Cloud governance -- manage the cloud challenge | Features | ChannelWorld.in

Cloud governance -- manage the cloud challenge

By Puneet Kukreja

Whilst business adoption of cloud services will not decrease, understanding that it is just another services model to be managed and governed is required. Governance will ensure that the value of business decisions can be tracked, and impacts to service level agreements for availability of the service, incident management, and growth on demand including the security and protection of the organisation's data assets can be understood and improved over time.

The word governance derives from the Greek verb κυβερνάω [kubernáo], which means to steer, and was used for the first time in a metaphorical sense by Plato (according to Wikipedia). Wikipedia further expands on the term, rightly calling it "the act of governing". Governance relates to decisions that define expectations, grant power, or verify performance.

Governance is about consistent management, cohesive policies, guidance, processes and decision-rights for a given area of responsibility. For the purpose of this discussion we will use it for the management, use and adoption of Cloud Services. The adoption of Cloud Services is challenging, those involved often concentrate on the security of data assets and any legislative implications that an organisation might be subjected to in the event of data assets being compromised. We discussed the concept of cloud security and its implications in an earlier article "To Cloud or Not to Cloud".

Speaking with a number of industry people about peoples' appetite for cloud adoption made me wonder if cloud is no different to outsourcing or offshoring. We explored this idea last month when we discussed "Embracing the Cloud -- A Decision Framework" where a 4-step approach was outlined, enabling your organisation to begin to adopt cloud services. This is really no different to the activities involved in procurement of business and IT services, and facilitating a quick turn-around time. In the end, it's all about mitigating the risk associated with suppliers--onsite, offsite, outsourced, offshored or in the new lingo, Infrastructure-As-A-Service (IAAS), Platform-As-A-Service (PAAS), Software-As-A-Service (SAAS). Add an 'AAS' after any capability, and it's a cloud service.

Obviously, as the take up of this new model increases, the challenge for executives is to ensure that controls are in place around the availability and viability of the cloud service offering--ensuring a service is fit for purpose and use, without neglecting data security and integrity.

Whilst business adoption of cloud services will not decrease, understanding that it is just another services model to be managed and governed is required. Governance will ensure that the value of business decisions can be tracked, and impacts to service level agreements for availability of the service, incident management, and growth on demand including the security and protection of the organisation's data assets can be understood and improved over time.

To assist with the management of the cloud challenge a list of 25 considerations, dubbed "CloudAdopt25", has been compiled to assist with establishing governance of cloud services. The 25 considerations have been split into 4 areas: Contract Management, Services Reporting, Services Management and Data Security.

Contract Management

1. Ensure that the lawyers of your organisation have adequate time to review the contract of services, specifically for any grey areas in which the vendor can change the terms of contracted services at their discretion.
2. Ensure the choice of jurisdiction is documented and agreed. An approach may be to agree that the contract between the parties be filed in the jurisdiction of the defendant.
3. The cloud services contract is required to document the actions that will take place at the start and end of the agreement to ensure appropriate establishment and closure of contracted services.
4. Ensure SLA's are in place for e-discovery requests in the event of a litigation response, further understand the liability implication of actions by your employees when using cloud services.

Services Reporting

5. Provide the cloud services provider with a definition and understanding of the organisation's control requirements.
6. Document current state controls posture of the cloud services provider against organisational requirements.
7. Establish reporting against the organisation's compliance requirements.
8. Ensure organisational structures are in place to provide continuous real-time reporting for services being consumed.
9. Ensure independent verification of detective and preventative technology controls are in place to validate confidentiality, integrity and the availability of cloud sourced data and information assets.

Service Management

10. Establish clearly documented roles and responsibilities for service provisioning including access and identity services.
11. Establish and agree on change management procedures to ensure that critical dependencies on the cloud providers' systems are understood such that they do not impact the overall service.
12. Establish and agree on incident management and response procedures that will be enacted in the event of a breach.
13. Ensure service availability parameters and thresholds are appropriately defined and agreed.
14. Ensure the cloud service provider understands their data lifecycle management obligations including backup, recovery, storage and archive.
15. Ensure request fulfilment procedures and associated processes are in place for access to the organisation's data assets in non-proprietary format and the length of the transition period at the end of the contract.

Data Security

16. Ensure that the cloud services model you chose aligns with your risk tolerance and acceptance thresholds, and that the cloud services model is commensurate with the sensitivity and/or classification of the data being stored/processed in the cloud.
17. Understand and document clear data ownership obligations and accountability of actions in the event of a breach.
18. Ensure your legislative obligations for data protection and management are addressed.
19. Understand where your data is being hosted and any impact the host country's privacy laws will have on your data.
20. Understand the legislative obligations that foreign owned vendors may be subject to (with regard to their local country's laws) whilst operating within your country.
21. Understand the architecture of the cloud service and the proposed solution to ensure the isolation of tenant applications is appropriate and in line with your policies and data security standards.
22. Ensure the cloud services provider has a secure gateway environment that is certified by an authoritative third party and the infrastructure is using validated products meeting federal or national standards.
23. Ensure there is strong encryption at the gateway, further supported by robust threat monitoring and secure logging of all access to applications and infrastructure instances hosting your data assets.
24. Ensure and validate the cloud service provider's police check and employee vetting procedures.
25. Ensure the cloud services provider has robust incident response and breach notification processes in place that are in-line with your own security incident response processes, and that they will support forensic investigation if required.


Latest Features

  • Two Snapchat features you probably don't know about

    Many social media apps have features that show up when you swipe in different directions, or functionality that isn't visible at first glance. But Snapchat might have ‘em all beat because it has a handful of hidden features and gestures that are only discovered through frequent usage or word of mouth. Frequent users of Snapchat may have noticed several places within the app that display numbers and emoticons, but most people either don't know these features exist or don't know what they mean.
  • How to make your (entire) enterprise more agile

    How to make your (entire) enterprise more agile

    In the current software development parlance, "agile" has become synonymous with innovation and speed. But many organizations limit their agile approaches to one or two siloed departments out of a mistaken belief that they're too big, too 'legacy,' too process-oriented to scale the approach across the larger business.
  • 3 tips for a hassle-free Windows 10 upgrade

    The waiting is almost over.
  • What you can learn from Nordstrom's use of the cloud

    The example of how retailer Nordstrom uses cloud computing services could serve as an example to other businesses who are struggling with how to use the cloud.
All About Windows 10

The Windows 10 upgrade: Who should do it, who could wait

The day is finally here: Windows 10's launch. And if you haven't been participating in Microsoft's Windows Insider previews, you have a single, simple question: Should I upgrade to Windows 10?

Windows 10 vs. Windows 8: Performance benchmarks show a close battle for fastest

Windows 10 performance is one of the hardest things to nail down right now. Here are some initial tests.

Windows 10 installation files already sneaking onto Windows 7 and 8 PCs

Starting around midnight Eastern time on Wednesday, June 29, 2015 Windows 10 will start rolling out to Windows Insider members.

Windows 10: Fact vs. fiction

It's a few days before Windows 10 is officially slated to drop, and still, confusion abounds. Worse, many fallacies regarding Microsoft's plans around upgrades and support for Win10 remain in circulation, despite efforts to dispel them.

IT hears the siren call of free Windows 10 upgrades

Even enterprise IT professionals are taken with Microsoft's free upgrade offer to Windows 10, according to a recently-released survey by Spiceworks.

ChannelWorld Research

Why Channels Have Changed Their Go-to-Market Strategy in Six Months

According to our SOTM Mid-Year Survey, a majority of Indian channels said their top go-to-market strategy was to offer services in a recurring revenue model—not introducing new technologies, like SMAC, which was their top GTM strategy six months ago.

SOTM Mid-Year Survey 2015: Your Roadmap for the Next 6 Months

According to the survey, the next six months of the year are going to be eventful. Here are the challenges, emerging technologies and trends that will shape the rest of the year for you.

Big Data, Mobility Top Partners’ Wish List: SOTM Mid-Year Survey 2015

According to the ChannelWorld's State of the Mart Mid-Year Survey (SOTM) 2015, big data is the way to go for the enterprise channels for the second half of this year, with 34 percent partners planning to invest in it.

Private Cloud Still Remains a ‘Safe Bet’ for Partners: SOTM Survey 2015

According to the STOM 2015 survey, channel partners who are into cloud computing feel that 42 percent of their business will be generated by private cloud.

Partners Pin Hope on Government, Expects IT Spend to Grow: SOTM Mid-Year Survey 2015

According to the ChannelWorld's State of the Mart Mid-Year survey (SOTM) 2015, 30 percent of the channel partners believe that IT spend in the government sector is likely to increase in next six months.

No More Baby Steps, Partners Ready to ‘Risk’ Gambling with Disruptive Tech: SOTM Survey 2015

According to ChannelWorld’s State of the Mart Survey (SOTM) 2015, 43 percent of channel partners say their business will have a ‘high risk appetite’ in the second half of this year.

Channels’ 3 Great Expectations from Tech OEMs

Introduced as an individual category under ‘Expectations from tech OEMs’ list in SOTM Mid –Year Survey, ‘transparent deal registration’ emerged as the biggest concern for channel companies in India.

Latest Videos

Why We Believe in Servicing a Single Vertical: Satish Pendse, Highbar Technologies

The biggest pro of taking a vertical approach is that you put all your efforts into one thing and this excessive focus helps you succeed, says Satish Pendse, President, Highbar Technologies.

Fortinet Geared to Enhance Visibility: Rajesh Maurya

Fortinet will engage in intense dialogue with customers and partners through events, roadshows, POCs and various other initiatives, says Rajesh Maurya, Country Manager- India & SAARC, Fortinet

Hybrid SDN is a Big Opportunity for Channels: Subhasish Gupta, Allied Telesis

Subhasish Gupta, Country Manager India & SAARC, Allied Telesis, says hybrid SDN and surveillance solutions can open new doors for channel partners in India.

EDITOR'S PICK

The Windows 10 upgrade: Who should do it, who could wait

The day is finally here: Windows 10's launch. And if you haven't been participating in Microsoft's Windows Insider previews, you have a single, simple question: Should I upgrade to Windows 10?

Windows 10 vs. Windows 8: Performance benchmarks show a close battle for fastest

Windows 10 performance is one of the hardest things to nail down right now. Here are some initial tests.

Windows 10 installation files already sneaking onto Windows 7 and 8 PCs

Starting around midnight Eastern time on Wednesday, June 29, 2015 Windows 10 will start rolling out to Windows Insider members.

Windows 10: Fact vs. fiction

It's a few days before Windows 10 is officially slated to drop, and still, confusion abounds. Worse, many fallacies regarding Microsoft's plans around upgrades and support for Win10 remain in circulation, despite efforts to dispel them.

IT hears the siren call of free Windows 10 upgrades

Even enterprise IT professionals are taken with Microsoft's free upgrade offer to Windows 10, according to a recently-released survey by Spiceworks.

SLIDESHOWS

7 Apps By The Indian Government You Need to Use

There are over hundreds of government initiated apps for Android, Apple and Windows devices. With Narendra Modi’s Digital India initiative, the government has released several new feature-rich smartphone applications.

SOTM Mid-Year Survey 2015: Your Roadmap for the Next 6 Months

According to the survey, the next six months of the year are going to be eventful. Here are the challenges, emerging technologies and trends that will shape the rest of the year for you.

The State of the Internet

Akamai's Q1 2015 state of the internet report provides insights into key global statistics including connection speeds, broadband adoption (fixed and mobile networks), and IPv4 exhaustion and IPv6 implementation.

India Software Market on an Upswing

According to IDC, the Indian software market has witnessed consistent growth of 10 percent since the second half of 2014, showing signs of growth and revival. 

7 Jobs Technology Has Replaced

Albert Einstein said once that it has become appallingly obvious that our technology has exceeded our humanity. With every invention of technology some poor soul becomes vulnerable to losing his or her job in some corner of the world. Here are few jobs that will cease to exist soon.

India's Leading VADs

Why Channels Want to Partner With Inflow Technologies

Inflow Technologies’ tie up with 39 vendor companies, an extensive tech portfolio, and a services play, are great value propositions for enterprise channels, says its President and CEO, Byju Pillai.

iValue Creates Real Value for Channels in India

Focused on niche vendor alliances around data, network and app management backed by a robust channel ecosystem marked iValue's success in 2014. What clicked for the seven-year-old VAD?

RAH Infotech Shows Channels the Way Ahead

Mutual trust and long lasting bond with vendor companies and channel partners helps VADs to evolve and succeed in today’s aggressively competitive market. Leveraging competent channel partners and forge niche vendor alliances marks RAH Infotech’s success in 2014.

How Satcom Infotech is Adapting to New Security Landscape

As a leading value added distributor, Satcom Infotech is emerging as an end-to-end security player, helping both customers and partners grow.

How ComGuard Shields Channel Partners

As emerging technologies introduce new threats to the enterprise landscape, they are making channel partners anxious. But VADs like ComGuard are putting their worries to rest. Here's how.

Tech Chat

Collaborating To Outcome Based World: Priyadarshi Mohapatra, Avaya

Priyadarshi Mohapatra, Managing Director, India and SAARC, Avaya, on how IT is transitioning from a keep-the-lights-on role to one that enables customers to deliver results.

The Dawn of the Digital Age: Akhilesh Tuteja, KPMG

The development of digital infrastructure will be a key growth driver for technology and solution providers. 

Paradigm Shift from End-Users to User-First : Parag Arora,Citrix

Parag Arora, Area Vice President and India Head, India Sub-continent, Citrix, says new technologies will force organizations to take a user-first approach in 2015.

Mobile and Cloud Are Gamechangers of the Future: Karan Bajwa, Microsoft

Karan Bajwa, Managing Director, Microsoft India, says, in  2015, organizations will adopt a mobile-first and cloud-first strategy to get ahead of competition.

A Network for the Internet of Everything : Dinesh Malkani,Cisco

Dinesh Malkani, President, India and SAARC, Cisco, talks about IoT and the significant technology transitions in the networking world.

Moving to the Third Platform: Jaideep Mehta, IDC

Cloud and mobility are the two technologies that will fuel the rapid adoption of the third platform in India.

Envisaging a Holistic Security Strategy For 2015: Sanjay Rohatgi,Symantec

Sanjay Rohatgi, President–Sales, Symantec India, says the company has a set of holistic solutions in place to secure organizations from security threats. 

Beating the Bad Guys: Sivarama Krishnan, PwC

Organizations will need to turn inwards to establish robust information security strategies.

Building Capabilities for a Digital Tomorrow: Alok Ohrie,Dell

Alok Ohrie, President and Managing Director, Dell India, on the company’s investments to build end-to-end solutions and delivery capabilities for a digital world.

FAST TRACK

Kamtron Systems

Transitioning towards a service-oriented company will boost our growth, believes Kavita Singhal, director, Kamtron Systems.

TIM Infratech

Delivering ‘best of breed’ technologies to enterprises is key to success, says Monish Chhabria, MD, TIM Infratech

Mudra Electronics

A vendor-agnostic strategy helped us sustain business, says Bharat Shetty, CMD, Mudra Electronics.

Systematix Technologies

Our USP is a customer-friendly approach backed by services, says Akhilesh Khandelwal, Director, Systematix Technologies.

CorporateServe Solutions

Our ability to turnaround complex ERP projects in record time is what gets us customer referral, says Vinay Vohra, Founder & CEO, CorporateServe Solutions.

KernelSphere Technologies

We are emerging as an end-to-end systems integrator, says Vinod Kumar, MD, KernelSphere Technologies.

Uniware Systems

We constantly validate emerging technologies for first-mover advantage, says Vergis K.R., CEO, Uniware Systems.

Astek Networking & Solutions

An innovative approach helps us stay successful, says Ashish Agarwal, CEO, Astek Networking & Solutions.

CSM Technologies

Our approach is backed by innovation and simplicity, says Priyadarshi Nanu Pany, CEO, CSM Technologies.

SOCIAL MEDIA @ CW India
SIGNUP FOR OUR NEWSLETTER

Signup for our newsletter and get regular updates.