Thursday, December 26th, 2013

Time	Event
1:30p	2014 Data Center Resolutions: Make ‘em Count and Make ‘em Last Aaron Rallo is the founder and CEO of TSO Logic. Aaron has spent the last 15 years building and managing large-scale transactional solutions for online retailers, with both hands-on and C-level responsibility in data center s around the world. AARON RALLO TSO Logic The truth about resolutions, as I’m sure we are all too familiar, is that most of them just don’t last. And as many studies have pointed out, the best way for a resolution to work is to make them measurable. Sound familiar? With this in mind, how do we craft a set of New Year’s resolutions for our data centers that will endure, and actually help to transform operations for the better? It’s actually getting easier. In the next few years, data centers are expected to shift the focus of many of their investments from hardware to a new breed of software that is enabling more intelligent analytics and decision making. Virtualization, infrastructure management, application-level insight, and intuitive power control are all software options that can significantly improve your operations and eliminate unnecessary energy costs. Using this software, data centers can look to improve the operational efficiency of their data centers by discovering some revealing facts. Let’s start by looking back at the tools that you used over the last 12 months to measure your data center ’s performance. Do they give you all the answers you need to run your business? Are you tracking workload and server metrics in a way that relates to your business and are these KPI’s shared with your executive team? If not, then maybe it’s time to consider these resolutions for the coming New Year. More specifically, let’s take a look at how this software, along with measuring some important metrics in your data center, can keep you on track to meeting these 2014 resolutions. Resolution: Review Past Performance to Improve for the Future Take a look back over the last 12 months of your workload logs and find your busiest hour. How well did your applications and servers perform? Did you maintain your SLA’s? Do you have these capabilities? This is an important step. Establishing a baseline and identifying where and when you lag best practices or support for critical SLAs will help you identify specific goals (or resolutions as the case may be) for the coming year. Resolution: Commit to Measuring and Managing Your Capacity and Energy Consumption Measuring and managing data center capacity and energy consumption can now be done with great detail, and this process can be transformational for your data center. Here are some specific recommendations for KPIs that can be shared with the executive team. Eliminate Waste from Idle and Comatose Servers – Safely identify and power down or eliminate servers that are doing no work. Know exactly how much is being spent on energy for idle and comatose servers. Identify opportunities for further virtualization or replacement of legacy servers with more efficient new technology. Relate Workload and Server Performance to Your SLAs – Trend workload and server performance statistics and relate them back to your critical service level agreements. Create an energy management strategy that includes power prioritization based on your critical SLAs. Examine Transactional Costs – Measure your individual transaction costs and even track by the type of transaction. Align these costs with your broader business objectives and track carbon emissions per transaction for broadcasting your sustainability programs. Resolution: Commit to Using Real Data that Link Data Center Costs to All of Your Applications Your data center contains a cache of real analytics that provide deeper value than just energy and operational savings. These analytics can be combined with other enterprise level business intelligence to enhance your strategic planning and operational processes. Better understand your power costs and relate them specifically to the applications you are running in your data center . Tie these costs back to your business to strategically manage your product offerings with an eye toward your top and bottom line. Identify opportunities to shift capacity or trim some fat out of your costs. Resolution: Enjoy the Results 2014 can be the year when the status of your data center is elevated from a cost center to an active participant in the corporate strategic planning process. With these software-based monitoring and power management tools, business leaders can now get the answers they need to better understand data center growth, plan capacity additions and CAPEX, and allocate costs more appropriately and definitively. This can be your year to shine. Make your resolutions count with measurable and achievable goals. Best wishes for a successful New Year! Industry Perspectives is a content channel at Data Center Knowledge highlighting thought leadership in the data center arena. See our guidelines and submission process for information on participating. View previously published Industry Perspectives in our Knowledge Library. (Comment on this)
2:00p	Cloud Security: An Interview with a Professional White Hat Security has always been a major concern in cloud computing The amount of information current traversing the cloud continues to grow. We’ve crested the zettabyte threshold and continue to push even more data, applications and workloads through a cloud model. As with anything in technology, the more users on the platform, the bigger the target becomes. Security has always been a major concern in cloud computing. The transmission of valuable data, the increased utilization of WAN resources and the growth of device connectivity are all pushing the boundaries of how we compute. There have been many discussions around cloud computing and security concepts. Today’s conversation is different. I’ve known this security professional for many years. Due to the very sensitive nature of his work, he’ll only be identified as Alex. He has worked with Fortune-sized organizations, conducted massive security tests, and has been hired to conduct intricate penetration tests to verify complex security capabilities. In short, he is very good at what he does, and is one of the good guys. He and his organization work with some of the latest security and cloud concepts currently on the market. Recently, I asked him to sit down with me for a brief conversation around some of the finer mechanics around cloud security. <cloudStuff> Bill: Alex, from your perspective. give me a few thoughts on cloud computing, what’s happening with user security, and some overall concerns when it comes to the cloud. Alex: From a strictly usability perspective, cloud computing is great (although nothing new). You are basically paying for only the things which you need, and you are able to get them and release them very quickly. Again, nothing new. I would break down security concerns into the following: You’re trusting somebody else with your data You’re running on untrusted systems Your data is accessible over the Internet Bill: That’s a great starting point. Could we dive into that a bit? When it comes to cloud, what is the major first issue that many organizations just seem to have a problem overcoming? Alex: First, you’re trusting somebody else with your data. It’s pretty self-explanatory, but basically you are taking what is presumably private and/or proprietary data and putting somebody in charge of it. This is as true with Amazon as it is with Google. As an individual or organization, you have no means of confirming the infrastructure and application safeguards that are in place or even how to respond to law enforcement requests for data. What if there’s a janitor working in your provider’s data center that secretly works for the PLA? Bill: PLA, As in the People’s Liberation Army (China’s armed forces). Advanced Persistent Threats (APTs) against the data center have certainly grown. We’re seeing new types of attacks against specific resources inside of a data center. Have you been seeing security threats like these? Alex: Absolutely, Google may have a public data usage policy, but what happens when they get breached? Which brings up the question: once you’ve put your data into the cloud, how can you confirm that the data is the same when you pull it back out? Beyond the confidentiality and integrity of your data, reliability may also be a security concern in some applications (i.e. if your data isn’t available, the company loses money). This was the case with Netflix when an EC2 outage took them offline last Christmas Eve. Bill: Another thing you mentioned was hosting data on systems which were potentially untrusted. Can you elaborate? Alex: While some cloud providers allow you to build your own systems, the majority of these kinds of offerings focus on pre-built images for rapid development, many of which are built by the community (I’m thinking of EC2 here). Just to reiterate, you’re potentially trusting your data on a server that some random IT admin built on the Internet. Let me give you an example. A friend of mine ran an experiment as a part of some research he was working on. He built an Amazon Machine Image (AMI) of a popular penetration testing platform, which was previously unavailable on EC2. One of his additions to the AMI was a backdoor which would basically just communicate back to his own server, indicating that somebody had turned on his backdoored instance. He could have just as easily built a reverse shell into the image (a link to the video: This particular process comes at the end, but the beginning research is also good). Beyond backdoored AMI instances, at the end of the day, you are using a server that is most certainly accessible at a low level by your provider (root access or equivalent). This basically comes back around to the discussion of data security, as all of your encryption keys, VPN configurations, and potentially passwords are protected by unknown controls, which are of unknown resiliency. As Dave Aitel posed in a recent Daily Dave post, how do you protect the security of your virtual servers when your provider transfers them over Internet links which are tapped by foreign governments? What keeps the people running/monitoring the Internet from flipping bits in your systems? Bill: That’s certainly an important thought to consider. You brought up a final point – the fact that cloud computing is basically the dynamic delivery of information over the Internet. What do organizations need to really understand around this? Alex: You’re making your data accessible over the internet, sometimes for the entire world to access. Your servers and/or data may very well be publicly accessible (which may or may not be what you actually wanted). Content Delivery Network (CDN) storage is great, but I have assessed many applications where data protection API’s were either inadequate or were used incorrectly. This would basically lead to a loss of sensitive/proprietary data. A couple of years ago, I saw a talk detailing a common misconfiguration in Amazon S3 buckets which lead to a lot of personal user data being publicly indexed and accessible. Again, this comes back around to putting your stuff on an unfamiliar, untrusted system and potentially not knowing how it works. Bill: Given the still-dynamic world of both cloud computing and the technologies surrounding the platform, organizations have to be extra careful with their data. The rapid pace of cloud adoption clearly shows there is a good place for this technology. So what would you recommend that organizations do moving forward? What can they do to better protect their data? Alex: As far as what I would recommend, I would say to try and stay away from cloud computing for critical security applications, and to divorce it from operational corporate data whenever possible. For example, don’t query (or replicate) your internal databases over the Internet to/from your cloud services. Also, use encryption where it makes sense. Encrypt data-at-rest, and ensure that data-in-transit is tunneled using some industry standard like TLS or SSH. Another suggestion (which is not limited to cloud computing), audit as many things as possible. If your cloud provider gives you logs, suck them into your security information and event management system (SIEM), figure out what normal behavior is, and then investigate anomalies. And as a final suggestion, go with reputable cloud providers. People seem to be in love with the idea of adopting buzzword technologies for no apparent reason. That, coupled with the cost savings that it provides, has new cloud services popping up daily. Your best bet with choosing the right vendor is probably their reputation, so try not to get swept up by promises from the sexiest new startup. Along with that, read your contract and try to understand what guarantees the provider gives you on the security of your data. </cloudStuff> Cloud security and data integrity are major concerns for any organization looking to utilize cloud services. New threats and even unknown surveillance programs can all cast potential shadows in cloud infrastructure confidence. Still, just like any technology, there will be road bumps that will need to be smoothed over. Security is certainly one of those bumps. Already we’re seeing more reputable cloud providers offering great services which are PCI/DSS, HIPAA and even FedRAMP government compliant. There’s no question that the user and corporate compute model has changed. New devices and new services are all changing the way we consume data, workloads, and applications. Security will always be a major part of the delivery process. Cloud computing certainly creates new types of targets and potential new threats. However, with proactive design methodologies and good security best practices, your organization can work to stay ahead in the cloud computing world. (Comment on this)

<< Previous Day

2013/12/26 [Calendar]

Next Day >>