Welcome!

@CloudExpo Authors: Liz McMillan, Harry Trott, Ashish Nanjiani, Moshe Kranc, Elizabeth White

Related Topics: @CloudExpo, Microservices Expo

@CloudExpo: Article

Demilitarized Cloud (DMC) Pattern

DMC is a simple pattern to start with on the path to cloud adoption

The traditional web hosting architecture is built around a common three-tier web application model that separates it into presentation (web servers), application (application servers) and persistence (database servers) tiers. From the security perspective, while database and applications servers almost always reside in the secure internal network, web servers could possibly go into DMZ if external access needs to be provided to the application from the untrusted network.

We are all very much familiar with what a Demilitarized Zone (DMZ) is. Wikipedia defines it as a physical or logical sub-network that contains and exposes an organization’s external services to a larger untrusted network, usually the internet.  Its purpose is to segregate the highly sensitive infrastructure into a secure internal network leaving only the publicly accessible services outside. While this does not mean in any way that services in DMZ are not secure, it certainly implies that sensitivities attached to these services are not as high as those hosted within the secure internal network – a key point that will be elaborated further down in the article for identifying candidates for cloud migration.

Typically, services that reside in a DMZ are those that need to be publicly accessible from the untrusted network. Web servers, web emails, proxy servers, file access (e.g. FTP), VPN services and DNS are some such examples. Putting web servers in DMZ ensures that internal web services cannot be compromised by providing direct access to them from the untrusted network. Similarly, with the increasing number of remote and mobile users, it has become necessary to employ email frontends and reverse proxy servers in DMZ to ensure that the primary email server is never directly exposed to the untrusted network. Motivations for other services listed above are not different.

Having elaborated the concept of DMZ, it needs to be emphasized at this point that the purpose of this article is not to discuss DMZ architecture or replicate it in the cloud, but to utilize it for identifying appropriate candidates for cloud migration. It should help enterprise architects in setting up policies and coming up with architecture blueprints for their publicly accessible applications.

When it comes to public cloud adoption, security is the primary concern of most of the senior IT leaders I talk to. Since this has more to do with the fear of the unknown (a new public platform) than anything else, the solution I propose as a cloud strategist is aimed at gradually increasing their comfort level with it. That is, instead of taking a lift and shift approach of moving an entire platform (e.g. email, document sharing, etc.) or an application in one shot, it is advisable to move one component or tier at a time. The former is a case of vertical partitioning of the organization’s IT environment which may seem to be a logical approach towards cloud migration because of the perceived standalone nature of that particular platform or application. But, as we all know, today’s IT environment is not siloed. All the systems and data repositories are interlinked in some way or the other. Thus, moving a platform or an application to the cloud does come with the overhead of modifications to its interfaces to different systems, if not entirely rebuilding them.

The horizontal partitioning approach of moving one tier at a time does have its own share of modifications of interfaces as well. But, it has the advantage of being gradual while going along the path of increasing level of comfort of the senior management. Migrating smaller logical components of the application involves lesser number of risks than those for the entire platform. It involves lesser amount of testing after the migration, and makes it easy to roll out and roll back because of its smaller size as compared to the entire application. Building and maintaining redundancy (parallel environments) during any migration effort is highly critical. Since it is more economical to build a parallel environment for a smaller piece than the entire application, chances of service disruption due to lack of sufficient infrastructure are practically eliminated.

The question now becomes where to start. A good way to kick off this approach is to start with the migration of the outermost tier that has the least stringent security requirements. As seen above, this outermost tier comprises of services hosted in DMZ. They have restricted access to the internal network. And, they all interface with the external untrusted network at the other end. By moving these services to the cloud, we are essentially creating our DMZ in the cloud giving rise to a new architectural pattern that I call Demilitarized Cloud (DMC). We now have a hybrid computing environment that spans across both the on-premise network and the cloud.

Surrounding the migrated services with a security envelope such as a Virtual Private Cloud, maintaining the same level of limited access to the secure internal network, and interfacing with the untrusted network at the other end helps create a DMZ-like secure logical sub-network within the cloud. Integration with the on-premise systems gives us the same application environment that is now hybrid in nature and which retains trade secrets, proprietary data or any other highly sensitive assets in the same secure internal network.

With DMC as the starting point, cloud migration roadmap can evolve along the lines of multi-tiered web application architecture. Having moved the presentation tier to the cloud, we can then focus on moving application tier in the next iteration. By then, IT departments would have gained sufficient public cloud security knowledge to feel comfortable about migration of more components in there. We can move app servers, service buses, databases or any combination or subset of those assets based on technical and business priorities.

To summarize, DMC is a simple pattern to start with on the path to cloud adoption. It helps in identifying less security-sensitive services that could be good first candidates for cloud migration. Because of the horizontal partitioning approach, it paves the way for migrating other tiers of the application stack in the future. The pace of this migration can be easily controlled by the IT leadership depending upon their comfort-level. Unlike the vertical partitioning approach, this approach provides the flexibility even to roll-back the migration gradually and without major disruptions. It is a good first step to get you feet wet without the fear of drowning.

More Stories By Ravi Bhangley

Ravi is an accomplished IT leader with 20 years of work experience, and strong concentration and success in management, strategy and vision. Before launching BizEnablers, a consulting firm specializing in enterprise cloud strategy and implementation, Ravi was Chief Architect at Dun & Bradstreet, world’s leading source of commercial information and insights into businesses. For last 10 years of working for corporate IT, he held several senior leadership positions spearheading diverse programs and organizations. He currently sits on the IT Advisory Board of New Jersey Technology Council (NJTC), the foremost organization of technology companies in New Jersey. He is actively engaged in cloud computing thought leadership through publications and frequent participations as a speaker or a panelist. He holds a Masters in Computer Science from Michigan State University.

@CloudExpo Stories
A look across the tech landscape at the disruptive technologies that are increasing in prominence and speculate as to which will be most impactful for communications – namely, AI and Cloud Computing. In his session at 20th Cloud Expo, Curtis Peterson, VP of Operations at RingCentral, highlighted the current challenges of these transformative technologies and shared strategies for preparing your organization for these changes. This “view from the top” outlined the latest trends and developments i...
Automation is enabling enterprises to design, deploy, and manage more complex, hybrid cloud environments. Yet the people who manage these environments must be trained in and understanding these environments better than ever before. A new era of analytics and cognitive computing is adding intelligence, but also more complexity, to these cloud environments. How smart is your cloud? How smart should it be? In this power panel at 20th Cloud Expo, moderated by Conference Chair Roger Strukhoff, paneli...
Hardware virtualization and cloud computing allowed us to increase resource utilization and increase our flexibility to respond to business demand. Docker Containers are the next quantum leap - Are they?! Databases always represented an additional set of challenges unique to running workloads requiring a maximum of I/O, network, CPU resources combined with data locality.
SYS-CON Events announced today that MobiDev, a client-oriented software development company, will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. MobiDev is a software company that develops and delivers turn-key mobile apps, websites, web services, and complex software systems for startups and enterprises. Since 2009 it has grown from a small group of passionate engineers and business...
SYS-CON Events announced today that GrapeUp, the leading provider of rapid product development at the speed of business, will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Grape Up is a software company, specialized in cloud native application development and professional services related to Cloud Foundry PaaS. With five expert teams that operate in various sectors of the market acr...
SYS-CON Events announced today that Ayehu will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on October 31 - November 2, 2017 at the Santa Clara Convention Center in Santa Clara California. Ayehu provides IT Process Automation & Orchestration solutions for IT and Security professionals to identify and resolve critical incidents and enable rapid containment, eradication, and recovery from cyber security breaches. Ayehu provides customers greater control over IT infras...
SYS-CON Events announced today that Datanami has been named “Media Sponsor” of SYS-CON's 21st International Cloud Expo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Datanami is a communication channel dedicated to providing insight, analysis and up-to-the-minute information about emerging trends and solutions in Big Data. The publication sheds light on all cutting-edge technologies including networking, storage and applications, and the...
Artificial intelligence, machine learning, neural networks. We’re in the midst of a wave of excitement around AI such as hasn’t been seen for a few decades. But those previous periods of inflated expectations led to troughs of disappointment. Will this time be different? Most likely. Applications of AI such as predictive analytics are already decreasing costs and improving reliability of industrial machinery. Furthermore, the funding and research going into AI now comes from a wide range of com...
SYS-CON Events announced today that EnterpriseTech has been named “Media Sponsor” of SYS-CON's 21st International Cloud Expo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. EnterpriseTech is a professional resource for news and intelligence covering the migration of high-end technologies into the enterprise and business-IT industry, with a special focus on high-tech solutions in new product development, workload management, increased effi...
SYS-CON Events announced today that SourceForge has been named “Media Sponsor” of SYS-CON's 21st International Cloud Expo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. SourceForge is the largest, most trusted destination for Open Source Software development, collaboration, discovery and download on the web serving over 32 million viewers, 150 million downloads and over 460,000 active development projects each and every month.
In this presentation, Striim CTO and founder Steve Wilkes will discuss practical strategies for counteracting fraud and cyberattacks by leveraging real-time streaming analytics. In his session at @ThingsExpo, Steve Wilkes, Founder and Chief Technology Officer at Striim, will provide a detailed look into leveraging streaming data management to correlate events in real time, and identify potential breaches across IoT and non-IoT systems throughout the enterprise. Strategies for processing massive ...
"Our strategy is to focus on the hyperscale providers - AWS, Azure, and Google. Over the last year we saw that a lot of developers need to learn how to do their job in the cloud and we see this DevOps movement that we are catering to with our content," stated Alessandro Fasan, Head of Global Sales at Cloud Academy, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"We focus on composable infrastructure. Composable infrastructure has been named by companies like Gartner as the evolution of the IT infrastructure where everything is now driven by software," explained Bruno Andrade, CEO and Founder of HTBase, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
SYS-CON Events announced today that Conference Guru has been named “Media Sponsor” of SYS-CON's 21st International Cloud Expo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. A valuable conference experience generates new contacts, sales leads, potential strategic partners and potential investors; helps gather competitive intelligence and even provides inspiration for new products and services. Conference Guru works with conference organi...
SYS-CON Events announced today that Cloud Academy named "Bronze Sponsor" of 21st International Cloud Expo which will take place October 31 - November 2, 2017 at the Santa Clara Convention Center in Santa Clara, CA. Cloud Academy is the industry’s most innovative, vendor-neutral cloud technology training platform. Cloud Academy provides continuous learning solutions for individuals and enterprise teams for Amazon Web Services, Microsoft Azure, Google Cloud Platform, and the most popular cloud com...
What's the role of an IT self-service portal when you get to continuous delivery and Infrastructure as Code? This general session showed how to create the continuous delivery culture and eight accelerators for leading the change. Don Demcsak is a DevOps and Cloud Native Modernization Principal for Dell EMC based out of New Jersey. He is a former, long time, Microsoft Most Valuable Professional, specializing in building and architecting Application Delivery Pipelines for hybrid legacy, and cloud ...
With major technology companies and startups seriously embracing Cloud strategies, now is the perfect time to attend 21st Cloud Expo October 31 - November 2, 2017, at the Santa Clara Convention Center, CA, and June 12-14, 2018, at the Javits Center in New York City, NY, and learn what is going on, contribute to the discussions, and ensure that your enterprise is on the right path to Digital Transformation.
21st International Cloud Expo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Me...
"Tintri focuses on the Ops side of the DevOps, which basically is pushing more and more of the accessibility of the infrastructure to the developers and trying to get behind the scenes," explained Dhiraj Sehgal of Tintri in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
"We do one of the best file systems in the world. We learned how to deal with Big Data many years ago and we implemented this knowledge into our software," explained Jakub Ratajczak, Business Development Manager at MooseFS, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.