Converge Detroit 2018

1. Don’t Fear the Cloud
Secure Solutions at Lower Cost

2. Matt Newell
@matthewnewell
matt@newell.cloud
● 20-year software engineer & architect
● AWS Certified Solutions Architect
● SkySync
● AWS Consulting Practice

3. 92%
… of business utilize public cloud services

4. 74%
… of tech leaders have security concerns with public cloud services

5. Reduce the Fear Factor
● How public is the public cloud?
● On-prem vs IaaS vs PaaS vs Serverless
● Control via Encryption
● Going Global
● Cost

6. Operational Efficiency
is a Defense

7. “Public” Cloud?

8. Public Cloud
● Amazon Web Services
● Google Cloud Platform
● Microsoft Azure
Private Cloud
● On-Premise
● VMware vSphere / vCloud
● Not really cloud
vs

9. Public Park?

10. Or Public Storage?

11. Shared Responsibility
Model

12. Public Storage

13. Architecture Model
Application
Runtime
OS
Hypervisor
Network
Storage
Facility
Database
Your code, or off-the-shelf product
Java, .NET, Ruby
Windows, Linux
VMWare, Hyper-V
Routers, Switches
Storage Area Network, Disks, Backplanes
Key Cards, Alarm, Security Guards
SQL Server, Oracle, MySQL

14. Who’s Responsible On-Prem
Application
Runtime
OS
Hypervisor
Network
Storage
Facility
Database

15. On-Prem
Application
Runtime
OS
Hypervisor
Network
Storage
Facility
Database

16. On-Prem Cloud
Application
Runtime
OS
Hypervisor
Network
Storage
Facility
Database
Application
Runtime
OS
Hypervisor
Network
Storage
Facility
Database

17. On-Prem Cloud
Application
Runtime
OS
Hypervisor
Network
Storage
Facility
Database
Application
Runtime
OS
Hypervisor
Network
Storage
Facility
Database

18. Control vs Trust
Do more with less

19. IaaS vs PaaS
Infrastructure as a Service
● Building blocks of the cloud
● VMs and Storage
● AWS EC2 & S3
● Most similar to data center
Platform as a Service
● Managed Services
● Databases or Cache
● On-prem MySql vs Amazon RDS
● On-prem Memcached vs AWS
ElastiCache
● Minor architectural adjustments

20. On-Prem IaaS
Application
Runtime
OS
Hypervisor
Network
Storage
Facility
Database
Application
Runtime
OS
Hypervisor
Network
Storage
Facility
Database

21. On-Prem IaaS
Application
Runtime
OS
Hypervisor
Network
Storage
Facility
Database
Application
Runtime
OS
Hypervisor
Network
Storage
Facility
Database
PaaS
Application
Runtime
OS
Hypervisor
Network
Storage
Facility
Database

22. Serverless
● Extreme PaaS
● Cloud runs application code directly
● Only responsible for securing code
● AWS Lambda
● Significant re-architecture
● HOT TOPIC

23. On-Prem IaaS
Application
Runtime
OS
Hypervisor
Network
Storage
Facility
Database
Application
Runtime
OS
Hypervisor
Network
Storage
Facility
Database
PaaS
Application
Runtime
OS
Hypervisor
Network
Storage
Facility
Database
Serverles
sApplication
Runtime
OS
Hypervisor
Network
Storage
Facility
Database

24. But I’m low on trust!

25. Encryption Everywhere - S3
● Server Side Encryption
○ S3-Managed Keys
○ KMS-Managed Keys
○ Customer Provided Keys
● Client Side Encryption
○ AWS SDK
● AES-256

26. S3: Efficiency Sidebar
● 11-nines durability (99.999999999%)
● Store 100 billion objects (files) without loss
● Designed to withstand the loss of 2 data centers
● Infinitely scalable

27. Encryption Everywhere - EC2
● One-Click Full Disk Encryption
● Data encrypted at rest ...
● … and moving to and from the VM
● AES-256

28. Encryption Everywhere - RDS
● One-Click Full Database Encryption
● Data encrypted at rest
● Data in motion depends on implementation
● AES-256

29. When to Encrypt?

30. Going Global

31. Start over? 2x effort.
Application
Runtime
OS
Hypervisor
Network
Storage
Facility
Database

32. Globally Homogenous
AWS Regions behave the same
● Same tools
● Same infrastructure
● Same patch levels
● Mostly

33. Cost
Zip. Zilch. Zero.

34. What do we know?
● Public isn’t public
● PaaS > IaaS > On-Prem
● Encryption is good
● Go global quickly
● Zero marginal cost

35. THANKS!
@matthewnewell
matt@newell.cloud