In my first post of this series, “CloudMigration Part One: An Overview,” I provided a high-level summary of how enterprises should migrate applications
to the cloud. In this installment, the focus is on enterprise data and why your
organization may need to review
and reclassify its data before moving anything to the cloud.
Cloud computing has done more than change the way
enterprises consume information technology.
It is also changing how organizations need to protect their data. Some may see this as an “unintended consequence”
but the headlong rush to save money by migrating applications to the cloud has
simultaneously uncovered long-hidden
application security issues. This revelation
is mostly due to the wide adoption of “Lift
& Shift” as a cloud migration strategy.
Using this option typically precludes any modifications of the migrating
application. It can also result in the
elimination of essential data security
controls and lead to grave data breaches.
While there is no doubt in the good intentions of all
involved, traditionally, enterprise applications were developed for deployment
into the organization’s own IT infrastructure.
This implicit assumption also included the use of infrastructure-based
security controls to protect organizational data. These generally accepted industry practices
were coupled with a cultural propensity to err on the side of caution by
protecting most data at generally high levels. During an implementation,
organizations typically used a two-level (sensitive and non-sensitive) or at
most a four-level data classification model.
Today, the cloud has
quickly become the preferred deployment environment for enterprise
applications. This shift to using “other
people’s infrastructure” has brought with it tremendous variability in the
nature and quality of infrastructure-based data security controls. It is also forcing companies to shift away
from infrastructure-centric security to data-centric
information security models. Expanding
international electronic commerce, ever tightening national data sovereignty
laws and regional data protection and privacy regulations (i.e., GDPR)
have also combined to make many data classification schemas generally
untenable. Cloud Security Alliance and the International Information Systems Security
Certification Consortium (ISC2), in fact, both suggest that corporate data
may need to be classified across at least eight categories, namely:
- Data type (format, structure)
- Jurisdiction and other legal constraints
- Context
- Ownership
- Contractual or business constraints
- Trust levels and source of origin
- Value, sensitivity, and criticality
- The obligation for retention and preservation
Moving to classify data at
this level means that one of the most important initial steps of any
cloud computing migration must be a review and possible reclassification of all
organizational data. In bypassing this
step, newly migrated applications simply become
data breaches in wait. At a minimum an enterprise should:
- Document all key business processes destined for cloud migration;
- Identify all data types associated with each migrating business process;
- Explicitly assign the role of “Process Data Owner” to appropriate individuals; and
- Assign each “Process Data Owner” the task of setting and documenting the minimum required security controls for each data type.
After completing these steps, companies should review and
update their IT governance process to reflect any required expansion of their
corporate data classification model.
These steps are also aligned with ISO
27034-1 framework for implementing cloud application security. This standard explicitly takes a process
approach to specifying, designing,
developing, testing, implementing and maintaining security functions and
controls in application systems. It
defines application security not as the state of security of an application
system (the results of the process) but as “a process an organization can
perform for applying controls and measurements to its applications in order to manage the risk of using them.”
In Part 3 of this series, I will
discuss application screening and related industry best practices and include:
- Determining the most appropriate target application deployment environment;
- Determining each application's business value, key performance indicators and target return on investment;
- Determining each application's migration readiness; and
- Deciding the appropriate application migration strategy.
This post was brought to you by IBM Global Technology Services. For more content like this, visit ITBizAdvisor.
