Migra1ng to the Cloud

Transcription

1 Migra1ng to the Cloud Barry P. Sheward LM Fellow June 9, Lockheed Mar1n. All Rights Reserved. 1

2 About this presenta/on The presenta1on will cover a brief introduc1on to cloud, followed by the general issues to consider when transi1oning to the cloud from a number of various perspec1ves including applica1on assessment and migra1on planning, governance, risk and compliance, virtual compute environments, virtual storage and virtual networking. It will then cover specific issues that we have encountered on programs while moving to the cloud. 2

3 About the speaker Barry Sheward is an LM Fellow at Lockheed Mar1n who specializes in cloud compu1ng. Barry was awarded the 2012 Lockheed Mar1n Cloud Compu1ng Individual Excellence Award and has developed secure hybrid cloud solu1ons used by government agencies. Barry started his career developing enterprise management solu1ons for Computer Associates then transi1oned into cyber security at TruSecure/CyberTrust. He graduated from Brunel University in London, is a Cer1fied Informa1on Systems Security Professional (CISSP), VMware Cer1fied Professional (VCP) for both vsphere and vcloud and an AWS Cer1fied Solu1ons Architect. barry.p.sheward@lmco.com 3

4 Cloud Terminology Delivery Models Deployment Models Cloud Characteristics 1. On-Demand Self-Service* 2. Ubiquitous Network Access* 3. Location Independent Resource Pooling* 4. Rapid Elasticity* 5. Measured Service* *US NIST Definitions Software As A Service (SaaS) Platform As A Service (PaaS) Public Cloud is accessible over the public internet for general consumption Community Cloud Cloud is accessible over the public internet for specific groups/purpose Virtual Private Cloud is deployed at providers facility and dedicated to a specific customer Hybrid Infrastructure As A Service (IaaS) Private Cloud is deployed behind customer firewall on customer presence 4

5 Why move to the cloud? Agility 55% Cost 20% (CapEx vs OpEx) Other 15% Defend IT Enable hybrid Quality Don t know Business Alignment 10% Source: The Drivers and Challenges of Private Cloud Compu1ng. March 2011, Gartner hcp:// 5

6 The Path to Cloud Tradi1onal Data Center - > Virtual Datacenter - > Cloud Datacenter Tradi1onal Data Center Provisioned by IT Department Special cases are the general case Virtual Datacenter Provisioned by IT Department Special cases can be accommodated Cloud Datacenter Self Service provisioning Special cases aren t usually accommodated 6

7 Challenges with Cloud Migra/on What You See What You May Not See On demand Self Service Flexible, Elas/c Usage Models Broad Network Access Pay For What You Use Finance, Security, Porkolio Management Con1nuous Security and Compliance Management Defense of Cyber APT Acquisi1on Contracts Vendor Lock In and interoperability Performance SLAs and Mission Support Green Eco- Friendly Legacy Applica1on Support and Migra1on Financial Integra1on Change Management DR/BC/COOP 7

8 Applica/on Assessment Applica1on Classifica1on Legacy Onen run on non- Wintel plakorms Costly to virtualize, but with great benefits Enterprise Mission cri1cal, high SLA requirements, high resource requirements Big Data Web Large volume of valuable data requires complex processing Compute/Storage must be close Visibility, impact are high. Elas1city is cri1cal. Agility for applica1on rollout is cri1cal. Desktop Server hosted applica1ons provide a consistent IT environment for end user compu1ng 8

9 Applica/on Assessment Understand Applica1on Value Business Impact Low impact applica1ons could be migrated first Understand Applica1on Requirements Security Availability (Up1me) Latency Bandwidth Specific API requirements Specific Hardware (CPU/BIOS/Peripheral) requirements Geography Data requirements Isola1on due to legal or regulatory requirements Test/Dev/Produc1on 9

10 Financial Assessment CapEx vs. OpEx costs Slow migra1on vs. Fast Migra1on Hardware re- use vs. replace saves CapEx License costs Cost to reputa1on Security Breach Availability 10

11 Data Requirements Tier 1 Enterprise High Availability (99.999%) High Volume (>10TB), Low Latency (<1ms) RTO/RPO Immediate/Zero High Impact Tier 2 Accounts 99.9% availability Medium Volume Size (5TB), Medium Latency (<10ms) RTO/RPO < 4Hrs / 4 Hrs Medium Impact Tier 3 Expenses 95% availability Low Volume (<1TB), High Latency (>100ms) RTO/RPO < 24Hrs / 24 Hrs Low Impact 11

12 Other Applica/on Considera/ons Applica1on Dependencies Each one needs its own considera1ons How many users? Usage pacerns? Applica1on scalability? High Availability requirements? Greenfield vs. Brownfield upgrade Forklin Upgrade 12

13 Governance, Risk and Compliance Security is not Compliance FRCP (US Federal Rules of Civil Procedure) GLBA (Graham Leach Bliley Act (Financial Moderniza1on Act of 1999)) SOX (Sarbanes Oxley Act of 2002) PCI (Payment Card Industry standard aka Payment Card Industry Data Security Standard (PCI DSS)) Governance approach Monitor - > Evaluate - > Direct For each applica1on note: Qualita1ve (Quick) Risk (H/M/L) Last assessment Regula1ons / Compliances Security Requirements 13

14 Threat Assessment Threat Risk Mitigations To Consider Customer Experience and Performance Poor performance creates self-made denial of service issues and poor customer experience Leverage cloud vendor best practice solutions Proactively manage bandwidth for performance and charge back Obtain vendor guarantees/slas so they do not over sell their cloud Constantly Changing Threat Landscape Cloud Computing Vendor Pulls a DOT.COM and Goes Chapter 11 or Closes Division Mission/Business Impact Management Availability Loss Ability to defend against 80% known threat and 20% unknown threat Loss of data and systems that impedes ability to execute mission Unable to access your information or run your mission/business Clearly understand the type of cloud you are using, including all planned changes Understand who might be sharing your cloud and any changes Implement a cyber security intelligence program so defenses (People, Process, Technology) can be proactively updated to mitigate the risks Ensure your cloud provider provides full transparency Leverage the Consensus Audit Guidelines Use a private cloud Check financial health of company and cloud computing division Use multiple cloud providers Reverse cloud the DR/BC/COOP Use a private cloud Use multiple cloud providers Privacy of Data Competitors and Those Of Nefarious Intent Use a private cloud Bulk encryption of data at rest and in motion Strong identity access management technology, governance, and processes Loss of Data and Integrity Insider Threat Intellectual property loss or misinformation introduced that adversely affects your mission/business All controls perfect; internal team with root/ admin access compromises systems Use a private cloud and Data Leak Protection Use Digital Rights Management Background check on all cloud computing employees Robust and secure auditing Ensure vendor compliant with ISO 9001, 27001, ITILv3, CMMI Change of Cloud Vendors Your data never destroyed Use crypto shredding and Use Active Active Cloud vendors Use virtual machine file and web application standards Legal/Industry Compliance Loss of customer confidence, financial loss, even Chapter 11 (your job) Use a private cloud Automated cyber security systems/robust and secure auditing 14

15 Virtual Compute Hypervisor Types Type I Bare Metal Type II Hosted Virtualiza1on Differences Full virtualiza1on Paravirtualiza1on Hypervisor Features Dynamic Resource Scheduling High Availability Fault Tolerance Scalability Peripheral Support Licensing & Cost Management Mul1ple Hypervisors? Physical Servers 15

16 Virtual Storage Provisioning Types Thick Thin Storage Types Block File iscsi Fibre FCoE CIFS NFS Storage Tiering Intra- array vs. Inter- array Caching (Flash) VM provisioning type ma5ers too! o Array Capabili1es o Replica1on & Failover o Clones and Snapshots 16

17 LESSONS LEARNED 17

18 The Big Ques/ons Which Service Model? IaaS PaaS API Managed IaaS SaaS Which deployment model? Private Cloud Hybrid Cloud Community Cloud Public Cloud Consideratons Vendor Lock- In Staff Acceptance User Acceptance Cost Flexibility Scalability Capability 18

19 Security Considera/ons Integrity Mul1ple acack points VM, Virtual Network, Is recovery possible? Checksums - everything Confiden1ality Mul1ple acack points VM, Virtual Network, Hard to detect Encryp1on everywhere VPN, File systems Availability Whether malicious or not DR/BC/CoOp plans Monitoring Automa1on and Integra1on Applica1on design Loose coupling Design for failure Who do you trust? 19

20 Security Considera/ons Lack of transparency Hypervisors Escape & Memory Reuse GovClouds Dedicated Instances (Not VPC!) Opera1ng Systems Storage Online, Nearline, Offline Object Reuse & Destruc1on Network Security Group Config Threat vectors increase as cloud capabilibes are ublized 20

21 Financial Considera/ons Compute Costs CPU varia1on Loss of value- add Compliance monitoring DevOps An1Virus Rent vs. Buy Value of op1ons Network Hidden Ini1al vs. Long term Cost of IP Addresses Direct Connect Storage Stopped VMs Disconnected Virtual Disks Tiers Online Nearline / Object Offline Access rules New business models Support CSPs are not GovSIs 21

22 Performance Considera/ons Command and Control VM start 1me Reac1on when scaling Compute Performance Similar types, dissimilar performance Network Bandwidth Network Latency Internally may be < 10ms To cloud may be > 500ms Storage Access Speed Online Fast IOPS, Higher cost Near- line Without or Outside cloud Content Distribu1on Networks Ini1al vs. Long Term Intra- cloud May be faster Customer to cloud Offline Does restora1on speed meet SLAs? Probably slower 2014 Lockheed Mar1n. All Rights Reserved. 22

23 Other Considera/ons Separa1on of Responsibili1es Can introduce issues as automa1on increases Authen1ca1on Hooks into corporate AD/ LDAP End- User Interface Cloud Vendor? Service Catalog? Offerings SKUs or a la carte? Exit strategy Service Desk Cloud Portability Can VMs be moved? CSP to CSP CSP to Customer Customer to CSP Down1me compensa1on Financial Measurement Pre- migra1on Post- migra1on 23

24 Thank You 24