blog

0
606
Thursday, August 8, 2018

Cloud Migration Part 2: Classify your data

Cloud Migration Part 2: Classify your data

In my first post of this series, “Cloud migration part one: An overview,” I provided a high-level summary of how enterprises should migrate applications to the cloud. In this installment, the focus is on enterprise data and why your organization may need to review and reclassify its data before moving anything to the cloud.

Security evolves with cloud

Cloud computing has done more than change the way enterprises consume information technology. It’s also changing how organizations need to protect their data. Some may see this as an unintended consequence, but the headlong rush to save money by migrating applications to the cloud has uncovered long-hidden application security issues. This revelation is mostly due to the widespread adoption of “lift and shift” as a cloud migration strategy. Using this option typically precludes any modifications of the migrating application. It can also result in the elimination of essential data security controls and lead to grave data breaches.

Manage deployment

Today, the cloud has quickly become the preferred deployment environment for enterprise applications. This shift to using other people’s infrastructure has brought with it tremendous variability in the nature and quality of infrastructure-based data security controls. It is also forcing companies to shift away from infrastructure-centric security to data-centric information security models. Expanding international electronic commerce, ever tightening national data sovereignty laws and regional data protection and privacy regulations such as GDPR. These issues have combined to make many data classification schema untenable. Cloud Security Alliance and the International Information Systems Security Certification Consortium (ISC2) both suggest that corporate data may need to be classified across at least eight categories, namely:

  • Data type
  • Jurisdiction and other legal constraints
  • Context
  • Ownership
  • Contractual or business constraints
  • Trust levels and source of origin
  • Value, sensitivity and criticality
  • The obligation for retention and preservation

Classify data

Moving to classify data at this level means that one of the most important initial steps of any cloud computing migration must be a review and possible reclassification of all organizational data. By bypassing this step, newly migrated applications simply become data breaches in wait. At a minimum, an enterprise should:

  • Document all key business processes destined for cloud migration.
  • Identify all data types associated with each migrating business process.
  • Explicitly assign the role of process data owner.
  • Assign each process data owner the task of setting and documenting the minimum required security controls for each data type.

Update policies

After completing these steps, companies should review and update their IT governance process to reflect any required expansion of their corporate data classification model. These steps are also aligned with the ISO 27034-1 framework for implementing cloud application security. This standard explicitly takes a process approach to specifying, designing, developing, testing, implementing and maintaining security functions and controls in application systems. It defines application security not as the state of security of an application system but as a process to apply controls and measurements to applications in order to manage the risk of using them.

In part three of this series, I’ll discuss application screening and related industry best practices to help you determine:

  • The most appropriate target application deployment environment
  • Each application’s business value, key performance indicators and target return-on-investment
  • Each application’s migration readiness
  • The appropriate application migration strategy

LEAVE A COMMENT

Name*
E-mail*
Phone number*
Your Message

Latest posts

0
212

MWC19: Where Telecommunications and Cloud Meet

As a cloud solution architect, my passion is learning the details about how cloud computing uniquely supports specifi...

0
170

Tulane University SoPA Selects “Architechting Cloud Computing Solutions”

Last week, Packt Publishing announced that “Architecting Cloud Computing Solutions” by Kevin L. Jackson a...

0
380

5G Wireless Technology Connecting Healthcare

Healthcare is in the middle of massive change. Called digital transformation by many, this term describes the industr...

0
350

Maria Lensing: The Network Platform for Healthcare’s Future

As a girl, Maria and her family traveled to Memphis, Tennessee to get cancer treatment for her sick brother. The mira...

0
1401

How “Big Iron” Does “Big Regulation”

According to Verizon, there were over there were over 53,000 security incidents in 2017, with over 2,200 of those ide...

0
1810

Mainframe Synergies for Digital Transformation

In July  of 2018, Broadcom announced its intentions to acquire CA Technologies. In the press release, Hock Tan, Presi...

0
456

2018 AT&T Business Summit: Security “in” and “of” the Cloud

While public cloud is undoubtedly an outsized piece of the conversation, news headlines of the latest data breach can...

0
198

My Brush with Royalty: Queen Latifah

Queen Latifah! Hip Hop Icon. Movie Star. Television Star. Fashion Model. Songwriter. Producer. Entrepreneurial Genius...

0
350

What’s New in Puppet 5?

Puppet 5 is released and comes with several exciting enhancements and features that promise to make configuration man...

0
227

5 Reasons Why Ansible is the Best CM Tool Out There?

Amidst volatile markets, dynamic technology shifts, and ever-increasing customer demands, it is imperative for IT org...