Finding a Framework for Hybrid Cloud Risk Management - GovCloud Network

blog

0
206
Sunday, March 3, 2016

Finding a Framework for Hybrid Cloud Risk Management

Finding a Framework for Hybrid Cloud Risk Management

 (Sponsored by IBM. Originally published on Point B and Beyond)

Hybrid cloud is rapidly becoming essential to today’s information technology processes. This is why hybrid cloud risk management has become the keystone to many modern corporate strategies. To effectively manage this shift, leading enterprises are reorganizing how the business side of IT is accomplished. When this reality is coupled with the rising cost of poor cybersecurity, decisions often rise to the board level.

Threats that challenge cloud-based information systems can have adverse effects on organizational operations, organizational assets, employees and partners. Malicious entities can exploit both known and unknown vulnerabilities, compromising the confidentiality, integrity or availability of the corporate information being processed, stored or transmitted by those systems. In this environment, risk management must be viewed as a holistic activity that is fully integrated into every aspect of the business.

Establishing Standards for Hybrid Cloud Risk Management

The National Institute of Standards and Technology (NIST) offers a very good model for hybrid cloud risk management that groups activities into three categories based on the level at which they address the risk-related concerns. It divides activities and concerns into:

  • The organization level (tier 1);
  • The mission and business process level (tier 2); and
  • The information system level (tier 3).

Addressing these activities in reverse order, the NIST Risk Management Framework (RMF) provides a disciplined and structured process for integrating tier 3 enterprise information security with risk management activities. Since mission or business processes govern tier 2, those details generally lie outside the scope of general treatment. Tier 1 organizational level aspects are, however, at the heart of the organizational restructuring needed to deal with risk management within today’s hybrid IT environments.

One effective approach for addressing the tier 1 aspects of a cloud ecosystem is through the use of a hybrid IT operating model construct. This distributes tactical and operational risk management activities across a front, middle and back office. Generally referred to as a cloud service brokerage, organizational risk management activities are managed through:

  • A front office that accommodates IT service choice, automated provisioning and quick service delivery;
  • A middle office that holds responsibility for decisions that involve business operations and new IT service brokerage functions; and
  • A back office that integrates orders with service provider fulfillment, thus addressing IT supply chain risk management activities in order to ensure the continuous delivery of solutions from the organization’s cloud ecosystem.

More About Cloud Service Brokerage

The IT service brokerage function addressed here is in no way similar to the real estate or financial service broker function with which many are familiar. Far more than the single transaction service of these other broker types, IT service broker functions sit between the back office (operations) and the front office (user experience).

From that position, it is responsible for new IT business operations skills such as sourcing, procurement, packaging and billing. This continuous and ongoing function defines and executes board guidance with regard to the organization’s technology sourcing strategies. It also supports the creation of solution architectures that maximize the value of the multisourced hybrid IT investments while meeting business needs.

Cyberattacks are a threat to businesses everywhere. Executives, board members and IT professionals must strategically organize to address hybrid cloud risk management. While the RMF and business-specific risk management processes are excellent options for tier 3 and tier 2 issues, a front-middle-back office organizational construct can be used to effectively manage tier 1 and the operational risk of the hybrid IT ecosystem.

Cloud Musings
↑ Grab this Headline Animator

( Thank you. If you enjoyed this article, get free updates by email or RSS – © Copyright Kevin L. Jackson 2015)

Follow me at https://Twitter.com/Kevin_Jackson

LEAVE A COMMENT

Name*
E-mail*
Phone number*
Your Message

Latest posts

0
283

Unveiling the end-to-end capabilities for the networked society

An Interview with Henrik Basilier  By Kevin L. Jackson The telecom industry is rapidly moving towards a future i...

0
231

AT&T Finance Solutions GM on Shrimping, Software, and DX

Helping clients address the trends and challenges presented by the Financial Services industry is the main focus for ...

0
5908

The IoT Nexus: Bosch Connected World 2019 in Berlin

Next week, I will be influencing #LikeABosch as I accept an invitation from the company to attend Bosch ConnectedWorl...

0
2114

Survive and Thrive With Digital Transformation

First cloud computing then multi-cloud. How can we get ahead of this digital transformation nightmare? These are the ...

0
415

The “George Jetson” of Today

He grew up in Silicon Valley, landed his first job at Apple Computers, was introduced to Nobel Prize winners by his d...

0
2033

MWC19: Where Telecommunications and Cloud Meet

As a cloud solution architect, my passion is learning the details about how cloud computing uniquely supports specifi...

0
366

Tulane University SoPA Selects “Architechting Cloud Computing Solutions”

Last week, Packt Publishing announced that “Architecting Cloud Computing Solutions” by Kevin L. Jackson a...

0
563

5G Wireless Technology Connecting Healthcare

Healthcare is in the middle of massive change. Called digital transformation by many, this term describes the industr...

0
525

Maria Lensing: The Network Platform for Healthcare’s Future

As a girl, Maria and her family traveled to Memphis, Tennessee to get cancer treatment for her sick brother. The mira...

0
1539

How “Big Iron” Does “Big Regulation”

According to Verizon, there were over there were over 53,000 security incidents in 2017, with over 2,200 of those ide...