Difference between revisions of "LII:Choosing and Implementing a Cloud-based Service for Your Laboratory"
Shawndouglas (talk | contribs) m (Tweaks) |
Shawndouglas (talk | contribs) |
||
(6 intermediate revisions by the same user not shown) | |||
Line 1: | Line 1: | ||
[[File:Cloud | [[File:Cloud computing icon.svg|right|400px]] | ||
'''Title''': ''Choosing and Implementing a Cloud-based Service for | '''Title''': ''Choosing and Implementing a Cloud-based Service for Your Laboratory'' | ||
'''Edition''': | '''Edition''': Second edition | ||
'''Author for citation''': Shawn E. Douglas | '''Author for citation''': Shawn E. Douglas | ||
Line 8: | Line 8: | ||
'''License for content''': [https://creativecommons.org/licenses/by-sa/4.0/ Creative Commons Attribution-ShareAlike 4.0 International] | '''License for content''': [https://creativecommons.org/licenses/by-sa/4.0/ Creative Commons Attribution-ShareAlike 4.0 International] | ||
'''Publication date''': August | '''Publication date''': August 2023 | ||
This guide examines the state of [[cloud computing]] and the security mechanisms inherent to it, especially in regards to how it relates to today's [[Laboratory|laboratories]]. While cloud computing and cloud-based applications can enhance the activities of many types of labs, a methodical and meticulous approach to [[cybersecurity]] is required to not only get the most out of a cloud solution but also mitigate future data catastrophes. This means understanding [[risk management]], regulatory considerations, deployment approaches, and the potential value of managed security services in the cloud. Additionally, the essential links between laboratory [[quality assurance]], the shared responsibility model, and cybersecurity in the lab are emphasized. Of course, it's also vital to understand what to look for in cloud providers, as well as how to approach finding them. In that regard, this guide adds value by more closely examining major public/hybrid cloud and managed security service providers (Appendix 1 and 2), as well as providing example request for information (RFI) templates for both provider types (Appendix 3). While this guide can prove useful to even non-laboratory organizations looking to dip into cloud services, it focuses heavily on laboratories implementing and updating information systems in the cloud. | This guide examines the state of [[cloud computing]] and the security mechanisms inherent to it, especially in regards to how it relates to today's [[Laboratory|laboratories]]. While cloud computing and cloud-based applications can enhance the activities of many types of labs, a methodical and meticulous approach to [[cybersecurity]] is required to not only get the most out of a cloud solution but also mitigate future data catastrophes. This means understanding [[risk management]], regulatory considerations, deployment approaches, and the potential value of managed security services in the cloud. Additionally, the essential links between laboratory [[quality assurance]], the shared responsibility model, and cybersecurity in the lab are emphasized. Of course, it's also vital to understand what to look for in cloud providers, as well as how to approach finding them. In that regard, this guide adds value by more closely examining major public/hybrid cloud and managed security service providers (Appendix 1 and 2), as well as providing example request for information (RFI) templates for both provider types (Appendix 3). While this guide can prove useful to even non-laboratory organizations looking to dip into cloud services, it focuses heavily on laboratories implementing and updating information systems in the cloud. | ||
The | The second edition of this guide updates grammar and phrasing, tweaks a variety of historical statistics, tweaks information about container security, updates a few trends in hybrid and multicloud, updates information about cybersecurity insurance for cloud, updates information about the DoD JEDI project and the replacement JWCC project, and adds a subsection to Chapter 1 about edges and edge computing. | ||
The table of contents for ''Choosing and Implementing a Cloud-based Service for Your Laboratory'' is as follows: | |||
1. [[LII:Choosing and Implementing a Cloud-based Service for | |||
1. [[LII:Choosing and Implementing a Cloud-based Service for Your Laboratory/What is cloud computing?|What is cloud computing?]] | |||
:1.1 History and evolution | :1.1 History and evolution | ||
Line 22: | Line 24: | ||
::1.2.1 Platform-as-a-service vs. serverless computing | ::1.2.1 Platform-as-a-service vs. serverless computing | ||
::1.2.2 Hybrid cloud vs. multicloud vs. distributed cloud | ::1.2.2 Hybrid cloud vs. multicloud vs. distributed cloud | ||
::1.2.3 Edge computing? | |||
:1.3 The relationship between cloud computing and the open source paradigm | :1.3 The relationship between cloud computing and the open source paradigm | ||
2. [[LII:Choosing and Implementing a Cloud-based Service for | 2. [[LII:Choosing and Implementing a Cloud-based Service for Your Laboratory/Standards and security in the cloud|Standards and security in the cloud]] | ||
:2.1 Standards and regulations influencing cloud computing | :2.1 Standards and regulations influencing cloud computing | ||
Line 34: | Line 37: | ||
::2.2.5 Software as a service | ::2.2.5 Software as a service | ||
3. [[LII:Choosing and Implementing a Cloud-based Service for | 3. [[LII:Choosing and Implementing a Cloud-based Service for Your Laboratory/Organizational cloud computing risk management|Organizational cloud computing risk management]] | ||
:3.1 Five risk categories to consider | :3.1 Five risk categories to consider | ||
Line 40: | Line 43: | ||
:3.3 A brief note on cloud-inclusive cybersecurity insurance | :3.3 A brief note on cloud-inclusive cybersecurity insurance | ||
4. [[LII:Choosing and Implementing a Cloud-based Service for | 4. [[LII:Choosing and Implementing a Cloud-based Service for Your Laboratory/Cloud computing in the laboratory|Cloud computing in the laboratory]] | ||
:4.1 Benefits | :4.1 Benefits | ||
Line 47: | Line 50: | ||
::4.3.1 Hybrid cloud, multicloud, and the vendor lock-in conundrum | ::4.3.1 Hybrid cloud, multicloud, and the vendor lock-in conundrum | ||
5. [[LII:Choosing and Implementing a Cloud-based Service for | 5. [[LII:Choosing and Implementing a Cloud-based Service for Your Laboratory/Managed security services and quality assurance|Managed security services and quality assurance]] | ||
:5.1 The provision of managed security services | :5.1 The provision of managed security services | ||
Line 57: | Line 60: | ||
::5.3.1 Using a request for information (RFI) process | ::5.3.1 Using a request for information (RFI) process | ||
6. [[LII:Choosing and Implementing a Cloud-based Service for | 6. [[LII:Choosing and Implementing a Cloud-based Service for Your Laboratory/Considerations when choosing and implementing a cloud solution|Considerations when choosing and implementing a cloud solution]] | ||
:6.1 What are the various characteristics of an average cloud provider? | :6.1 What are the various characteristics of an average cloud provider? | ||
Line 66: | Line 69: | ||
::6.4.1 Using a request for information (RFI) process | ::6.4.1 Using a request for information (RFI) process | ||
7. [[LII:Choosing and Implementing a Cloud-based Service for | 7. [[LII:Choosing and Implementing a Cloud-based Service for Your Laboratory/Final thoughts and additional resources|Final thoughts and additional resources]] | ||
:7.1 Final thoughts | :7.1 Final thoughts | ||
Line 97: | Line 100: | ||
:[[BT Cyber Security Platform]] | :[[BT Cyber Security Platform]] | ||
:[[Cisco Cloudcenter and UCS Director|Cisco Active Threat Analytics]] | :[[Cisco Cloudcenter and UCS Director|Cisco Active Threat Analytics]] | ||
:[[Cyderes Managed Services]] | |||
:[[Foresite Managed Cybersecurity]] | :[[Foresite Managed Cybersecurity]] | ||
:[[IBM Cloud|IBM Managed Security Services]] | :[[IBM Cloud|IBM Managed Security Services]] | ||
:[[NTT Managed Security Services]] | :[[NTT Managed Security Services]] | ||
Line 109: | Line 112: | ||
Appendix 3. RFI questions for cloud providers and MSSPs | Appendix 3. RFI questions for cloud providers and MSSPs | ||
:[[LII:Choosing and Implementing a Cloud-based Service for | :[[LII:Choosing and Implementing a Cloud-based Service for Your Laboratory/RFI questions for cloud providers|RFI questions for cloud providers]] | ||
:[[LII:Choosing and Implementing a Cloud-based Service for | :[[LII:Choosing and Implementing a Cloud-based Service for Your Laboratory/RFI questions for MSSPs|RFI questions for MSSPs]] | ||
<!---Place all category tags here--> | <!---Place all category tags here--> | ||
[[Category:LII:Guides, white papers, and other publications]] |
Latest revision as of 22:59, 19 June 2024
Title: Choosing and Implementing a Cloud-based Service for Your Laboratory
Edition: Second edition
Author for citation: Shawn E. Douglas
License for content: Creative Commons Attribution-ShareAlike 4.0 International
Publication date: August 2023
This guide examines the state of cloud computing and the security mechanisms inherent to it, especially in regards to how it relates to today's laboratories. While cloud computing and cloud-based applications can enhance the activities of many types of labs, a methodical and meticulous approach to cybersecurity is required to not only get the most out of a cloud solution but also mitigate future data catastrophes. This means understanding risk management, regulatory considerations, deployment approaches, and the potential value of managed security services in the cloud. Additionally, the essential links between laboratory quality assurance, the shared responsibility model, and cybersecurity in the lab are emphasized. Of course, it's also vital to understand what to look for in cloud providers, as well as how to approach finding them. In that regard, this guide adds value by more closely examining major public/hybrid cloud and managed security service providers (Appendix 1 and 2), as well as providing example request for information (RFI) templates for both provider types (Appendix 3). While this guide can prove useful to even non-laboratory organizations looking to dip into cloud services, it focuses heavily on laboratories implementing and updating information systems in the cloud.
The second edition of this guide updates grammar and phrasing, tweaks a variety of historical statistics, tweaks information about container security, updates a few trends in hybrid and multicloud, updates information about cybersecurity insurance for cloud, updates information about the DoD JEDI project and the replacement JWCC project, and adds a subsection to Chapter 1 about edges and edge computing.
The table of contents for Choosing and Implementing a Cloud-based Service for Your Laboratory is as follows:
- 1.1 History and evolution
- 1.2 Cloud computing services and deployment models
- 1.2.1 Platform-as-a-service vs. serverless computing
- 1.2.2 Hybrid cloud vs. multicloud vs. distributed cloud
- 1.2.3 Edge computing?
- 1.3 The relationship between cloud computing and the open source paradigm
2. Standards and security in the cloud
- 2.1 Standards and regulations influencing cloud computing
- 2.2 Security in the cloud
- 2.2.1 The shared responsibility model
- 2.2.2 Public cloud
- 2.2.3 Hybrid cloud and multicloud
- 2.2.4 Container security and other concerns
- 2.2.5 Software as a service
3. Organizational cloud computing risk management
- 3.1 Five risk categories to consider
- 3.2 Risk management and cybersecurity frameworks
- 3.3 A brief note on cloud-inclusive cybersecurity insurance
4. Cloud computing in the laboratory
- 4.1 Benefits
- 4.2 Regulatory considerations
- 4.3 Deployment approaches
- 4.3.1 Hybrid cloud, multicloud, and the vendor lock-in conundrum
5. Managed security services and quality assurance
- 5.1 The provision of managed security services
- 5.1.1 Managed security services in the cloud
- 5.2 Managed security services and the laboratory
- 5.2.1 The quality assurance officer
- 5.2.2 The shared responsibility model in the scope of security management and quality assurance
- 5.3 Choosing a provider for managed security services
- 5.3.1 Using a request for information (RFI) process
6. Considerations when choosing and implementing a cloud solution
- 6.1 What are the various characteristics of an average cloud provider?
- 6.2 What should your lab look for in a cloud provider?
- 6.2.1 Service-level agreements
- 6.3 What questions should you ask yourself?
- 6.4 What questions should be asked of a cloud provider?
- 6.4.1 Using a request for information (RFI) process
7. Final thoughts and additional resources
- 7.1 Final thoughts
- 7.2 Key reading and reference material
- 7.3 Associations, organizations, and interest groups
- 7.4 Consultancy and support services
Appendix 1. Top public and hybrid/mutlicloud services
- Alibaba Cloud
- Amazon Web Services
- Cisco Cloudcenter and UCS Director
- Dell Technologies Cloud
- DigitalOcean
- Google Cloud
- HPE GreenLake
- IBM Cloud
- Linode
- Microsoft Azure
- Oracle Cloud Infrastructure
- OVHcloud
- Tencent Cloud
- VMware Cloud
Appendix 2. Top managed security services
- Accenture Security Managed Security
- AT&T Cуbеrѕесurіtу
- Atos Managed Security Services
- BT Cyber Security Platform
- Cisco Active Threat Analytics
- Cyderes Managed Services
- Foresite Managed Cybersecurity
- IBM Managed Security Services
- NTT Managed Security Services
- Orange Cyberdefense
- Secureworks Managed Security Services
- Trustwave Managed Security Services
- Verizon Managed Security Services
- Wipro Managed Security Services
Appendix 3. RFI questions for cloud providers and MSSPs