Cloud, Security and Technology

2020 is coming upon us, and it's time to reflect on my 2019 predictions I made, and look forward to this coming year with another technology prediction. So let's get started - first off - a lookback to see  progress in the areas I outlined, possibly no earth shattering results, but progress.  2019 retrospective - New UX - probably not as much evolution as I would have wanted to see in this area. For now, we use windows, android, IOS, and it's pretty much the same UX as it's been for a while. IoT the simple assistant - IoT continues to be the hot area of growth. I consider this more evolution than revolution. As we see IoT based technology being embedded into more and more devices. Cloud growth advances in   astonishing speeds - This past year all three cloud providers made strides in the cloud worth noticing.  AWS entered the quantum computing market with Bracket, introduced an in-house...

Last month I finished a project with the Azure team that involved building a secure PaaS based solution that provides a step by step guidance and automation to allow researcher to be able to use Machine Learning to run scientific experiment securely. Key thing here is that it's built to be /Secure/ Problem Most times when a traditional experiments are run, an experimenter or researcher starts with a data set they got their hands on, and uses tools such as Jupyter notebook to create an R or Python based experiment. Frequently this experiment is using a simple data science VM or a workstation. The scientist will then run the experiment (which maybe computationally intense) and turn to a cloud solutions to score the experiment in Google or Azure, and finally run Tableau or PowerBI or Excel for visualization. Since researchers are not security experts and do not think that what they are working on should consider their work as possibly sensitive they may expose their work...

I've been asked several times as to what are the building blocks to build a secure cloud solution. In my last 2017 blog I revisit the paper I wrote a while back called " 13 Effective Security Controls for ISO 27001 Compliance " and reconsider the 13 security measure that help meet compliance controls. One important update for this blog over the paper, is that I will not look at IaaS services a whole lot. Protecting a OS or VM has been done to death.   IMHO organizations need to get out of the business of managing the health of OS's/VM's and WebServices.  Moving to Containers with an orchestration engines such as Kubernetes , or Platform such as provided by Azure, or AWS is one of the best long term security investments. No more AV, Patching, or Host services maintenance…  The process is to get most companies away from the IT business, and into their core competency with a High tech offering that provide a capability on demand. Moving...

As I spend more time developing work that helps drive cloud adoption I like to be reminded that moving to the cloud is hard!. And understanding Microsoft, or AWS's terminology and responsibilities can be complex in ways that are frequently overlook.  I've addressed shared responsibility when moving to the cloud in my paper shared responsibility in cloud computing , as it's essential to understand the cloud role you take on before you adopt cloud computing. The role of security changes each time you move up the stack from IaaS, to SaaS. And overall your attack surface area may get smaller but your security posture cannot change... you must stay on top of your security effort. In IaaS the role to secure your environment is a bit tougher, as you have to protect data, users, applications, and hosts. That means you own your VM, you have to patch it, run AV/AM, configure it correctly, and monitor the VM -- that's a lot of operational items that are easy to miss, or ...

A while back I worked with a great Architect general guru of secure code. Adam Shostack who is a foremost expert when it comes to threat modeling . He does a great job in help educate us all in how you should plan a secure solution before you build it. A threat model should be seen as a key design element before code is started, similar to a floor plan in a house design. In this blog I wanted to illustrate the value and methods required to build a threat model, and tie it back to work I recently published, Payment Processing Blueprint for PCI DSS-compliant environments which included sample threat model for a cloud based PaaS solution. Wow, that’s great a free starter threat model to an architecture, what else can you ask for? What does it take to create your very own threat model? Think like an attacker, it’s important to see the problem from the attackers point of view when designing, or architecting a solution. For instance that includes thin...

This past bit I've been working on a new set of solutions that expands on work I've done in the past helping people adopt Azure cloud securely. The process has involved an evolution that moved from guidance to automation. I've also written about shared responsibility and what it takes a provider like Microsoft to create a compliance program. But what does it take our customers to use our services and be compliant? The PCI Blueprint is the first of its kind solution, that makes it possible to quickly understand what it takes to build a compliant workload on Microsoft Azure without having to learn the ropes of PCI DSS compliance! I put together a short video that illustrates how easy it is to deploy the solution, and a PCI DSS workbook providing the mapping to controls for the solution (which you can download from the documentation site) What's also really cool is that the solution has a full fledged threat model diagram provided. If you've ever contemplat...

It's been a while since I posted a blog. And to my readers I apologize. However in the past six months I've been madly working to publish 8 white papers on security and compliance for Microsoft Azure... It's a bit crazy to think anyone can get more than a paper published a month, especially when it requires as many reviewers as I've had to place my writing through. Normally, I place my ideas on the screen and bam... it's published!.. At my 'day' job it takes a bit more rigor to get a paper published. Including colleagues that are area experts providing feedback plus getting lawyers to validate that everything stated is in line with good corporate guidance. That normally means two months of reviews for everything I create. This is the first time I've tried to execute the writing, editing, reviewing and publication of 8 consecutive streams of content. It's true that the work is supper similar, and that's because it relates to compliance... And...

After completing my blog on how you would move to the cloud I started thinking about some compelling reasons to adopt cloud computing. Here are 8 immediate cost benefits moving to the cloud for a start-ups or small or mid-sized company.  1. Established ISMS Information Security Management System:   Many companies talk about setting up an ISO27002 based ISMS but struggle. That’s because it take lots of people resources, and money. The major cloud providers have this already built out, and tested.  2. Gates, fortified walls, guards, fences Facility Security:   Cloud providers help restrict access by role, and by granting access to small sets of trusted staff members. Most cloud providers have well established facility security including gates, fences, guards, lighting, and many other security measures. 3. Tested backup and recovery solutions Data Retention Policy:   Cloud providers should have a plan for data retention and storage that...