Clouds, Security and Enterprises

IRAP (Infosec Registered Assessors Program) is a familiar friend to ICT professionals working for / on many government and non-government programs. With the aim to secure ICT systems and data in broader private and public sectors, the Australian Signals Directorate (ASD) endorses suitably qualified cyber security professionals to provide this comprehensively developed security assessment services. ‘Endorsed IRAP assessors assist in securing your systems and data by independently assessing your cyber security posture, identifying security risks and suggesting mitigation measures. IRAP assessors can provide security assessments of SECRET and below for: ICT systems Cloud services Gateways Gatekeeper FedLink’ (from cyber.gov.au) Going through an IRAP assessment journey is rarely a straightforward job - many would wonder if that would be possible at all. It takes considerable efforts by the organisation and their service providers to work with the IRAP assessor to cover a large number of as...

Many people are familiar with the 7 Rs in cloud migrations – the seven cloud migration strategies advocated by AWS and other cloud service providers: Rehost Replatform Refactor Repurchase Retain Relocate Retire In this blog piece, I would like to share some real-world customer considerations on choosing the Refactor and/or Replatform strategies.  To give a general definition, the Replatform strategy is the migration approach in which some tweaks (optimisations and modernisation) are performed during the migration to the cloud but the core architecture of the workloads stays. Some examples that given by AWS are migrating server based databases to Amazon RDS, or moving an application to Amazon Elastic Beanstalk – both are cases of moving to fully managed cloud native services. The Refactor strategy, on the other hand, is sometimes referred to as Rearchitect, where more changes are made to the application architecture than Replatform, typically increasing agility and business continui...

Amazon AppStream 2.0 is a fully managed non-persistent application and desktop streaming service that provides users access to desktop applications from anywhere through HTML5 web clients. It sits in the AWS End User Computing (EUC) business unit. Other services in AWS EUC include Amazon WorkSpaces, Amazon WorkSpaces Web (not to be confused with WorkSpaces) and Amazon WorkDocs. This blog is not a tutorial on AppStream 2.0. After all, each customer may find different use cases for this flexible yet powerful AWS service. In this piece, I discuss several scenarios that saw AppStream 2.0 help some of my enterprise customers with their specific needs. The non-persistent admin desktops People call AppStream 2.0 a non-persistent ‘virtual desktop’ service. These virtual end-user compute sessions, powered in the backend by an elastic AppStream fleet and in a presenting form of an application streaming service, are torn down once the user sessions are completed. This characteristic means: What a...

(This blog piece was the streamlined transcript of a community video talk I gave.) Enterprise data protection is an integral part of any organisation’s data security architecture and operations. As a characteristic of the cloud era we are in, more and more data nowadays resides in cloud environments.  In a typical scenario of an enterprise’s AWS cloud setup, multiple AWS accounts are used – there are good reasons why multiple OUs (Organizational Units) and accounts are structured for a given organisation.  Behaviour differences exist between these AWS accounts. Though they all belong to the same enterprise, AWS resources for a workload in an AWS account may behave differently to another workload and its resources in a different account. The behaviours here refer to the traits of how certain resources communicate and how certain data is accessed. As a simple example, an S3 bucket in an account is designed to be frequently accessed by a vast number of users (even including the g...

Amazon FSx for OpenZFS, ‘a fully managed shared storage built on the popular OpenZFS file system’, was launched in AWS Sydney Region (ap-southeast-2) in April 2022. Powered by Graviton processors (AWS designed processors that as per AWS delivering a major leap in performance and capabilities and providing the best price performance), Amazon FSx for OpenZFS enables a range of new capabilities, such as higher performance, lower latency, broad access by Linux, Windows and MacOS operating systems, all at a lower price point against other comparable shared storage services offered by AWS. OpenZFS file system has its root from the ZFS file system, which was developed by Sun Microsystems over twenty years ago, in 2001, for the proprietary Solaris operating system. ZFS was designed with considerations for large, powerful servers at the time, which use-case focus was leaning more towards performance, functionality and reliability, rather than economical costing. A few years later in 2005, Sun M...

Let’s start by thinking of a stock exchange’s trading platform, where hundreds of thousands of transactions may occur in a single second and millisecond-level differences in the arrival times of trade requests matter. This gives some idea on high performance databases. There are widespread use cases of high-performance databases in all industries - anywhere ultra-low latency and high volume of real-time concurrent transactions are needed. Naturally, such performances cannot rely on the speeds of hard drives, even those of SSDs. There have been many technologies and heralds in this field; one particularly worth mentioning is the open source Redis project, initialised by Salvatore Sanfilippo more than ten years ago. Not sure how many still think of the ‘Remote Dictionary Server’ origin when the word is frequently mentioned nowadays. Redis has become the name for that popular open source, in-memory data structure store that is a cache, a database, or a real-time data platform. Redis adopt...