Cloud Transformation and Significance of Security

Transcription

1

2 Cloud Transformation and Significance of Security Mohit Sharma, Chief Architect & Cloud

3 Datacenter Management Change Management Policy Physical Network Management Vendor Contact details in case of emergency Policy for physical security of Data Center Inventory of assets Labelling Redundant cooling system Visitor record maintenance

4 Which facility is more secure? Expert third party auditors make the claim, not operators themselves

5 Why Cloud? Cost Scalability Agility Reduced Ops SLA (reliability) Security

6 Public Cloud Availability some of the major players

7 Magic Quadrant for Cloud Infrastructure as a Service, Worldwide Published: 03 August 2016 Source: Gartner

8 Global Coverage - AWS The AWS Cloud operates 35 Availability Zones within 13 geographic Regions around the world, with 9 more Availability Zones and 4 more Regions coming online throughout the next year. US East (N. Virginia) OPERATIONAL Asia Pacific (Singapore) US West (Oregon) US West (N. California) EU (Ireland) EU (Frankfurt) South America (São Paulo) Asia Pacific (Tokyo) Asia Pacific (Sydney) Asia Pacific (Seoul) Asia Pacific (Mumbai) China (Beijing) NEWLY ANNOUNCED Ohio Ningxia UK Montreal Source: AWS

9 Central US Global Coverage - Microsoft Azure West Europe OPERATIONAL North Europe South Central US Azure is generally available in 26 regions around the world, and has announced plans for 8 additional regions. East US East Asia Canada Central West US East US 2 Southeast Asia Canada East West US 2 US Gov. Iowa Japan East West India Australia East US Gov. Virginia Japan West China East Australia Southeast North Central US Brazil South China North Central India West Central US South India NEWLY ANNOUNCED US DoD East US DoD West United Kingdom South Germany Central Korea Central Germany Northeast Korea South United Kingdom West Source: Microsoft

10 Global Coverage - GCP Region Location Available zones Features Western US The Dalles, Oregon us-west1-a us-west1-b Broadwell processors 32-core machine types Local SSDs Central US Council Bluffs, Iowa us-central1-a Sandy Bridge processors Local SSDs Eastern US Berkeley County, South Carolina us-central1-b us-central1-c us-central1-f us-east1-b us-east1-c us-east1-d Haswell processors 32-core machine types Local SSDs Ivy Bridge processors 32-core machine types Local SSDs Haswell processors 32-core machine types Local SSDs Western Europe St. Ghislain, Belgium europe-west1-b Sandy Bridge processors Local SSDs europe-west1-c Ivy Bridge processors 32-core machine types Local SSDs Deploy Cloud Platform services by zone, within or across regions. GCP offer Compute Engine in five regions containing a total of 15 zones, for example. europe-west1-d Haswell processors 32-core machine types Local SSDs East Asia Changhua County, Taiwan asia-east1-a asia-east1-b asia-east1-c Ivy Bridge processors 32-core machine types Local SSDs Source: Google

11 Compliance and Audits - AWS Source: AWS

12 Compliance and Audits - Azure Source: Microsoft

13 Compliance and Audits - GCP Google has annual audits for the following standards: SSAE16 / ISAE 3402 Type II: SOC 2 SOC 3 public audit report ISO 27001, one of the most widely recognized, internationally accepted independent security standards. Google has earned ISO certification for the systems, applications, people, technology, processes and data centers serving Google Cloud Platform. ISO 27017, Cloud Security, This is an international standard of practice for information security controls based on ISO/IEC specifically for cloud services. ISO 27018, Cloud Privacy, Privacy, This is an international standard of practice for protection of personally identifiable information (PII) in public clouds services. FedRamp ATO for Google App Engine PCI DSS v3.1 HIPAA Google Cloud Platform will also support HIPAA covered customers by entering into a Business Associates Agreement. The Cloud Platform BAA currently covers Compute Engine, Cloud Storage, Cloud SQL, Genomics, and BigQuery. Google Cloud Platform and the EU Data Protection Directive As part of Google s rigorous privacy and compliance standards and commitment to our customers, Google Cloud Platform offers EU model contract clauses for customers subject to the EU Data Protection Directive. Source: Google

14 Compliance and Audits Private Data Center

15 Which facility is more secure? Expert third party auditors make the claim, not operators themselves

16 Cloud Transformation

17 What data types can be stored in the cloud?

18 What data types can be stored in the cloud?

19 What data types can be stored in the cloud?

20 Cloud Transformation has taken shape globally ENTERPRISES. STARTUPS. GOVERNMENTS. UNIVERSITIES.

21 Initial Cloud Adoption Use-case Storage Test/Dev Disaster Recovery Production Non-mission Critical Application

22 CLOUD MIGRATION METHODLOGY Cloud Assessment Phase Proof of Concept Phase Data Migration Phase Application Migration Phase Leverage the Cloud Phase Optimization Phase

23 Application Considerations Cloud-native applications E-business hosting General Business hosting Enterprise Application Development Environment Batch Processing Internet of Things (IOT) applications

24 Multi-cloud Adoption Source: RightScale State of Cloud report 2016

25 Hybrid Cloud Connectivity

26 Hybrid Cloud Connectivity

27 Security Its better to be proactive than reactive

28 Cloud Security a shared responsibility Source: HP

29 Where do data breaches really come from?

30 Infrastructure & Network Security Infrastructure Security IPS/IDS Antimalware DDoS Integrity monitoring Web Reputation Cloud Provider Peripheral Security IAM MFA Cloud Provider Physical Security Network Security WAF

31 Secure your Workloads

32 Secure your Entry Points

33 Cloud Native Journey

34 Continued Cloud Transformation Ease of access to multiple cloud Guarantee High Availability & Performance Security, Compliance & Cost Effective Deploy Quickly & Scale Easily

35 The Legacy Migration Journey Completes your Cloud service assurance model MIGRATE MANAGE SECURE OPTIMIZE Lift-and-shift migration approach Infrastructure support transition End-to-end security enablement Cost optimization and automation

36 Cloud Transformation Well Architected Framework DESIGN FOR RELIABILITY & PERFORMANCE Monitoring of service limits Network topology best practices Application scalability planning and benchmarking Automation deployment and patching DR and backup planning Application component fault tolerance and resiliency Resource design, selection and sizing based on performance benchmarking Resource monitoring and capacity planning DESIGN FOR DEVOPS Define and deploy CI/CD pipeline Define and automate environment provisioning framework Define and establish automated configuration management framework Define and establish application performance benchmarking framework DESIGN FOR COST ASSURANCE Define and establish account and tagging best practices Resource utilisation tracking and optimisation Dev tests automation RI Planning Cost control policy and alerts

37 Managing Your Cloud Success Completes your Cloud service assurance model STABILITY EFFICIENCY SECURITY CLOUD Services Audit & Automation Cloud Infrastructure + App Management Cloud Automation + Cost Optimization Hybrid Cloud Security + Security Compliance

38 Offering LET S START YOUR TRANSFORMATION TODAY!

39 Mohit Sharma CloudNayan