Friday, July 27, 2018

Cloud Migration Best Practice Part 2: Classifying Your Data



In my first post of this series, “CloudMigration Part One: An Overview,” I provided a high-level summary of how enterprises should migrate applications to the cloud. In this installment, the focus is on enterprise data and why your organization may need to review and reclassify its data before moving anything to the cloud.

Cloud computing has done more than change the way enterprises consume information technology.  It is also changing how organizations need to protect their data.  Some may see this as an “unintended consequence” but the headlong rush to save money by migrating applications to the cloud has simultaneously uncovered long-hidden application security issues.  This revelation is mostly due to the wide adoption of “Lift & Shift” as a cloud migration strategy.  Using this option typically precludes any modifications of the migrating application.  It can also result in the elimination of essential data security controls and lead to grave data breaches.

While there is no doubt in the good intentions of all involved, traditionally, enterprise applications were developed for deployment into the organization’s own IT infrastructure.  This implicit assumption also included the use of infrastructure-based security controls to protect organizational data.  These generally accepted industry practices were coupled with a cultural propensity to err on the side of caution by protecting most data at generally high levels.  During an implementation, organizations typically used a two-level (sensitive and non-sensitive) or at most a four-level data classification model.

Today, the cloud has quickly become the preferred deployment environment for enterprise applications.  This shift to using “other people’s infrastructure” has brought with it tremendous variability in the nature and quality of infrastructure-based data security controls.  It is also forcing companies to shift away from infrastructure-centric security to data-centric information security models.  Expanding international electronic commerce, ever tightening national data sovereignty laws and regional data protection and privacy regulations (i.e., GDPR) have also combined to make many data classification schemas generally untenable.  Cloud Security Alliance and the International Information Systems Security Certification Consortium (ISC2), in fact, both suggest that corporate data may need to be classified across at least eight categories, namely:
  • Data type (format, structure)
  • Jurisdiction and other legal constraints
  • Context
  • Ownership
  • Contractual or business constraints
  • Trust levels and source of origin
  • Value, sensitivity, and criticality
  • The obligation for retention and preservation

Moving to classify data at this level means that one of the most important initial steps of any cloud computing migration must be a review and possible reclassification of all organizational data.  In bypassing this step, newly migrated applications simply become data breaches in wait.  At a minimum an enterprise should:
  • Document all key business processes destined for cloud migration;
  • Identify all data types associated with each migrating business process;
  • Explicitly assign the role of “Process Data Owner” to appropriate individuals; and
  • Assign each “Process Data Owner” the task of setting and documenting the minimum required security controls for each data type.

After completing these steps, companies should review and update their IT governance process to reflect any required expansion of their corporate data classification model.  These steps are also aligned with ISO 27034-1 framework for implementing cloud application security.  This standard explicitly takes a process approach to specifying, designing, developing, testing, implementing and maintaining security functions and controls in application systems.  It defines application security not as the state of security of an application system (the results of the process) but as “a process an organization can perform for applying controls and measurements to its applications in order to manage the risk of using them.”

In Part 3 of this series, I will discuss application screening and related industry best practices and include:
  • Determining the most appropriate target application deployment environment;
  • Determining each application's business value, key performance indicators and target return on investment;
  • Determining each application's migration readiness; and
  • Deciding the appropriate application migration strategy.



This post was brought to you by IBM Global Technology Services. For more content like this, visit ITBizAdvisor.



Cloud Musings
( Thank you. If you enjoyed this article, get free updates by email or RSS - © Copyright Kevin L. Jackson 2016-2018)



21 comments:

Thomson Peter said...

I am really impressed with the way of writing of this blog. The author has shared the info in a crisp and short way.

Cloud Migration services
Aws Cloud Migration services
Azure Cloud Migration services
Vmware Cloud Migration services
Database Migration services

vm migration said...

Great scheme, waiting for part 3

Priya said...

This post is great and thanks for sharing. By reading this article I got some idea about the concept of Cloud Migration
Google Cloud Platform Training
GCP Online Training
Google Cloud Platform Training In Hyderabad


Unknown said...

Given article is very helpful and very useful for my admin, and pardon me permission to share articles here hopefully helped:
Erp In Chennai
IT Infrastructure Services Software
ERP software company
web design company in india
Remote Infrastructure Services Software
College Management System Software
School Management System Software
Cloud Erp Software Company In India
Best web development company
ERP in India

Unknown said...

Excellent information with unique content and it is very useful to know about the information based on blogs.
Construction company in aranthangi pudukottai
best Construction company
cement wholesale dealers in aranthangi pudukkottai
TMT steel bars wholesale dealers in aranthangi
best interior designers
construction resources and equipments providers
best hardware product suppliers
electrical products and services

DevOps said...

Thanks for sharing the valuable information.
Cloud Foundry Online Training

Bhanu Sree said...

This concept is a good way to enhance the knowledge.thanks for sharing.. Great article ...Thanks for your great information, the contents are quiet interesting.
GCP Online Training
Google Cloud Platform Training In Hyderabad
Google Cloud Platform Training
Google Cloud Platform Training Online

Dennis said...

Nice Blog !!..
IT Infrastructure Services
HRMS Services
HR Management Services
JAVA Development Services

Neeta Sahay said...

Good piece of work it contains all the matters with regards to the cloud migration as a service. Good luck to you and your well performed job.

Unknown said...

Great Article
Cloud Computing Projects


Networking Projects

Final Year Projects for CSE


JavaScript Training in Chennai

JavaScript Training in Chennai

The Angular Training covers a wide range of topics including Components, Angular Directives, Angular Services, Pipes, security fundamentals, Routing, and Angular programmability. The new Angular TRaining will lay the foundation you need to specialise in Single Page Application developer. Angular Training

Vibin said...

Nice Blog. Its really helpful for those who all are looking for a cloud service.

sri said...

Thanks for sharing this informative content , Great work
Leanpitch provides online training in Devops during this lockdown period everyone can use it wisely.
Devops Online Training

seethalakshmi said...

I got full details on cloud migration service providers after reading your blog. It is the best blog to know about it. Thanks for sharing.
cloud migration service providers

donnaj edwards said...

I really liked your Information. Keep up the good work. iManage Work

CloudNow said...

Thanks for sharing this was very helpful. Please check our product akku
Identity & Access Management Solution

Malliefahey said...

Hi, Neat post. There is a problem with your website in internet explorer, would test this… IE still is the market leader and a huge portion of people will miss your great writing due to this problem.web agency berlin

CloudNow said...

This information really helped me a lot. It was very informative.
Cloud Managed Services
GCP Managed Services
Cloud Migration Services
Cloud Advisory Services

Application Development said...

This information really helped me a lot. It was very informative.
Cloud Migration Services

Helen John said...

https://vaporvm.com/cloud-migration

Application Development said...

"This information really helped me a lot. It was very informative.
Cloud Migration Services
Cloud Migration Solutions
Cloud Migration Service providers
cloud migration & deployment services
Cloud Migration solution provider in india
cloud migration service and solution providers in india
Cloud Migration service provider in india"

Andrea said...

Great work! Thank you for sharing this. Check it out our top notch services and solution on IT infrastructure services in chennai . Experts in AMC Service Provider in chennai, Cloud Management Services in chennai, Hybrid IT solutions in chennai, Penetration Testing Services, Cyber Security Services Company, ISO 27001 Services