Founded 1997
2 million developers, 97% of Fortune 1000
Development, management, distribution & cloud deployment for dynamic languages
Drivers for Cloud Computing US Patriot Act & Data Privacy
Savings of physical IT costs Faster Deployment Times
Higher Levels of Application Availability Reliability & Fault Tolerance
Access Anywhere
Maintain privacy & confidentiality Preserve intellectual property rights
Potential for intervention by foreign governments Manage operational & commercial risks
Information is
no longer in your direct custody or control.
handed over to a third party to manage
resident in a different jurisdiction or multiple jurisdictions
Mass-market cloud services are subject to “take it or leave it” service agreements
Signed into law in October 2001
Extended in May 2011
grants privileges to access private data in case of suspected terrorist threats
New powers of surveillance and search/seizure extend to records of anyone (including Foreign Nationals) in the US.
Extends to records in the custody of
US companies in Foreign Countries
Cloud Computing is premised
on the concept of infrastructure pooling regardless of geographic location.
Users may not
have visibility in relation to the ultimate location of data.
Data may not
in fact be pooled in one place
Data that is housed or passes through the United States is vulnerable to interception by authorities
applies to:
Everyone living and visiting the country, including any foreign national who spends time on U.S. soil as part of a visa
arrangement.
BBC Worldwide HQ in London
also has studios and offices in the U.S
National Security Letters
can involve a gag order
prevents the organization from ever disclosing receipt of a letter requiring the handover of
records.
Vendors cannot provide a guarantee that their customers would be informed
Regulators
may restrict the
international transfer of certain kinds of data, even require certain
kinds of data to be kept separate and not be
MSFT could not guarantee the sovereignty of European customers’ data in its data centers
If the US Patriot Act was invoked,
MSFT would be compelled to hand data over to US authorities and would keep the data transfer secret
This contravenes the new EU Data Protection Directive which requires organizations to inform users when
personal information is disclosed
CEO, Reinhard Clemens
"The Americans say that no matter what happens I'll release the data to the government if I'm forced to do so, from anywhere in the world, certain German companies don't want others to access their systems. That's why we're well-positioned if we can
Remains responsible for protecting and safeguarding information
Needs to make informed choices
Take be a risk-based approach
What is the sensitivity of the information? What is the risk to the data?
What role does the jurisdiction play in that risk?
Own the infrastructure Run your own cloud in your data center
Host your own services Minimize the number of layers between you and the NSL
Minimizes US Patriot Act
Keep all your data within your own firewalls
Avoids the Gag Issue
If the US Gov’t wants information – they have to ask you, not some cloud provider
Keep all your data within secure containers
Multi-tenancy Security by Isolation
Ensure Privacy within your organization
Encrypt your data when you transmit it beyond your firewalls
Greater oversight & control Maintaining security of data
Greater control over computational resources Exclusive to an organization
Applications (SaaS)
Application Middleware/Platform (PaaS)
IaaS Layer:
Gives you an Elastic Playground Pooled Resourcing
Shared Operating System Shared Services
Security by
PaaS Layer:
gives your applications individual Playgrounds
Everyone gets their own Operating system No Shared Services
Applications need more than just infrastructure!
Applications Need Secure Environments
Applications need middleware components: languages, modules, databases, web servers Apps don’t deploy themselves
A PaaS automatically configures and deploys the middleware,
Maintain accountability and ensure security
Keep your & your clients’ data private & secure Ensure that you are notified requests for
information based US Patriot Act
Still get all the benefits of cloud (elasticity, pooling resources within your organization, with faster
time-to-market) on a private cloud
Hybrid Clouds Private Clouds
Your App
www.activestate.com/cloud
Twitter: @activestate (#stackato)
Blog: www.activestate.com/blog
Email: [email protected]
