Welcome!

@CloudExpo Authors: Liz McMillan, Yeshim Deniz, Pat Romanski, Zakia Bouachraoui, Elizabeth White

Blog Feed Post

IT Infrastructure Security and Regulatory Compliance

By Steven Wolford, Director of Information Security, 6fusion

Closing a series of politically inspired posts on IT infrastructure security, I’d like to paraphrase Groucho Marx “Regulatory Compliance is the art of looking for trouble, finding it everywhere, diagnosing it incorrectly, and applying the wrong remedies.” This is especially true in highly regulated industries and IT environments involving security and the cloud.

Industries worldwide have been forced to understand and struggle to comply with rapidly evolving governmental regulations and industry standards meant to address transparency, privacy, and consumer protection. The list of acronyms seems to be growing even as each tries to evolve to meet current IT security concerns, threats and technologies. PCI, GLIBA, Sarbanes-Oxley, HIPAA, NIST, FISMA, and many more, each has it’s own take on what the trouble is, how it is diagnosed (often incorrectly), and how to remedy the problem.

It is unfortunate that the many oversight organizations feel that businesses must be forced to protect the data, confidentiality, integrity, and availability of its own and it’s customer’s information. It is even more unfortunate that businesses incorrectly equate regulatory compliance with IT security, particularly security in cloud. Weave IT in the cloud into the mix and this goes from bad to ugly. Many regulations and standards were slow to meet the disruption caused by cloud adoption leaving the business unsure if they could adopt cloud resources or if they did adopt cloud resources were they going to be identified as being non-compliant.

How then to give your business confidence in compliance and have a level of comfort in it’s IT infrastructure security? Frameworks to the rescue. Many of the major security frameworks have been updated to account for cloud technology and include crosswalks of the major security regulations. SAS 70 has morphed into SSAE 16, ISO has updated the venerable 27000 series, and ISACA has issued COBIT cloud guidance.

At least one new framework is designed specifically for cloud users, the Cloud Security Alliance Cloud Control Matrix (CSA CCM). The CSA CCM is gaining in popularity given its foundation in cloud resources and the strong relationship with many regulatory requirements. In order to avoid applying the wrong remedies the CCM offers a wonderful matrix to help select the right control based upon the particular standard or regulation as well as the specific service model (IaaS, PaaS, SaaS). The controls are grouped into 13 domains and include 98 unique controls.

Do yourself a favor, instead of looking for a reason to declare security in the cloud issues, let the art of CCM help you create an environment that meets your IT infrastructure security requirements and is compliant with the regulations and standards your business is obliged to meet.

 

The post IT Infrastructure Security and Regulatory Compliance appeared first on 6fusion.

Read the original blog entry...

More Stories By John Cowan

John Cowan is co-founder and CEO of 6fusion. John is credited as 6fusion's business model visionary, bridging concepts and services behind cloud computing to the IT Service channel. In 2008, he along with his 6fusion collaborators successfully launched the industry's first single unit of meausurement for x86 computing, known as the Workload Allocation Cube (WAC). John is a 12 year veteran of business and product development within the IT and Telecommunications sectors and a graduate of Queen's University at Kingston.

CloudEXPO Stories
With more than 30 Kubernetes solutions in the marketplace, it's tempting to think Kubernetes and the vendor ecosystem has solved the problem of operationalizing containers at scale or of automatically managing the elasticity of the underlying infrastructure that these solutions need to be truly scalable. Far from it. There are at least six major pain points that companies experience when they try to deploy and run Kubernetes in their complex environments. In this presentation, the speaker will detail these pain points and explain how cloud can address them.
Your job is mostly boring. Many of the IT operations tasks you perform on a day-to-day basis are repetitive and dull. Utilizing automation can improve your work life, automating away the drudgery and embracing the passion for technology that got you started in the first place. In this presentation, I'll talk about what automation is, and how to approach implementing it in the context of IT Operations. Ned will discuss keys to success in the long term and include practical real-world examples. Get started on automating your way to a brighter future!
Bill Schmarzo, author of "Big Data: Understanding How Data Powers Big Business" and "Big Data MBA: Driving Business Strategies with Data Science," is responsible for setting the strategy and defining the Big Data service offerings and capabilities for EMC Global Services Big Data Practice. As the CTO for the Big Data Practice, he is responsible for working with organizations to help them identify where and how to start their big data journeys. He's written several white papers, is an avid blogger and is a frequent speaker on the use of Big Data and data science to power the organization's key business initiatives. He is a University of San Francisco School of Management (SOM) Executive Fellow where he teaches the "Big Data MBA" course. Bill was ranked as #15 Big Data Influencer by Onalytica. Bill has over three decades of experience in data warehousing, BI and analytics. He authored E...
When talking IoT we often focus on the devices, the sensors, the hardware itself. The new smart appliances, the new smart or self-driving cars (which are amalgamations of many ‘things'). When we are looking at the world of IoT, we should take a step back, look at the big picture. What value are these devices providing. IoT is not about the devices, its about the data consumed and generated. The devices are tools, mechanisms, conduits. This paper discusses the considerations when dealing with the massive amount of information associated with these devices. Ed presented sought out sessions at CloudEXPO Silicon Valley 2017 and CloudEXPO New York 2017. He is a regular contributor to Cloud Computing Journal.
Wooed by the promise of faster innovation, lower TCO, and greater agility, businesses of every shape and size have embraced the cloud at every layer of the IT stack – from apps to file sharing to infrastructure. The typical organization currently uses more than a dozen sanctioned cloud apps and will shift more than half of all workloads to the cloud by 2018. Such cloud investments have delivered measurable benefits. But they’ve also resulted in some unintended side-effects: complexity and risk. End users now struggle to navigate multiple environments with varying degrees of performance. Companies are unclear on the security of their data and network access. And IT squads are overwhelmed trying to monitor and manage it all.