Proactively Working in the Cloud

Glad to see you again for this blog posting. Remember in the last posting I defined cloud computing and mentioned our industry is focusing almost entirely on the glitzy side of cloud computing such as storage on demand or security and skipping over the critical impact on our organization’s data. In this posting I’ll offer an important role the data professional can play to be proactively involved in the cloud, and in the next posting I’ll talk about some reactive roles.

This proactive role is to determine which data subjects belong in the cloud. The data modeler and data architect typically have a strong understanding of the metadata, such as definitions, source systems, data volatility, and data sensitivity. We are therefore in a great position to made recommendations on which data subjects belong in the cloud.

For example, should we store Prospects in the cloud? Well a number of Prospects may turn in to Customers and therefore if we store Prospects in the cloud maybe we should also store Customers in the cloud. However, some of the information about a customer is extremely private, or accessed very frequently, or ties strongly to other subjects that are not candidates for the cloud…you get the idea.

If this role sounds exciting to you (and it definitely does to me!), a good place to start is by reading The Cloud Security Alliance (CSA) Security Guidance for Critical Areas of Focus in Cloud Computing V2.1(see http://www.cloudsecurityalliance.org/csaguide.pdf ). Any document with a title this long has got to be good. And this is a great document. They recommend several steps to take to determine whether an application or data subject would be a good fit for the Cloud. Data Architects or Data Modelers would be in the best position to perform these steps:

• Come up with a master list of considerations for the Cloud. This can be an application, part of an application, or just data. Imagine how valuable our enterprise data model would be (along with a data element mapping) at this step. This is a great reason for having an enterprise data model!
• Evaluate the asset. How important is the data or function? That is, what are the confidentiality, integrity, and availability requirements for the asset? The CSA suggests answering these questions:
  • How would we be harmed if the asset became widely public and distributed?
  • How would we be harmed if an employee of our cloud provider accessed the asset?
  • How would we be harmed if the process or function were manipulated by an outsider?
  • How would we be harmed if the process or function failed to provide expected results?
  • How would we be harmed if the information/data were unexpectedly changed?
  • How would we be harmed if the asset were unavailable for a period of time?
• Map the asset to potential cloud deployment models. For the asset, determine if you are willing to accept the following options:
• Public. The cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services.
• Private. The cloud infrastructure is operated solely for a single organization. It may be managed by the organization or a third party, and may exist on-premises or off premises.
• Community. The cloud infrastructure is shared by several organizations and supports a specific community that has shared concerns (e.g., mission, security requirements, policy, or compliance considerations). It may be managed by the organizations or a third party and may exist on-premises or off-premises.
• Evaluate potential cloud service models and providers. Your focus will be on the degree of control you have to implement risk mitigations which includes factors such as data privacy, portability, and performance.
• Sketch the potential data flow. If you are evaluating a specific deployment option, map out the data flow between your organization, the cloud service, and any customers/other nodes.  We are great at building simple diagrams that communicate complex ideas, so we can probably build these diagrams in our sleep.

Give this role some thought…could be job security for many years to come! Until the next blog…