ISO 20000 quality specifications for information systems and its processes for service delivery, relationship management, control processes, and resolution processes. It provides examples of questions to ask cloud providers regarding audits, data location, contract provisions, and migration to other providers.
dtechnClouologyassociatepart2
- 1. 2.2. The principles of managing Cloud services
- 2. 2.2.1 IT Service Management Principles in a Cloud Environment Outsourcing to the Cloud means that the provider needs to be in control of the complete supply chain. Key areas of control: • IT governance; the customer needs to remain in control over his/her business processes • Business-IT alignment; the customer needs to make sure that the Cloud IT processes support his/her business in the short and long term
- 3. IT Governance The following elements need to be in place: • Good Service Level Management • Different requirements for the different Cloud models • Reporting system • Clear SLA’s with ‘SMART’ performance criteria • Proper audit standards and internal audit mechanisms • Provider: • ISO/IEC 20000:2011 (Service Management) • ISO/IEC 27001-2 (Information Security) • Customer: • COBIT® or ISO/IEC 38500:2008 (corporate governance of IT) (COBIT® is a registered trademark of the Information Systems Audit and Control Association (ISACA)/IT Governance Institute (ITGI))
- 4. 2.2.2 Managing Service Levels in a Cloud Environment ISO/IEC 20000:2011 quality specifications Component Consisting of Purpose Quality specifications Information System • People • Processes • Technology • Partners To manage information • Availability • Capacity • Performance • Security • Scalability • Adjustability • Portability Support • Changes, system restoration in case of failure • Maintenance To ensure performance according to the agreed requirements
- 5. ISO/IEC 20000:2011 Processes • The provider needs to conform to the process requirements. • Its staff need to be familiar with the processes and adhere to the procedures and instructions! Process group Process Service delivery processes − Service Level Management − Service Reporting − Service Continuity and Availability Management − Budgeting and Accounting for Services − Capacity Management − Information Security Management Relationship processes − Business Relationship Management − Supplier Management Control processes − Configuration Management − Change Management Resolution processes − Incident Management − Problem Management Release process − Release and Deployment Management
- 6. Questions to ask the Cloud provider • How are audits performed? • Where are the servers located, and which legislation applies to the data? • What are the provisions when a service changes or ends (service life cycle and end of life)? • What are the provisions if we want to migrate to another provider (contract life cycle and end of life)?
- 7. 3. Using the Cloud
- 8. 3.1 Overview of Accessing the Cloud
- 9. 3.1.1 Accessing Web applications through a Web Browser • Basic ingredients: - “any” web enabled device - PC, laptop, tablet, smart phone, thin client - Internet browser - Internet connection - Provider, IP-address - Cloud based application - SaaS solution
- 10. 3.1.2 Cloud Web Access Architecture Basic ingredients: • Standard protocols (for each ISO-OSI layer) • Web enabled device • PC • Laptop • Tablet • Smart phone • And… (revival of the computer terminal) Thin Client • Internet access
- 11. Understanding open standards for the Cloud: the OSI model Copyright & source: http://www.lrgnetworks.com
- 12. Examples of standard protocols • HTTP • VT • RTSE • API-sockets • TCP and IP • SSL • Ethernet, • IEEE 802.3, • 10BASE-T
- 13. 3.1.3 The use of a Thin Client • A simple network enabled computer • No moving parts like a hard disk or DVD drive • Boots from the network • Benefits: • Lower costs; initial price and running costs • Simple; no moving parts • Better for the environment; they produce less heat and need less cooling, sometimes not even a fan • Heightened security; booting from the network with controlled access, no local data, etc. • Less chance of user errors
- 14. Categories of Web applications … for everyone • Google Gmail • Yahoo Mail • Twitter • Zimbra • Salesforce • Dropbox • Skype • …..
- 15. Categories of Web applications … for business • Customer Relationship • Management (CRM) • Enterprise Resource Planning (ERP) • HR solutions • IT Service Management • Finance & accounting • Web design and management •Email (professional) •Webmail •Office suites •E-Business •Online Storage •Collaboration •Video conferencing
- 16. 3.1.4 Overview of the use of Mobile Devices in accessing the Cloud
- 17. Mobile web enabled devices • Tablet • Smart phone Platforms: • Apple iPhone • Google Android • Blackberry • Windows phone + interoperability between different cellphone networks - no/low interoperability between platforms
- 18. Typical solutions for mobile devices • Text messaging • E-mail • Apps • Navigation • Streaming radio • TV • Internet browser • And …. Anything you can imagine (or not)
- 19. 3.2. HOW Cloud Computing can support business processes
- 20. 3.2.1 Impact of Cloud Computing on primary business processes • Primary processes are Purchasing, Manufacturing, Sales, Advertising and Marketing • Contribution of Public or Hybrid Cloud computing For example: • Purchasing and Manufacturing • Collaboration with suppliers: Exchange and share platforms • Sales, Advertising and Marketing • Interaction with potential customers and the market: social media • Communication with customers: social media • Registration of customer contacts: CRM
- 21. 3.2.2 Role of standard applications in collaboration • Social Media (also for business use!) • LinkedIN, Facebook, Twitter • Email/Webmail • Google Gmail, Yahoo Mail • Videoconferencing • Skype • File sharing • Dropbox • Sales and CRM • Salesforce
- 22. Application Example: Content Management Systems • Large numbers of people contribute and share stored data • Controlled access to data, based upon user roles • Easy storage and retrieval of data • Reduction of repetitive duplicate input • Easier report writing & communication between users: previous versions are accessible • Access is location independent
- 23. 3.3 Service providers using the Cloud
- 24. 3.3.1 Impact on Relationship Vendor Customer • The relationship between provider and customer changes • Customer intimacy: running the customer’s business • Running the whole supply chain • Requirement to demonstrate performance and compliance • New and clear SLA’s • Audit trail • Compliance to legislation, regulations and international audit standards
- 25. 3.3.2 Benefits and Risks of providing Cloud based Services • Benefits: business opportunities • New lease of life for “old” data centers (IaaS) • Better use of resources because of multi-tenancy • Economics of scale • Quickly develop and run applications in the same environment (PaaS) • Risks: challenges • Compliance - Standards, legislation and regulations • Performance - Availability, capacity, flexibility, scalability • Security • Privacy
- 26. 4. Security and Compliance
- 27. Overview of Security and Compliance
- 28. 4.1 Security risks and mitigating measures
- 29. 4.1.1 Security risks in the Cloud • Data breaches / loss • Shared technology vulnerabilities • Insecure application interfaces • Malicious insiders • Abuse of Cloud Services • Denial-of-Service • Account, service and traffic hijacking • Insufficient Due Diligence Copyright & Source: Cloud Security Alliance (CSA), paper: “Cloud Security Alliance The Notorious Nine: Cloud Computing Top Threats in 2013”.
- 30. 4.1.2 Measures mitigating Security Risks • Risk: • Data breaches/loss • Shared technology vulnerabilities • Insecure application interfaces • Malicious insiders • Abuse of Cloud Services • Unknown risk profile and account • Account, service and traffic hijacking • Insufficient Due Diligence • Mitigation: • Authentication, audit, authorization, etc. • Operations procedures, operational security practices, etc. • Design for security, etc. • HR vetting procedures, etc. • Validation of credentials, active monitoring of traffic, etc. • SLA structures, Cloud provider compliance audits • Strong authentication, active monitoring, etc. • Assess the financial health of the Cloud service provider Copyright & Source: Cloud Security Alliance (CSA), paper: ‘Cloud Security Alliance “Top Threats to Cloud Computing” Version 1.0 (2010)’ and “Cloud Security Alliance The Notorious Nine: Cloud Computing Top Threats in 2013” Controls are added in the Notorious Nine instead of mitigating measures.
- 31. 4.2 Managing identity and privacy
- 32. Overview of Managing identity and privacy
- 33. 4.2.1 Authentication • Non-Cloud authentication • Simple authentication using user-id and password • Active directory authentication • Uses your active directory account credentials • Uses Kerberos protocol (no transmission of readable data) • Authentication in the Cloud • Active directory authentication (VMware plays the role of the domain controller and/or security server) • LDAP (Lightweight Directory Access Protocol) or Kerberos
- 34. Triple-A Authentication • Authentication • Triple identification, what/who you • Know (password) • Have (token/smart card) • Are (fingerprint or retina scan) • Authorization • leveled • Accountability • periodic logs & audit data
- 35. 4.2.2. Main aspects of Identity Management • Typical characteristics of an Identity Management system are: • Role management; IT implementation of a business role. • Role hierarchy; a representation of an organization chart. • Separation of duties. • Group management; permissions are not given to people but to roles. • Self-service functions. • Password synchronization. • Digital Identity; presence and location determine available services and capabilities.
- 36. Single sign-on (SSO) for web services • Problem: Security infrastructure in the Cloud is distributed • Solution: Single sign-on (SSO) • All distributed elements consolidated on an SSO-server • Credentials are offered by AD-account, token or smart card • Uses SOAP protocol
- 37. 4.2.3 Privacy, compliance issues and safeguards in Cloud Computing • Issues • Handling of Personal Identifiable Information (PII) • Compliance to international privacy legislation and regulations • Safeguards • Effective Access Control and Audit • Secure Cloud Storage • Secure Network Infrastructure
- 38. Personal Identifiable Information (PII) • Forms of identification: SSN, passport, fingerprints • Occupational: job title, company name • Financial: bank numbers, credit records • Health care: insurance, genetic • Online activity: log-ins • Demographic: ethnicity • Contact: phone, e-mail
- 39. International Privacy/Compliance • USA: the Privacy Act 1974, federal laws HIPAA & GLBA and Safe harbor • Japan: Personal Information Protection Law and Law for Protection of Computer Processed Data Held by Administrative Organs (1988) • Canada: PIPEDA (Personal Information Protection and Electronic Data Act 2008) and Privacy Act (1983) • EU: Laws and privacy standards of the member countries, EU Internet Privacy Law (DIRECTIVE 2002/58/EC, 2002) and EU Data Protection Directive (1998)
- 40. Safeguards • Effective Access Control and Audit • Single sign-on (SSO) • Strong authentication: password & biometric measure • Review on audit logs • Secure Cloud Storage • Encryption • Integrity by mechanisms as hashing • Secure Network Infrastructure • Encryption protocols against leakage • Integrity protocols (digital signatures) against modification • Consult a lawyer, specialized in international legislation • Know where (which country) your data is
- 41. 5. Evaluation of Cloud Computing
- 42. 5.1 The business case
- 43. 5.1.1 The business case for Cloud computing
- 44. Business drivers • Flexibility • Time-to-market (TTM) • Costs • TCO • CAPEX vs. OPEX • TCAO • Service Level Agreements (SLA) • Performance, Security, Availability, Scalability, … • Architecture • Integration (PaaS), migration • Green(er) computing
- 45. Compelling feature: quicker time-to- market But… • Can the cloud provide the resources faster than when hosted locally in your company? • What do we give up? • What do we gain? • Is your organization willing to compromise? • Are the organization, employees, IT staff, other interested parties willing to make the change without delay?
- 46. TCO ‘and all that stuff’ Statement: into the Cloud lowers your TCO of IT • Is this true or are you just redistributing costs? • Capital costs are lowered significantly, but are replaced by subscriptions, pay-per-use, expensive support contracts, etc. (CAPEX becomes OPEX) • We need to compare what we are paying now to the Cloud scenario • Not only as a snap-shot, bu also as a long term video
- 47. Example: Total cost of application ownership (TCAO) • Server costs • Storage costs • Network costs • Backup and archive costs • Disaster recovery costs • Data center infrastructure costs • Platform costs • Software maintenance costs (package software) • Software maintenance costs (in-house software) • Help desk support costs • Operational support personnel costs
- 48. 5.1.2 Operational and staffing benefits • Operational benefits (examples): • Managed services • Self-service (unmanaged services) • instant server deployment • software licensing without impact on CAPEX • uptimes are guaranteed • Backups as a service (always off-site) • Staffing benefits (examples): • Less IT staff (less wages to be paid) • Lower recruitment, HR and training costs • Lower employee benefits
- 50. Overview of Evaluating Cloud Computing Implementations
- 51. 5.2.1 The evaluation of performance factors, management requirements and satisfaction factors Typical questions to be asked are: • How long does it take to resolve incidents and problems? • How good is the security of the Cloud data center? • How does system performance; i.e., connection and transaction speeds, compare to your own data center and private network? Advice: It makes sense to do a comparative study of several providers before you sign a contract.
- 52. Evaluating Cloud Implementations • Power savings • Floor space savings • Network infrastructure • Maintenance • Software licensing • Time to value • Trial period • Service • Wiser investment • Security • Compliance • Faster delivery of what you want • Less CAPEX • Short-term needs
- 53. Performance, Requirements and Satisfaction Try before you buy! • Demand a trial period! • Do not commit until you are certain it works the way you want, especially when considering a completely new software package or completely new service!
- 54. 5.2.2 Evaluation of service providers and services: what you get for your money You need a Governance framework! • Performance • monthly technical performance reports; • exception reports; • quarterly management reviews. • Compliance • Third party statements for: • SAS70, ISAE3402 • ISO/IEC 20000, 27001, 9001, etc.
- 55. END