Welcome!

Microservices Expo Authors: Yeshim Deniz, Pat Romanski, Elizabeth White, Liz McMillan, Zakia Bouachraoui

Related Topics: @CloudExpo, Microservices Expo, Cloud Security

@CloudExpo: Blog Feed Post

Compliance in the Cloud | @CloudExpo @DMacVittie #DevOps #Compliance

Our work, both with clients and with tools, has lead us to wonder how it is that organizations are handling compliance issues in

Our work, both with clients and with tools, has lead us to wonder how it is that organizations are handling compliance issues in the cloud. The big cloud vendors offer compliance for their infrastructure, but the shared responsibility model requires that you take certain steps to meet compliance requirements.

Which lead us to start poking around a little more. We wanted to get a picture of what was available, and how it was being used. There is a lot of fluidity in this space, as in all things cloud. The fact that DevOps Security plays into the cloud compliance model – particularly in dynamic cloud environments – makes it even more fluid.

We’ve found the following options are the ones most frequently being pursued in cloud deployments for industries that need to meet compliance requirements.

Not in the Cloud
This is the default, and a lot of companies are following it. That is not to say they don’t use the cloud, but that anything that falls under compliance requirements is not moved to the cloud. In its simplest form, only static web sites are moved out to the cloud, or only SaaS, where compliance burdens fall more heavily on the provider are moved out of the datacenter.

Using Guidelines
All of the major vendors have guidelines to compliance for the customers’ part of the shared responsibility model. Since AWS is the largest cloud provider, we’ll link to their section. This requires manual effort and maintenance of scripts, but allows compliance to closely match inside-the-DC compliance. This is arguably the most often followed model.

Outsourcing
There is a healthy consulting business around compliance in the cloud, and a fair number of organizations are using it. By asking someone whose specialty is the nexus of compliance and cloud, the organization gets the results required without burning up a ton of man-hours internally. This too is a popular option, and should your organization go in that direction, there are plenty of resources to help find the consultant/service that best suits a given scenario.

Compliance Tools
There is a growing collection of tools available to help ease the transition to Cloud based compliance. They range from tools that aim to lock down the application itself to tools that run through cloud vendor settings and validate that the clients’ share of infrastructure configuration is compliant.

Due to the rate of change that both agile and DevOps introduce, we see this type of automation as the direction of the future, but it is too early to say how soon in the future. The simple fact is that Security and Compliance teams were already overburdened, and automation is the only thing that will allow them to stay ahead of the curve. The question is how fast the tools can both mature and engender trust amongst those responsible for corporate compliance.

In the End, It Is About the Org
The answer is different for each organization, sometimes even for each application portfolio or even application. We’re just listing the most common paths teams take, so if you’re looking for more options than whatever is currently happening, you have a place to start. There is a decent amount written about each of these options, so researching the one that suits you should not be a problem.

More Stories By Don MacVittie

Don MacVittie is founder of Ingrained Technology, A technical advocacy and software development consultancy. He has experience in application development, architecture, infrastructure, technical writing,DevOps, and IT management. MacVittie holds a B.S. in Computer Science from Northern Michigan University, and an M.S. in Computer Science from Nova Southeastern University.

Microservices Articles
Consumer-driven contracts are an essential part of a mature microservice testing portfolio enabling independent service deployments. In this presentation we'll provide an overview of the tools, patterns and pain points we've seen when implementing contract testing in large development organizations.
Containers and Kubernetes allow for code portability across on-premise VMs, bare metal, or multiple cloud provider environments. Yet, despite this portability promise, developers may include configuration and application definitions that constrain or even eliminate application portability. In this session we'll describe best practices for "configuration as code" in a Kubernetes environment. We will demonstrate how a properly constructed containerized app can be deployed to both Amazon and Azure ...
In his general session at 19th Cloud Expo, Manish Dixit, VP of Product and Engineering at Dice, discussed how Dice leverages data insights and tools to help both tech professionals and recruiters better understand how skills relate to each other and which skills are in high demand using interactive visualizations and salary indicator tools to maximize earning potential. Manish Dixit is VP of Product and Engineering at Dice. As the leader of the Product, Engineering and Data Sciences team at D...
In his session at 20th Cloud Expo, Scott Davis, CTO of Embotics, discussed how automation can provide the dynamic management required to cost-effectively deliver microservices and container solutions at scale. He also discussed how flexible automation is the key to effectively bridging and seamlessly coordinating both IT and developer needs for component orchestration across disparate clouds – an increasingly important requirement at today’s multi-cloud enterprise.
SYS-CON Events announced today that DatacenterDynamics has been named “Media Sponsor” of SYS-CON's 18th International Cloud Expo, which will take place on June 7–9, 2016, at the Javits Center in New York City, NY. DatacenterDynamics is a brand of DCD Group, a global B2B media and publishing company that develops products to help senior professionals in the world's most ICT dependent organizations make risk-based infrastructure and capacity decisions.
Most DevOps journeys involve several phases of maturity. Research shows that the inflection point where organizations begin to see maximum value is when they implement tight integration deploying their code to their infrastructure. Success at this level is the last barrier to at-will deployment. Storage, for instance, is more capable than where we read and write data. In his session at @DevOpsSummit at 20th Cloud Expo, Josh Atwell, a Developer Advocate for NetApp, will discuss the role and value...
DevOpsSummit New York 2018, colocated with CloudEXPO | DXWorldEXPO New York 2018 will be held November 11-13, 2018, in New York City. Digital Transformation (DX) is a major focus with the introduction of DXWorldEXPO within the program. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive over the long term.
CloudEXPO New York 2018, colocated with DXWorldEXPO New York 2018 will be held November 11-13, 2018, in New York City and will bring together Cloud Computing, FinTech and Blockchain, Digital Transformation, Big Data, Internet of Things, DevOps, AI, Machine Learning and WebRTC to one location.
Enterprise architects are increasingly adopting multi-cloud strategies as they seek to utilize existing data center assets, leverage the advantages of cloud computing and avoid cloud vendor lock-in. This requires a globally aware traffic management strategy that can monitor infrastructure health across data centers and end-user experience globally, while responding to control changes and system specification at the speed of today’s DevOps teams. In his session at 20th Cloud Expo, Josh Gray, Chie...
Discussions of cloud computing have evolved in recent years from a focus on specific types of cloud, to a world of hybrid cloud, and to a world dominated by the APIs that make today's multi-cloud environments and hybrid clouds possible. In this Power Panel at 17th Cloud Expo, moderated by Conference Chair Roger Strukhoff, panelists addressed the importance of customers being able to use the specific technologies they need, through environments and ecosystems that expose their APIs to make true ...