Welcome!

Government Cloud Authors: Elizabeth White, Liz McMillan, Gopala Krishna Behara, Raju Myadam, Kevin Jackson

Related Topics: @CloudExpo, Government Cloud, @DXWorldExpo

@CloudExpo: Blog Feed Post

Cloud Computing: A Data-Centric Business Model By @Kevin_Jackson | @CloudExpo #Cloud

'Enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources'

According to the National Institute of Standards and Technology:

"Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications and services) that can be rapidly provisioned and released with minimal management."

While this definition is broadly accepted and has, in fact, been my adopted standard for years, it only describes technical aspects of cloud computing.

The amalgamation of technologies used to deliver cloud services is not even half the story. Above all else, the successful employment requires a tight linkage to the economic and business models of the enterprise. Critical components for any transition to cloud include:

  • Enterprise economic model
  • Organizational goals (financial and operational)
  • Enterprise operational model
  • Relevant operational processes
  • Relevant operational resources
  • Process relevant data
  • Data classification (e.g. severity of enterprise damage if the data is used improperly)
  • Risk identification and management
  • Security controls
  • Process automation

Taking all of these components in total, cloud computing is a business model for propelling an enterprise towards its economic and operational goals. This is why cloud computing transitions cannot be left as a task for the information technology team.

The most central aspect of any business is data because data is the fuel for all business processes. The custodian of this data is the business owner. The technical aspects of cloud computing are only tools for the provisioning, manipulating and storing of data. Decisions on all aspects of any cloud computing deployment must therefore be purposely driven by business process owners. The IT Team acts as the trusted technology advisor to and the technology execution arm of the business process owners. On the flip side, the business process owner must act as the trusted business advisor to and business execution arm of the IT Team. This defines why collaboration is essential in the delivery of a cloud computing solution. It also explains why the object of this collaboration must be business data.

Data-centric collaboration explicitly addresses how an organization handles each business data-type throughout its lifecycle. In recommending industry best practices for security, the International Information System Security Certification Consortium, would recommend the use of the data security lifecycle:



Figure 1- Secure data lifecycle, Official (ISC)2 Guide to the CCSP, Domain 2

  • Create: The generation of new digital content or the alteration/updating/modifying of existing content. This phase can happen internally in the cloud or externally and then the data is imported into the cloud. The creation phase where data classification and encryption is implemented. During this lifecycle phase, data can be vulnerable to attackers if access control list are not well implemented or enforced. Correct threat scanning processes and data classification are also critical.
  • Store: The act of committing digital data to a storage repository typically occurs nearly simultaneously with creation. Controls such as encryption, access policy and backups should be implemented to avoid data threats.
  • Use: Data is viewed, processed, or otherwise used in some sort of activity, not including modification. Data in use is most vulnerable because it is might be transported into unsecure location. Controls such as DLP (digital loss prevention), IRM (information rights management) and database and file access monitors should be implemented in order to audit data access and prevent unauthorized access.
  • Share: Information is made accessible to others. Not all data should be shared, and not all sharing should present a threat. Since shared data is no longer in control of the organization, this is a very challenging phase to perform securely. Technologies such as DLP can be used to detect unauthorized sharing, and IRM technologies can be used to maintain control over the information.
  • Archive: Data leaves active use and enters long-term storage. Cost vs. availability trades based on business considerations must drive data access procedures. Regulatory requirements must also be addressed.
  • Destroy: The data is removed from the cloud provider. Destruction options are driven by usage, data content and applications. Data destruction can mean logical erase of pointers or permanently data destruction using physical or digital means.

The handling of each datatype should also be defined in terms of:

  • The actors that potentially have access to the data;
  • Potential locations for the data;
  • The types of security controls present in each potential location; and

Allowable functions in each potential location include:



Figure 2-  Identifying the functions, Official (ISC)2 Guide to the CCSP, Domain 2

  • Access: View/access the data, including copying, file transfers, and other exchanges of information;
  • Process: Perform a transaction on the data: update it, use it in a business processing transaction, etc.; and
  • Store: Store the data (in a file, database, etc.).



Figure 3- Mapping key data functions to the data security lifecycle. Official (ISC)2 Guide to the CCSP, Domain 2
The data-centric approach is crucial as more enterprises adopt the hybrid cloud model. According to Gartner, nearly half of all large enterprises will have hybrid cloud deployments by the end of 2017.  Dell, in fact, lists security and management as one of five essential consideration for hybrid cloud saying that, "Customers can now manage their own encryption keys when using a public cloud data store, and vendors like Dropbox, OneDrive and others can integrate with IT systems so that data is transparently encrypted on its way from users' workstations to public cloud services without any additional steps on the part of the end user."

A data-centric business model abandons the typical infrastructure-centric security model by adopting an explicit assumption that the IT infrastructure cannot be trusted to protect business data. Embedded in that assumption are also requirements for the encryption of all data-at-rest, data-in-motion and, if possible, data-in-use. An effective transition to cloud computing demands the adoption of a data-centric business model and the equally important broad use of encryption technologies.

This post was written as part of the Dell Insight Partners program, which provides news and analysis about the evolving world of tech. Dell sponsored this article, but the opinions are my own and don't necessarily represent Dell's positions or strategies.

Cloud Musings

(Thank you. If you enjoyed this article, get free updates by email or RSS - © Copyright Kevin L. Jackson 2015)

Follow me at http://Twitter.com/Kevin_Jackson

Read the original blog entry...

More Stories By Kevin Jackson

Kevin Jackson, founder of the GovCloud Network, is an independent technology and business consultant specializing in mission critical solutions. He has served in various senior management positions including VP & GM Cloud Services NJVC, Worldwide Sales Executive for IBM and VP Program Management Office at JP Morgan Chase. His formal education includes MSEE (Computer Engineering), MA National Security & Strategic Studies and a BS Aerospace Engineering. Jackson graduated from the United States Naval Academy in 1979 and retired from the US Navy earning specialties in Space Systems Engineering, Airborne Logistics and Airborne Command and Control. He also served with the National Reconnaissance Office, Operational Support Office, providing tactical support to Navy and Marine Corps forces worldwide. Kevin is the founder and author of “Cloud Musings”, a widely followed blog that focuses on the use of cloud computing by the Federal government. He is also the editor and founder of “Government Cloud Computing” electronic magazine, published at Ulitzer.com. To set up an appointment CLICK HERE

IoT & Smart Cities Stories
The deluge of IoT sensor data collected from connected devices and the powerful AI required to make that data actionable are giving rise to a hybrid ecosystem in which cloud, on-prem and edge processes become interweaved. Attendees will learn how emerging composable infrastructure solutions deliver the adaptive architecture needed to manage this new data reality. Machine learning algorithms can better anticipate data storms and automate resources to support surges, including fully scalable GPU-c...
Machine learning has taken residence at our cities' cores and now we can finally have "smart cities." Cities are a collection of buildings made to provide the structure and safety necessary for people to function, create and survive. Buildings are a pool of ever-changing performance data from large automated systems such as heating and cooling to the people that live and work within them. Through machine learning, buildings can optimize performance, reduce costs, and improve occupant comfort by ...
The explosion of new web/cloud/IoT-based applications and the data they generate are transforming our world right before our eyes. In this rush to adopt these new technologies, organizations are often ignoring fundamental questions concerning who owns the data and failing to ask for permission to conduct invasive surveillance of their customers. Organizations that are not transparent about how their systems gather data telemetry without offering shared data ownership risk product rejection, regu...
René Bostic is the Technical VP of the IBM Cloud Unit in North America. Enjoying her career with IBM during the modern millennial technological era, she is an expert in cloud computing, DevOps and emerging cloud technologies such as Blockchain. Her strengths and core competencies include a proven record of accomplishments in consensus building at all levels to assess, plan, and implement enterprise and cloud computing solutions. René is a member of the Society of Women Engineers (SWE) and a m...
Poor data quality and analytics drive down business value. In fact, Gartner estimated that the average financial impact of poor data quality on organizations is $9.7 million per year. But bad data is much more than a cost center. By eroding trust in information, analytics and the business decisions based on these, it is a serious impediment to digital transformation.
Digital Transformation: Preparing Cloud & IoT Security for the Age of Artificial Intelligence. As automation and artificial intelligence (AI) power solution development and delivery, many businesses need to build backend cloud capabilities. Well-poised organizations, marketing smart devices with AI and BlockChain capabilities prepare to refine compliance and regulatory capabilities in 2018. Volumes of health, financial, technical and privacy data, along with tightening compliance requirements by...
Predicting the future has never been more challenging - not because of the lack of data but because of the flood of ungoverned and risk laden information. Microsoft states that 2.5 exabytes of data are created every day. Expectations and reliance on data are being pushed to the limits, as demands around hybrid options continue to grow.
Digital Transformation and Disruption, Amazon Style - What You Can Learn. Chris Kocher is a co-founder of Grey Heron, a management and strategic marketing consulting firm. He has 25+ years in both strategic and hands-on operating experience helping executives and investors build revenues and shareholder value. He has consulted with over 130 companies on innovating with new business models, product strategies and monetization. Chris has held management positions at HP and Symantec in addition to ...
Enterprises have taken advantage of IoT to achieve important revenue and cost advantages. What is less apparent is how incumbent enterprises operating at scale have, following success with IoT, built analytic, operations management and software development capabilities - ranging from autonomous vehicles to manageable robotics installations. They have embraced these capabilities as if they were Silicon Valley startups.
As IoT continues to increase momentum, so does the associated risk. Secure Device Lifecycle Management (DLM) is ranked as one of the most important technology areas of IoT. Driving this trend is the realization that secure support for IoT devices provides companies the ability to deliver high-quality, reliable, secure offerings faster, create new revenue streams, and reduce support costs, all while building a competitive advantage in their markets. In this session, we will use customer use cases...