thanks Jeff for the intro and and
Brendan I think he's gone so that was a
great talk
and a great introduction to some of the
topics we'll talk about for the rest of
the the workshop my name is Doug Miller
I've been a consultant independent
consultant for the last 12 years really
focused in the areas of cloud computing
cross-platform interoperability identity
management and looking at it from both
the technology point of view as well as
how it impacts privacy and security
before that I worked at Microsoft for
five years and you know been in this
industry for gee over 30 years started
out as a UNIX programmer and I sort of
seeing all the different waves that have
happened in technology and server
computing platforms and now cloud
computing so what I'm going to be
talking about today is really you know
the cloud and both the good and the bad
and some of the challenges that we have
related to compliance Greg and others
will talk about some of the nitty-gritty
of compliance in the cloud but I wanted
to sort of start with a kind of a
reference point you know what is the
cloud opportunity I think we all
recognize that it's kind of inevitable
you know what is the cloud and it may
seem obvious but it's probably worth
having the discussion where is the cloud
which becomes important when you're
talking about compliance and whose laws
apply and and then some of the
particular challenges related to
compliance in the cloud so an
interesting number here 89% of
enterprises will be using cloud services
by the end of this year that's a that's
a pretty amazing number when you when
you think about cloud computing hasn't
been around that long and cloud is a
little different than a lot of
technology evolutions that we've had if
you look back at you know server
computing and clients are computing and
and the various models that have have
come about most of them have been very
technical
they've been things that you know
computer scientists and computer
engineers are focused on working with in
order to provide some sort of solution
for a business the big difference with
cloud is it's so simple and it provides
so many economic benefits as well as
complexity reducing complexity benefits
that just about anybody can jump on the
cloud now and in fact one thing that you
know is concerning probably a lot of
people in the room is you know who is
using the cloud inside my organization
who's using a cloud that I haven't
sanctioned you know how many people have
a Dropbox account but it's not offered
by their organizations to somewhere
where they store files sometimes these
are sensitive files so all of these kind
of raise questions about compliance how
do we kind of adopt the cloud get all
the benefits but also have some control
over it so some of the benefits of
course the idea of being able to scale
up scale down as you need compute
resources and pay for what you use as
opposed to investing on a whole lot of
computers and data centers and and the
ability to handoff the complexity to a
cloud vendor and when you think about it
most businesses are not IT businesses
you know they're hospitals or insurance
companies or banks or whatever you know
they don't want to spend their whole
time administering IT they just want to
get on with their business so the idea
of this model where you handoff the
complexity in the IT management to
people who do that for a living has huge
attraction for businesses of all size
whether you're a little small business
wanting to outsource your email or
whether you're a large corporation
wanting to do for instance business
analytics and a large amount of data so
all of these are big drivers but there
are concerns that are still there and
many of those concerns are over trust
who has access to my data how will it be
used what happens if if the the data is
breached
can the club provider provide better
security than I can and can the cloud
provider provide better compliance with
all the rules and regulations that I
need to comply with in order to do my
business
so we'll go through some of these
questions and answers throughout the
rest of the the sessions today and just
you know look at before we sort of leave
the opportunity look at what some of the
analysts are saying about the cloud you
know if you're resisting cloud because
of security concerns you're running out
of excuses and and so basically we're
now at the point where cloud vendors any
of the big cloud vendors can offer
better security than what many of us can
do regardless of the size of our
organization the question is no longer
how do I move to the cloud instead it's
now I'm in the cloud how do I make sure
I've optimized my investment and risk
exposure and so that's a big question
you know a lot of people talk about the
idea of transferring risk if you go to
the cloud you can transfer some of your
risk to the cloud provider if they're
taking responsibility for things like
compliance with regulations by 2020 we
will stop referring to the public cloud
and the private cloud will simply talk
about it as a way of doing business and
you know right now we sort of talk about
different models of cloud computing but
ultimately it's just going to be a
service that we sign up for and we won't
think about the particular underlying
technology that actually gets us there I
wanted to highlight this study just for
a sec it's a little hard to read the
text and I will blow up the kind of the
important point there but this is a
study that Microsoft just commissioned
before store and hasn't been published
yet so I had to get special permission
to be able to show you this one slide
but what it is is you know the drivers
why are people thinking about cloud and
you know you probably can't read the
reasons here and it's kind of good for a
way in a way because probably three
years ago the major driver for going to
the cloud was saving money reducing
complexity and so you'd expect that to
be the number one answer but in fact
what is the most important very
important or important reason for going
to the cloud is improved secure
and/or the ability to meet compliance
regulations so that's now bubbled up to
the top as the most important driver for
organizations moving to the cloud so you
know this is a slide you can show to
your management you know if they're
saying well is anybody really going to
the car do people really trust the cloud
this says a lot about how far the cloud
has come from a trust point of view from
where it started just a few years ago so
a very important statistic here
from over 400 organizations that were
pulled in this particular survey so you
know you get the question what is the
cloud you know most of you go yeah I
know what the cloud is you don't need to
talk about that don't waste my time well
I won't spend a whole lot of time on
these slides but I think it's worth
having the conversation just to make
sure we're all using the same language
when we think about the cloud and
hopefully you can take some of these
slides if you need them when you're
educating your own staff or if you're
making presentations to your management
if they say well what the heck is the
cloud maybe some of these slides can be
useful so I'm gonna start with the
standard NIST definition this was
definition this put a several years ago
and it's actually held up pretty well
and what you know I'll give you a chance
to read it but what I've done here is
underline some of the most important
aspects of cloud that really are not
just the the technical attributes but
they're also the key benefits of why
people go to the cloud the idea of
ubiquitous convenient on-demand network
access to whatever service that you're
signing up for whether it's a payroll
service whether it's charging a credit
card whether it's getting access to your
files or email it's something that you
can get whenever you need it and this
idea of a pool of configurable computing
resources that can expand and contract
as you need them so you only pay for
what you need regardless of whether it's
network bandwidth servers server compute
time storage and that sort of thing can
be rapidly provision this is a key
differentiator between other types of
on-premises computing the idea that okay
I need to spin up a virtual
to do a particular job you can do that
literally within minutes use that
virtual machine for whatever purpose you
need and then turn it off only pay for
the compute time you need and you can do
that with minimal effort so this is one
of the biggest attractions I think for
smaller businesses and less IT oriented
businesses is they don't have to be
computer scientists to be able to use
the cloud there are cloud models that
consists of five essential
characteristics and we'll go through
these three service models and for
deployment models this was back in the
old NIST definition most people would
say hey we've gone away beyond that
there are a lot more models but this is
a good place to start because literally
when you start thinking about as a
service models it you know there are new
ones appearing every single day so the
essential cloud characteristics and
again these are some of the biggest
benefits the idea of on-demand
self-service broad network access so you
can be anywhere in the world and be able
to get access assuming that you have
internet access to your services the
idea of resource pooling and be able to
share resources rapid elasticity the
idea of being able to rapidly expand
somebody like the IRS when it comes to
tax time they need a lot of compute
power well they can expand to whatever
size they need virtually infinite
compute power and then contract back
down when the tax season is done and
then the idea of a measured service the
idea that you can only you only have to
pay for what you use and rather than
having to invest in a lot of compute
resources you basically just pay for the
the compute time that you use that's
owned by the cloud service provider so
service models again the service models
is kind of almost becoming an infinite
list but the three big ones are software
is a service so when you think about
software as a service things like office
365 you know the ability to deliver
software as a service from the cloud and
it's not just email could be you know
your word
or excel session is delivered as a cloud
session Google Apps another big example
of software as a service and Salesforce
of course one of the early pioneers that
the idea of being able to deliver a very
robust enterprise application without
the need for any software being
installed on your on your computer we
also have things that are appearing you
know things like email as a service but
really is is part of the idea of
software as a service we have platform
as a service this is the idea of course
of using the cloud as essentially a
computer you can program that thing and
basically write applications that make
use of the resources that are in the
cloud and so we have Microsoft Azure of
course as well as Google App Engine and
in other models out there for being able
to program and write applications to the
cloud and then the other big one is
infrastructure as a service
you know folks like Amazon Microsoft
even Dropbox when you think about the
idea of infrastructure being even a
virtual hard drive these are folks that
are offering virtual computers that you
can ramp up quickly in the form of
virtual machines for example and be able
to do whatever computing you need there
and then we have other as a service
offering it's coming along things like
identity as a service so rather than
having to maintain your own
for instance Active Directory servers
on-premises you can actually do that as
a as a cloud service and we'll walk
through some examples of some of these
in a sec we have four main deployment
models we have public cloud private
cloud community cloud and hybrid cloud
public cloud initially started out as
something that people stayed away from
they thought gee you know like Gmail I I
don't really want to use the same of
this infrastructure Google uses for
Gmail for my business applications well
a lot has happened in the last couple of
years and people are beginning to really
trust the public cloud and that's where
you're gonna get the biggest economic
benefits as well as the biggest benefits
for reducing complexity but we also have
the option for private cloud the idea of
taking everything that's in
public cloud putting it in a box and
then being able to install that on your
own servers and storage systems and
whatever in your own data center a good
example of that is the the azure stack
and basically what Microsoft's done is
taken all of the software that they use
to run their public cloud and make that
available to organizations to be able to
install in their own datacenter and be
able to use that for for running
essentially their own private version of
the public cloud behind their own
firewall and again you know we'll look
at what the difference is between that
and just standard on-premises computing
but again always keep those
characteristics in mind in order to
really think about it as a cloud we have
community cloud that's where a cluster
of different folks who have similar
interests or certain security concerns
of privacy concerns and get together and
have their own community cloud the best
example here would be the government
cloud here in the US many of the cloud
vendors have data centers specifically
focused for government customers and
that's what they sign up to and so
they're using a cloud data center system
that's totally isolated from the public
cloud where other businesses or or even
individuals could be using the services
and then hybrid is essentially a mix of
of any of the previous three where you
may be doing public cloud for some stuff
private cloud for other and having them
talk together and work together and of
course we also have the possibility of
cloud working with our own premises
systems and I'll talk about that a
little bit the idea that you may want to
keep some of your systems on-premises
for whatever reason and they're not
traditional cloud services their
traditional on-premises may be
client-server computing and one of the
biggest reasons there is maybe you
already have all the systems it's
working it's all paid off great
you know response time when people are
using the service so you don't want to
rip that all out but you may want to use
services there for instance maybe
billing that's a cloud service and so
you can tie those together use the cloud
where it makes sense and be able to
still leverage your investments
on-premises so the other thing to look
at is what is not a cloud these are
different technologies here that it can
exist both on-premises and in the cloud
but aren't necessarily cloud computing
things like outsourced tightiy or remote
data centers this just could be you've
hired IBM to basically run your data
center for you well it's not necessarily
cloud computing it's just basically
on-premises but in a different place
virtual machines again if you're
manually setting up your own virtual
machines and doing the software images
and everything else
it's hard work that's not you don't get
the benefits of what you get from sort
of the auto provision capabilities from
most of the cloud vendors and on and on
so there's there's a variety of
different classes of types of apps and
services that you may be using today and
you think oh that's cloud I've got an
internet based email must be cloud well
not necessarily if you're the person
who's having to administer that system
so the the big differentiator again when
you're thinking about cloud are you know
on-demand self-service broad network
access resource pooling rapid elasticity
and measured service so those are the
key things that you should think about
when you're looking at these and
thinking okay if I got all these
characteristics in my internet based
email for example so I wanted to walk
through a couple of examples just make
sure everybody's sort of on the same
page with these here's an example of a
multi-tenant public cloud so you could
think of Google Apps or office 365 so in
this case we we might have three
different types of cloud services
software as a service platform as a
service and infrastructure as a service
and these are all hosted in the same
cloud infrastructure where multiple
customers say worker one from company a
and we have worker one from Company B
are both writing applications using the
platform services of the cloud but
they're completely isolated from each
other so they don't actually know that
there's an
their company using those same services
we could also have for instance multiple
folks using the same email system hosted
in the cloud but one might be in Europe
and why one might be in Asia but they're
using the same service that's
distributed throughout the cloud and
then possibly a third customer that's
over here running infrastructures of
service may be spinning up some virtual
machines for various tasks so that's
your typical multi-tenant public cloud
if you look at a typical private cloud
it looks an awful lot the same the big
difference here is that all of this is
built behind your corporate firewall
typically and all of the people that are
using this are your employees or people
who work in your organization so you're
not doing any sharing all of this is
happening within your own organization
but you still get the benefits of the
cloud you can spin up resources move
them around Auto provision virtual
machines that sort of thing and and use
the cloud just like you could in the
public cloud but do it behind your own
firewall so the other big question you
guys well how does cloud really differ
from on-premises computing so this is
just a very simple example of
on-premises we've got our corporate
headquarters here we have data center
inside the organization where we might
have some file sharing systems we might
have some email systems and then we have
users inside the main office on
terminals and laptops and whatever
accessing these systems but we also
offer the ability for our remote offices
mobile users and home users to be able
to VPN or directly connect to our
services on-premises so this typically
involves a capex funding so this means
you are buying lots of servers and
software you're installing it in a data
center maybe you're renting the space at
the day's center but this is a fairly
large outlay of capital the compute
resources you usually manage by you or
they're managed by somebody that you've
hired but you're responsible
all of the management of those systems
and you retain full control over all the
apps in the data so that's kind of you
know we're we're we historically had
been for the last couple of decades if
we look at cloud computing what we have
here is that the cloud service provider
has basically provided the cloud servers
and infrastructure that you need to
carry on your business and expose the
compute power and storage power
networking power through the the various
cloud service models and then all of
your offices including your headquarters
your mobile users home our users
whatever connect to these services over
the internet using a trusted connection
of some type and again in this case
we're using more of an OP X model where
you're renting the service you're paying
per month and it's not just a flat fee
per month but paying for the cycles that
you're actually consuming and so for a
lot of organizations this is hugely
attractive because it's much easier to
manage budgets this way rather than
trying to amortize the purchase of
computers and that sort of thing over
many years and also in this case these
servers here are managed by the cloud
service provider you don't even care how
many servers are there or what type of
storage they use because it's all
exposed to you simply as a service and
then the control and access to the data
even though it's being run by this
organization over here
all of the big vendors are super focused
on making sure that there's no
compromise on privacy or security and so
if anything this model will be more
private more secure than typically what
you can you can do on your own and if
you look at a lot of the big breaches
that have happened many of them have
happened from companies that had this
model the old on-premises compute model
not so much in the cloud compute model
where people who have been dealing with
the great big vendors they typically are
much more secure or private than they
were
when they were doing it themselves going
to sort of a level deeper and looking at
email as an example looking at
on-premises versus cloud so you know
historically if you had something like
an exchange server and email server it
might be a linux server whatever
on-premises you would install that
software on a server here and your users
would maybe authenticate with some sort
of identity management system in this
case we're talking about exchange so the
active directory that authenticate and
then access the services directly on the
server that's managed inside the the
corporate data center that's owned by
the the organization and then the email
gets fired off to the the Internet this
way and and this connection to the
Internet is managed by the organization
as well so in the cloud based Exchange
Online model it might look more complex
but it's actually more straightforward
in that all of this part here is all
managed by Microsoft including the
connection to the Internet secure
connection with the Internet managing
the exchange servers and then as well
handling the authentication of users and
so users simply connect to the service
they may authenticate locally or they
may authenticate through a cloud-based
authentication system which is
synchronized but basically they just
connect to the service do their email
and then that gets fired out to the
internet that way so the the overhead of
managing these two models very very
little overhead here a lot of overhead
here of trying to manage your own
exchange servers so just a fairly
simplistic example one to spend just a
couple of minutes and talk about where
is the cloud you know we get this
question a lot and so if you think about
where the what cloud data centers used
to look like they look just like regular
old data centers they were data and
racks of computers and storage lots of
network
Abel's here and they seem to go on you
know forever and if you wanted to add
more compute power he brought in some
more servers you put them in the rack
brought in some more storage put it in
the rack did all the cabling and it was
a lot of overhead for the cloud
providers and to be honest a lot of them
didn't make a lot of money doing this
but now we've actually moved to a new
model for a lot of the modern providers
there's a picture of one of Microsoft's
data centers and what we have here is
these modules right here is an example
of one that basically can be dropped
anywhere in the world as a single
compute unit for cloud computing and you
literally plug it into the power you
take a garden hose and plug it into the
water to get water cooling and then plug
it in to the network and they they can
be configured automatically to basically
join the cloud and offer their services
up so a lot less overhead for the people
who are managing these data centers and
then also a lot more flexibility if
you're operating in a data center you
have a way too much capacity and
nobody's ever going to use it you can
pick one of these up put it on a freight
train and move it to the other data
center where maybe you did need it so a
lot of innovation going on behind the
scenes I tried to get a tour of the mic
one of the Microsoft cloud data centers
but they wouldn't let me in but but you
can go online and just type in a search
for Microsoft virtual data center tour
and they have a very cool
interactive data center tour that you
can go through and see you know kind of
some of these new innovations that are
going on so this is a picture of of
Microsoft's global data centers Amazon
would have a very similar picture Google
others but as you can see you know we've
come a long way in the last couple of
years from just a couple of data centers
to data centers all over the world and
more coming online all the time the
green ones are new ones that are coming
on in Canada some new ones in Europe and
and it's not just adding new data
centers as Brendan mentioned
is kind of a new model that's being
tested out the idea of using trustees to
manage the data center so that Microsoft
can take themselves out of that the
chain I feel like if there's a warrant
that comes down says you know we want
the data in that data centers is not our
data center well we own it but we don't
run it and we don't have a way to get
access to that data you need to contact
the local law enforcement authorities
and have them submit a subpoena to the
people who operate it in a lawful way in
that country so a very creative way to
sort of help protect customer data even
more than they have been doing in the
past so you know a lot of expansion
going on to really meet customer demand
so I wanted to spend a few minutes and
talk about compliance in the cloud I am
NOT the compliance expert Greg is over
there and he'll be talking in in gory
detail on some of the compliance
challenges but I wanted to give you a
little overview and really just kind of
emphasize this whole idea that trying to
manage compliance especially if you're a
multinational organization is really
really hard to do on your own you know
it's not just that there are a whole lot
of standards out there but they're
constantly changing and and you guys
know better than just about anybody in
the world you know what happened in
Europe you know with safe harbor going
away and then you know I guess we use
model clauses now and then you know now
we have privacy shield well if you're an
individual organization trying to
navigate through all of those challenges
it can be hugely complicated and
time-consuming and consume a lot of your
resources so you really want to make
sure that you know when you're going to
the cloud go with somebody who can help
offload a lot of that complexity and do
that work for you and you know we
actually you know we use the term the
idea of a compliance decision maker you
know we've got your business decision
maker and technical decision maker but a
compliance business decision maker who's
in the the chain of approval for new
technology and they go I just I'm
overwhelmed I can't believe that you
know this cloud provider is going to
look after our ability to meet this
halation to do our business and you know
china or whether it's going to be in new
zealand or wherever and so you know
they'll say look you know we got a
slowdown we can't jump to the cloud we
already kind of haven't sort of sort of
figured out but and so we we see a lot
of people who are trying to nix the idea
of going to the cloud in fact one
example if I can just use this for a
second
there was a law firm here in the States
and they were looking to go to the cloud
and their own legal counsel said now you
can't do that because if you put you
know client data up in the cloud you're
gonna violate attorney-client privilege
and you know they passed that
information back and this was you know a
Microsoft salesperson who was trying to
sell Microsoft cloud services and you
know they came back and said hey can you
guys help us at all well so we actually
did some research on this we got some
really smart people people like dan
Soloff to go and dive down into the
issue and and really find out the answer
it will you lose attorney-client
privilege if you store you know
sensitive client data up in the cloud
and and the in fact there's been lots of
rulings on this already and the American
Bar Association has said no if you if
you follow you know very strict rules
about how you treat the data and who has
access to it you can use the cloud for
storing client data without violating
the attorney-client privilege so that's
kind of an example of you know trying to
grapple with some of these challenges
and overcome some of the misperceptions
that are out there related to cloud
computing so we sort of think of
compliance with standards and the cloud
and three big buckets and and again I'm
not a compliance expert but it certainly
makes it easier for me to understand but
the idea of broad cross industry
international standards that are out
there that everybody should care about
and that every cloud provider frankly
should be providing support for and a
lot of these aren't just sort of
checklist items if you if you focus in
on one here the 2700 18 ISO
you know this was really brought about
by people really concerned about what is
going on with my data when I hand it
over to a cloud provider I want to have
an assurance that that data's not being
used for advertising or marketing or
shared with other customers or whatever
I want not just an assurance I want a
standard that I can see okay that
provider complies with the standard
therefore I know there's kind of a code
of practice in place that will protect
my data when it gets used by the
provider of the services but not used by
anybody else and essentially it's it's
protecting the data only for the use
that you intended it for so there's a
lot of different standards out there
there really are international standards
impact everybody and then we kind of
have two other groups we have you know
vertical standards and regulations that
impact different industries healthcare
manufacturing education financial
services government law enforcement
we'll hear a little more about some of
the challenges with law enforcement a
little later on from Jenner
each of these industries have their own
specific standards and we have to be
able to comply with these in order to
play in the industry if you want to
offer education services you've got to
comply with FERPA
and that sort of thing so you know we've
got all of these to worry about again a
big task if you're trying to do this on
your own
and then we have regional standards and
so if you're a multinational company or
organization you not only have to worry
about you know complying with
regulations here in the US but you know
of course Europe has lots of issues but
so the lots of other countries and more
and more countries are jumping onboard
with establishing their own standards
and regulations and you got to keep pace
with all of those as they come on stream
if you want to do business in those
countries and in some cases we have a
mix of both the you know the vertical
and the international for instance in in
the UK you have Gulf Cloud which is sort
of a set of requirements for dealing
with you know offering cloud services to
the UK government so you know it's a
fairly complicated
set of standards that may it may or may
not apply to your business and again
going with a cloud provider who's kind
of figured this all out
is hugely important if you really want
to take advantage of the cloud so you
know basically what a compliant cloud
offers you know I I was talking to some
folks who talked to people like
yourselves a lot and the one thing that
kept bubbling up was the idea of risk
you know how can I manage risk how can I
transfer risk and so if you can feel
comfortable transferring some of your
compliance risk to a cloud provider that
will help you you know sleep at night we
also of course have to make sure that
respecting rules that are imposed on us
to it participate in certain types of
industries even something as simple as
taking a credit card
obviously PCI rules coming in into play
and you need to keep that information
confidential in a way that complies with
the the regulations so the whole idea
here is to sort of lower your risk
profile and offload a lot of that
compliance work over to a cloud service
provider I wanted to just take a second
you know what a compliant cloud looks
like in real time so this is just a I
have an office 365 and Azure account
myself from my own little business and
one of the new things that that have
been added for an office 365 customer is
the ability to go into a security and
compliance portal that you manage and so
this is very cool you can go through all
the various attributes here we have
alerts permission security policies data
management certs an investigation so
this one for example permissions and and
this is one thing to really keep in mind
is is that compliance in the cloud is a
shared responsibility
you know Microsoft provides this tool
Anna's on will have their tools Google
will have their tools but it's up to you
to actually use these tools and use them
appropriately so for example you know
for compliance administrator I can set
up a roll
based identity for your compliance
administrators and joining people to
that role based on their need to be able
to be involved in the compliance of your
organization and some of the things that
these you know that person would have
control over or the group of people
would be you know the ability to you
know manage that manage the other
members within it do data loss
prevention reports that sort of thing
retention policies and all that sort of
stuff so in this case we have a bunch of
different roles a little hard to read
I'm kind of squinting but that you can
assign to help manage the compliance of
your organization another page that
comes up here for example is if I want
to you know let's say my boss came in
and says can you actually prove that
we're PCI compliant can you give me
something that'll actually I can take
and show to the board to show them that
we're doing this the right way so we
have a resource area as part of your
customer service here that's based on
your business you actually answer a
couple of questions about the type of
business that you're in
and then it offers the whole list of the
various reports that you can go and grab
and print out and hand to your
management to show them yes we do comply
so that's kind of what the new world of
compliance looks like in the cloud
a lot of this works already been done
for you you don't have to go out and
start scrambling and worrying about a
lot of these standards and doing it
yourself
so just a couple of things I wanted to
you know talk about at the end here is
is the idea that you know regardless of
the type of architecture that you want
to use you should be able to have choice
with your cloud vendor be able to do
private cloud public cloud or maybe a
mix of both it was kind of interesting
with private cloud there was a an
article that was published a couple of
months ago in infoworld
David
I believe is how you pronounce his name
I think the title of it was something
like you know Microsoft Azure for
private cloud is dead on arrival or
something and a lot of the points he
made didn't really make a lot of sense
but what was really fascinating and
there's all these people like yourselves
piling on with comments saying no we
actually like this idea we like the
option to be able to build our own
private cloud if we really feel like we
absolutely have to we won't necessarily
use it but the idea that that's there is
really super comforting to know that we
could build our own private cloud in our
own existing data center if we felt like
we really had to for a particularly
sensitive type of workload so you know
if you have super super sensitive data
or applications the option to build your
own private cloud and still have the
cloud benefits is always there a lot of
people go with public cloud because
that's where you get the maximum
economic benefit and the least amount of
complexity and you know people
originally were kind of you know I'm not
sure about public clouds you know who's
gonna get access to that data will be
used for something else well people are
feeling more and more comfortable as the
survey results showed about the idea of
using public cloud and if you look at a
lot of the reports that are coming out
now public cloud is really just
exploding in use much more so than just
about any other type of cloud
architecture but you also have the
option here that you could do a hybrid
cloud a bit of mix of both where you
have maybe some services in a workload
running in private and some working in
public and maybe even some working on
on-premises and and so you know one
thing to really look for is is the idea
of you know whichever one you choose you
should have a consistent platform across
all of these different architectures and
the same type of tools and the same type
of management concepts and be able to do
it in a way that's you know much much
simpler than it would have been if you
were setting up your own data centers
for these types of workloads so that's
what I had to say I'm happy to take any
questions or
and we have lots of other experts here
who can answer questions that I probably
can't answer but yeah okay my name is
Rudi Gudde I'm with Intel security I
didn't question about vendor
responsibility for meeting compliance
standards he said that the customer has
to use the tools properly but how much
responsibility will the vendors take on
for keeping their tools compliant for
example if they built something that was
a up/down and regulation changed it had
to be opted in in a certain region and
they failed to do that would they take
on responsibilities were they gonna
disclaim that kind of thing
how's that that's a standard now why I
can't answer on behalf of any of the
vendors but I think one of the things
that they do is worry about that you
know day in and day out if you look at
Microsoft for example there's a thousand
lawyers and policy makers in there that
are looking at this coupled with
engineers who are trying to figure out
how to implement a particular type of
new policy a good example is what
happened with in Europe you know from my
understanding you know the folks inside
Microsoft could see that you know the
safe harbor system was in trouble and it
was only a matter of days and literally
a couple of years before it fell apart
has started working through the idea of
PU model clauses and literally went to
every single jurisdiction and got those
in place so that if safe-harbor went
away you know there would still be a
model for being able to have their
customers carry on business in fact safe
harbor went away and you know
fortunately there was that safety net
there that allowed customers to carry on
with their business then you know
obviously Microsoft Amazon Google IBM
all of the major vendors were very
interested to see what was going to
happen with privacy shield we're deeply
involved and of course you know people
like Microsoft were first in line to
sign
for privacy shield in order to be able
to track those changes and make sure
that they're in place for customers so
that's one example but you know I think
if you don't have that level of trust
you're not going to have the customers
and so if you start ignoring standards
and ignoring compliance customers will
go elsewhere there's a lot of
competition in the space right now and a
lot of good companies thank you for that
definition of private cloud because I
never understood it until you explained
that it was basically the infrastructure
of the cloud copied into a private
server set earth or something where
there's more of a boundary I suppose my
question is other than the private cloud
with it I'm looking and I'm looking this
from from a federal government
perspective and also someone has it has
a security background IT security
background one of the most important
parts of getting a certified operation
operation to operate is that you have to
have a boundary of the system and you
say this is this is ours this is theirs
this is what I'm responsible for this
and I just don't see how you can do that
in the cloud when server could be
anywhere in the world
so in in that particular example you
know one way to do it you know certainly
what what Microsoft had done in Amazon
have also done is build a community
cloud that is built specifically for
those requirements of that customer set
a good example is is one that we were
quite involved in and CJIs the criminal
justice information system standards and
gener going to talk about that but the
the idea of you know law enforcement
organizations have very strict rules and
how you know data can be accessed who
can have access to the de down to the
point of whoever's administering the
data center has to be checked as well
and so you know private data centers for
communities of law enforcement customers
and that sort of thing it's sort of one
way to go about it so that you can
certify those people and the cysts
in the physical security the software
tools and whatever so that you can
actually meet those standards and I know
like the DISA requirements and other
requirements that are coming down
Microsoft and Amazon are both been super
active and you know trying to anticipate
the standard and getting ahead of the
game to get their systems at the maximum
levels that are reasonable you know at
some point you may hit you may hit a
wall but organizations are you know
constantly trying to push the boundaries
of what's possible with cloud indirect
and such as the the narrow question you
just have to do it I mean in some level
we have to work agency by agency to get
FedRAMP certified with an own scope we
have to layer 853 compliance or FedRAMP
list compliance on with that agency now
the nice thing about FedRAMP when it
works is a lot of that evidence creation
the next agency has a slightly easier
time but we can get some general jag
approval and things general oversight
bidding yes you have to define what is
the compliance though what are the set
of controls that we're managing get the
control evidence up layer it on to the
agency and take it forward so in that
specific case there's no way around it I
just want to take one second if I could
and just show you one of the the outputs
of some of the work we've been doing
which is providing some very focused
resources for exactly this audience here
we call it the legal and compliance
community and you know one of the
challenges we've heard from folks is you
know it's just so much information I
find it hard to find what I need I need
to find out which standards apply to me
in a particular industry and that sort
of thing so we've built this new part of
the Microsoft trust center for the legal
and compliance community just to let you
know and if you just do a search for
Microsoft trust center it'll take you to
this place
but here we have an open letter from
Brad Smith which you know he reaffirms
the commitment to this community of
helping resolve the issues that you have
in challenges with with compliance and
in fact I think you have printed copies
of that letter in there we also have
resources and certifications so you know
for instance if you want to see what
certifications are available for and I
think we still have a live connection
here
No maybe done so I'd invite you when you
have an internet connection go visit
this and you know we have news and
events so we actually track news as it
happens during you know in the day
publish that out to the site so if you
want to see what's happening and you can
do it filtered by different attributes
for instance regional news if you're in
Europe and you want to see what's going
on in Europe or if you're in a
particular industry you want to see
what's happening in Europe and financial
services yeah it looks like we don't
have an internet connection so so anyway
go check that out
you can also get to it by going to
Microsoft cloud assurance com