Cloud adoption requires adopting a new mindset to provide a return on investment.
The Bottom Line // Moving to the cloud requires a new way of thinking and managing services. Cloud adoption requires adopting a new mindset to provide a return on investment. Start with a clear goal, preferably a specific application or service, as you take your company to the cloud to minimize the cost of acquisition while your teams learn and grow in the new environment.
Download our handout and read the four things you can do to ensure the cost of acquisition is minimized and the return on investment is maximized.
Basketball season is in full swing. I have been lucky for the last seven years to coach different levels of basketball ranging from Youth teams through the local High School team. Coaching continues to be a rewarding experience and many of the lessons I have learned working with athletes and other coaches apply directly to my work with product teams. It doesn’t matter how much you work to perfect your craft, be it system architecture or coaching a team of 5th grade athletes, there are always new challenges to tackle. A core tenant of sports is continuous improvement which should be applied to everything we do with technology. No one starts playing basketball ready to play in the pros, but everyone has it in them to be successful. It takes a tremendous amount of practice, a dedication to learning new things from others, and celebrating the little victories along the journey.
It is not surprising there are so many different Cloud Security analogies available on the Internet. Cloud Security is a difficult concept to describe given the wide range or tools, services, and seemingly infinite combinations organizations can utilize to solve business problems. If you are a fan of basketball, using different defensive schemes is a great way to describe different views on Cloud Security processes. In all cases, the goal is to prevent the offense, or in this case bad actors, from scoring while providing dynamic responses to a constantly changing product architecture and threat landscape. Typical Cloud Security frameworks today can be compared to two classic defenses: man-to-man and zone.
Man-to-Man Cloud Security involves security controls developed around individual services of products. Each control is focused on denying the service from sending or receiving information to other services in the system and aggressively focusing on protecting a single service. Firewalls, both web application and network, focus on denying traffic to block bad actors from easily accessing services. Logging and application specific analytics can be used to build a profile of a service and alert when the service profile is not followed. The disadvantage with man-to-man Cloud Security is in its aggressive focus on the individual service and a lack of real understanding of the big picture. There is a general lack of information on what other services are doing and because of this, any weakness in the focus on a single service can lead to breakdown of the security in general and, in basketball terms, an easy lay-up.
Zone Cloud Security primarily revolves around the frameworks in place for infrastructure deployed to support a wide variety of services. We still see organizations bringing the rigid security frameworks utilized for years in brick and mortar data centers and trying to apply them to Cloud Security. Deployed like a 2-3 zone in basketball, the defensive posture is to watch a specific area of the infrastructure and report back to a central service for monitoring and support. As information travels through the zone, communication is critical to ensure nothing gets lost in the shuffle. Each position in the zone is devoted to a specific task supporting a number of different services including both perimeter and core defense. The disadvantage with any zone defense is the gaps and in the public cloud space, gaps are appearing every day.
Server-less architectures are an exciting approach to utilizing the true power of elastic capacity while providing developers easier and easier ways to deploy features to production environments. However, in reducing the amount of infrastructure under direct monitoring the threat surface area is increasing at an equal rate. As any basketball coach will tell you, the easiest way to defeat a zone defense is by moving the ball and attacking the gaps in the zone. Another easy lay-up.
Trility takes a different approach to Cloud Security: the pack line.
Pack Line Defense, created by Dick Bennett of Wisconsin-Stevens Point, is commonly used in some form by many coaches including Tom Izzo at Michigan State and Tony Bennett at Virginia. It is a variation of man-to-man defense with the biggest difference being off-ball defenders play in the gap instead of pressuring their player and denying the pass. Everyone except the player guarding the ball plays inside an imaginary line 16 feet from the rim also known as the pack line. As the ball moves around the perimeter, it is the responsibility of each defender to close out on the ball and aggressively pressure while the remaining defenders adjust their position accordingly to see both man and ball and prepare to help their teammates – 5 against the ball.
Cloud Security is everyone’s responsibility and while we are aggressively providing man-to-man defense on the active products, the rest of the team is continuously adjusting to find and fill gaps in the defensive strategy. We react to changing conditions and close out on threats while keeping business goals front of mind.
The ephemeral and elastic nature of the public cloud along with software defined infrastructure and platforms provide an opportunity for service specific architectures. Trility utilizes two patent pending tools to help provide high quality customized security for cloud services: IronBench Compliance Navigator and IronBench Cloud Config.
IronBench Compliance Navigator empowers organizations to develop highly customized compliance guidelines for products and services. Throughout the product lifecycle, IronBench Compliance Navigator uses standards and regulatory information updated as regulatory compliance laws and standards change to provide a solid foundation for product development teams.
IronBench Cloud Config is an enterprise framework and provides the source code for the entire implementation. Product teams can utilize a customizable secure framework based on industry standards and practices on which to build secure supporting infrastructure. Compliance Navigator helps you aggressively challenge the ball handler while Cloud Config supports the team by helping them adjust to changing product needs efficiently and securely working from a library of standards based templates.
On Wednesday, May 24th, 2018 Dynamo, LLC and Trility Consulting, LLC announced the launch of their strategic alliance, bringing together two emerging leaders in the technology services industry. The partnership between these two companies represents an intersection between the strategic consulting, product delivery services, behavioral and engineering guidance that Trility offers combined with the high-quality, high-capacity recruiting and flexible resourcing solutions that Dynamo brings to the venture. Together, Dynamo and Trility create a powerful partner for companies facing significant business and technology challenges or embarking on or amidst a digital transformation journey.
About Dynamo, LLC
Founded in 2014 with a focus on redefining an industry, Dynamo is a technology consulting and recruiting services company headquartered in Omaha, NE. Dynamo is a new model for what technology consulting and recruiting should be: focusing quality over quantity, valuing people over transactions, and getting it right the first time. Their talent networks extend into agile software development, information security, data and analytics, mobile, and cloud focus areas. Dynamo serves customers in Iowa, Colorado, Nebraska, Texas, and Tennessee. To learn more, visit their website at www.godynamo.co
About Trility Consulting, LLC
Headquartered in Urbandale, Trility is a people-first, full-spectrum solutions company focused on helping customers and partners enjoy success with today’s digital transformation needs. From cloud adoption, migration, implementation and evolution to continuous cyber-security solutions and full-stack application and systems development, their focus is understanding customer needs, providing customers multiple options and implementing solutions that constantly enable the ability to change as their needs change. Trility is a certified AWS Consulting Partner, and a partner/re-seller of Ironbench products which include secure enterprise cloud adoption, Linux security and regulatory compliance adoption solutions. To learn more, visit their website at www.trility.io
Through the partnership of Dynamo, Trility Consulting and IronBench, we provide our customers the right combination of people, skills, products and services in a way that no other individual company can bring to the table.
For inquiries about how Dynamo and Trility can help your organization, contact either Dynamo or Trility representatives today to start a conversation.
Trility Consulting and IronBench have signed paper for Trility Consulting to sell the IronBench security suite of products and offer professional services as well!
IronBench of Des Moines, Iowa, launched in January 2017, is a product company focused on cloud adoption, cloud operations and cloud-focused information security and regulatory compliance behaviors.
IronBench offers three products designed to help companies securely adopt and evolve cloud ecosystems (IronBench Cloud Config), securely manage Linux assets (IronBench Access Manager) and understand organizational regulatory and compliance status in relation to pertinent industry standards (IronBench Compliance Navigator).
Trility Consulting, also of Des Moines, Iowa, is a professional services company focused on discovering what goals customers would like to achieve and then helping them get there through lean, continuous delivery behaviors.