Welcome!

Government Cloud Authors: Elizabeth White, Liz McMillan, Gopala Krishna Behara, Raju Myadam, Kevin Jackson

Related Topics: @CloudExpo, Microservices Expo, Agile Computing, Cloud Security, Government Cloud

@CloudExpo: Article

Enterprise Cloud Security – Comprehensive Security Approach

Effective risk management can result in secure, scalable, on-demand enterprise cloud solutions

Cloud Security has been one of the top challenges reported by organizations that want to migrate to the Cloud. This is a challenge since the organization’s data may now be stored externally that can pose greater challenges to data integrity and compliance. Even though the data may be in the Cloud provider’s space, any compromises put the organization at risk. The Cloud can introduce new security risks that need to be addressed, however there are specific ways to manage the risks and leverage the benefits that Cloud has to offer and to ensure secure solutions across the Enterprise.

As part of the Cloud vendor selection, it is important to ensure a solid business presence and financial stability. If the vendor goes out of business, it’s important to make sure the organization’s data is secure and will not be lost. The vendor should provide secure service management capabilities for provisioning, updates and auditing. Prior to moving to the Cloud, an assessment of data sensitivity and compliance requirements should be one of the initial steps. Subsequently, specific vulnerabilities for the Cloud solution should be identified, documented and addressed. From an Enterprise Security perspective, policies, tools and controls should be developed for protection. There are many ways in which the security risks can be mitigated. One of the ways is to make sure that the providers have audits and certifications to ensure the security of the data. The location of the data is a common concern, if the data is needed in a specific area it is important to incorporate this aspect in the service level agreements with the vendor. Security controls at every level should be documented and addressed as part of the certification activities. For the Government, FEDRAMP is a program that supports secure cloud computing and provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.

Due to the multi-tenant aspects of the Cloud and virtualization, proper segmentation is extremely important, since segmentation problems can be very dangerous and can cause unintended consequences. It’s like living in an apartment complex, a negative event in one apartment can quickly spread to the whole complex and cause damage. Data encryption at rest, in process and in motion should be properly addressed, this includes files on servers, data being exchanged through the applications and transactional data. Smart key management should be utilized and seamless identity, access management should be addressed to authenticate users and applications. As with other deployment mechanisms, applications should be designed and developed to address security threats and attacks. For example, for web applications, security standards should be applied and vulnerabilities such as cross side scripting, information leakage, cross site request forgery, SQL injection, malicious file execution etc. need to be addressed. Perimeter security, network and host based controls should be leveraged. Governance and risk management should encompass a thorough review of processes and controls. Cloud Security may appear to be a daunting task, however applying a comprehensive security approach and effectively managing the risks can result in secure, scalable, on demand Enterprise Cloud solutions.

(This has been extracted from and is reference to Ajay Budhraja's blog).

More Stories By Ajay Budhraja

Ajay Budhraja has over 24 years in Information Technology with experience in areas such as Executive leadership, management, strategic planning, enterprise architecture, system architecture, software engineering, training, methodologies, networks, and databases. He has provided Senior Executive leadership for nationwide and global programs and has implemented integrated Enterprise Information Technology solutions.

Ajay has a Masters in Engineering (Computer Science), and a Masters in Management and Bachelors in Engineering. He is a Project Management Professional certified by the PMI and is also CICM, CSM, ECM (AIIM) Master, SOA, RUP, SEI-CMMI, ITIL-F, Security + certified.

Ajay has led large-scale projects for big organizations and has extensive IT experience related to telecom, business, manufacturing, airlines, finance and government. He has delivered internet based technology solutions and strategies for e-business platforms, portals, mobile e-business, collaboration and content management. He has worked extensively in the areas of application development, infrastructure development, networks, security and has contributed significantly in the areas of Enterprise and Business Transformation, Strategic Planning, Change Management, Technology innovation, Performance management, Agile management and development, Service Oriented Architecture, Cloud.

Ajay has been leading organizations as Senior Executive, he is the Chair for the Federal SOA COP, Chair Cloud Solutions, MidTech Leadership Steering Committee member and has served as President DOL-APAC, AEA-DC, Co-Chair Executive Forum Federal Executive Institute SES Program. As Adjunct Faculty, he has taught courses for several universities. He has received many awards, authored articles and presented papers at worldwide conferences.

IoT & Smart Cities Stories
Rodrigo Coutinho is part of OutSystems' founders' team and currently the Head of Product Design. He provides a cross-functional role where he supports Product Management in defining the positioning and direction of the Agile Platform, while at the same time promoting model-based development and new techniques to deliver applications in the cloud.
Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life settlement products to hedge funds and investment banks. After, he co-founded a revenue cycle management company where he learned about Bitcoin and eventually Ethereal. Andrew's role at ConsenSys Enterprise is a mul...
In his session at 21st Cloud Expo, Raju Shreewastava, founder of Big Data Trunk, provided a fun and simple way to introduce Machine Leaning to anyone and everyone. He solved a machine learning problem and demonstrated an easy way to be able to do machine learning without even coding. Raju Shreewastava is the founder of Big Data Trunk (www.BigDataTrunk.com), a Big Data Training and consulting firm with offices in the United States. He previously led the data warehouse/business intelligence and Bi...
Cell networks have the advantage of long-range communications, reaching an estimated 90% of the world. But cell networks such as 2G, 3G and LTE consume lots of power and were designed for connecting people. They are not optimized for low- or battery-powered devices or for IoT applications with infrequently transmitted data. Cell IoT modules that support narrow-band IoT and 4G cell networks will enable cell connectivity, device management, and app enablement for low-power wide-area network IoT. B...
The Internet of Things will challenge the status quo of how IT and development organizations operate. Or will it? Certainly the fog layer of IoT requires special insights about data ontology, security and transactional integrity. But the developmental challenges are the same: People, Process and Platform and how we integrate our thinking to solve complicated problems. In his session at 19th Cloud Expo, Craig Sproule, CEO of Metavine, demonstrated how to move beyond today's coding paradigm and sh...
What are the new priorities for the connected business? First: businesses need to think differently about the types of connections they will need to make – these span well beyond the traditional app to app into more modern forms of integration including SaaS integrations, mobile integrations, APIs, device integration and Big Data integration. It’s important these are unified together vs. doing them all piecemeal. Second, these types of connections need to be simple to design, adapt and configure...
Cloud computing delivers on-demand resources that provide businesses with flexibility and cost-savings. The challenge in moving workloads to the cloud has been the cost and complexity of ensuring the initial and ongoing security and regulatory (PCI, HIPAA, FFIEC) compliance across private and public clouds. Manual security compliance is slow, prone to human error, and represents over 50% of the cost of managing cloud applications. Determining how to automate cloud security compliance is critical...
Contextual Analytics of various threat data provides a deeper understanding of a given threat and enables identification of unknown threat vectors. In his session at @ThingsExpo, David Dufour, Head of Security Architecture, IoT, Webroot, Inc., discussed how through the use of Big Data analytics and deep data correlation across different threat types, it is possible to gain a better understanding of where, how and to what level of danger a malicious actor poses to an organization, and to determin...
Nicolas Fierro is CEO of MIMIR Blockchain Solutions. He is a programmer, technologist, and operations dev who has worked with Ethereum and blockchain since 2014. His knowledge in blockchain dates to when he performed dev ops services to the Ethereum Foundation as one the privileged few developers to work with the original core team in Switzerland.
Digital Transformation and Disruption, Amazon Style - What You Can Learn. Chris Kocher is a co-founder of Grey Heron, a management and strategic marketing consulting firm. He has 25+ years in both strategic and hands-on operating experience helping executives and investors build revenues and shareholder value. He has consulted with over 130 companies on innovating with new business models, product strategies and monetization. Chris has held management positions at HP and Symantec in addition to ...