This document discusses security and cloud adoption for enterprises. It covers introducing Amazon Web Services (AWS) and Cloudreach, an overview of the cloud security market, building a business case for cloud adoption, and how Cloudreach helped Warner Music Group secure their AWS environment. The presentation outlines Cloudreach's cloud adoption framework and key pillars including operations, security, visibility, and governance. It then discusses how Cloudreach worked with Warner Music Group to implement a comprehensive cloud security program across infrastructure, applications, identity and access management, data security, and more.

1. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Tom Ray, Global Head of Cloud Enablement
Stew Katz, SVP, Engineering & User Experience
Security & Cloud Adoption for the Enterprise.
Not If. When
Warner Music Group & Cloudreach

2. AGENDA
• Introductions (Tom & Stew)
• View of the market
• Building the business case?
• Where do you start?
• AWS Cloud Adoption Framework (CAF)
• How did we do it? (Stew)
• Wrap up and Q&A

3. VIEW OF THE MARKET

4. It’s been a busy 12 months
● 1st Chicago AWS Summit
12 months ago
● Cloudreach >250 staff,
including building out our
Chicago office
● More ‘traditional
businesses’ moving to the
Cloud
● Broadening of scope of
our engagements
● Distinct split between
bimodal workloads
○ mode 1 - traditional
enterprise workloads
○ mode 2 - agile,
revenue generating

5. Building the Business Case
Mode 1
● Non-differentiating
workloads
● Shutdown data centers
● Cutting costs
Mode 2
● Enabling innovation
● Moving fast with agility
● Focus on generating
new revenues

6. WHERE DO YOU START?

7. Cloudreach Competencies
LinesofBusiness
Cloud
Platform
Cloud
Operations
Cloud
Enablement
Keycompetencies
Cloud Data Center
High velocity data center
transformation for large enterprises
Application Innovation
Turnkey re-platform, re-architecture
and operations of mission critical
workloads
e-Commerce
Re-platform and operate
e-commerce sites with
large transactional
revenue
Digital Estates
Orchestration and DevOps
of digital platforms to
improve agility and release
velocity
Data Analytics
Creation, optimisation and
operation of analytical
platforms utilising IaaS
value-added features
Cloud Adoption
Deep domain expertise managing complex
enterprise cloud adoption programmes
Cloud Service Line
Portal-based access to environments for rapid deployment
of standard packages (e.g. web hosting)

8. AWS Cloud Adoption Framework
A core framework for Cloud delivery
Cloud adoption is more than a
migration, it’s a major
transformation in how IT
supports business customers.
People
Perspective
Process
Perspective
Security
Perspective
Maturity
Perspective
Platform
Perspective
Operating
Perspective
Business
Perspective

9. ● Core Cloudreach competency
● All customers need it
● Includes the practical steps to deploy the CAF 7 perspectives
● Complete in parallel with your projects
● Prioritize
● Ongoing process
● Unique to your organization
Cloud Adoption

10. To make the CAF easy to transpose onto
your organization, Cloudreach has mapped
this onto 4 pillars.
Cloudreach has comprehensive offerings
for each, they include our methodologies,
tooling, materials and services.
Cloud Strategy
Business Architecture
Security
Operations
Governance
Visibility
Amazon Web Services
Key Pillars to your Cloud Adoption Program

11. ● Operations - operational aspects of running
a cloud environment as peak efficiency.
● Security - securing your cloud environment
through new and existing controls.
● Visibility - understand what is happening in
your cloud environment and applications.
● Governance - guardrails to help provide
guidance.
All four pillars, with the right business
architecture, are required to embrace a
successful cloud first strategy.
Cloud Strategy
Business Architecture
Security
Operations
Governance
Visibility
Amazon Web Services
Key Pillars to your Cloud Adoption Program

12. Cloud Strategy
Business Architecture
Security
Operations
Governance
Visibility
Amazon Web Services
Cloudreach’s Cloud Security
Framework
Key Pillars to your Cloud Adoption Program

13. WARNER MUSIC GROUP
How we secured it!
Stew Katz, SVP Engineering & User Experience

14. …then things changed
We were there already…
New development platform on AWS
Running important but not critical workloads
Gone through architectural review with AWS
Comfortable with our security posture

15. - Max, Strange Days
The issue is not whether you
are paranoid,
the issue is whether you are
paranoid enough.

16. …which leads to...
Information
Security
Culture clash...
DevOps Network
Operations
Engineering

18. What we did next…
Went to re:Invent
Got some recommendations from our relationship manager
Spent time with the shared security model slide...

19. This is great...
…but...

21. ...we called uncle
After two months…
● We spoke to lots of vendors
● We learned a lot
● To us, no clear pattern emerged

22. And changed our direction…
Got more recommendations from our relationship manager
Narrowed it down to two Premiere Partners
And we said, “Please help us solve this puzzle”

23. INFRASTRUCTURE
OS
APPLICATION
IDS/IPS
Firewalls
ACLs
NACLs
Proxies
Vulnerability
Assessments
Application
Security
Code
Deployment
Penetration
Testing
Vulnerability
Assessments
AWS Identity and
Access
Management (IAM)
IAM
& MFA
Data
Security
Encryption
& AWS KMS
Authentication
& Authorization
Logging
& Monitoring
Endpoint
Security
Patch
Management
Vulnerability
Assessments
IAM
Encryption
& KMS
Privileged
Access
Logging
& Monitoring
AWS stack meets security issues

24. Questions?