2.6 KiB
Introduction to case studies
This guide refers to two running case studies, which are introduced here and referred to at the end of each chapter.
Case study: Alice, the private cloud builder
Alice is a technical manager overseeing a new OpenStack deployment for the US government in support of Healthcare.gov. The load on the cloud is expected to be variable, with moderate usage increasing to heavy usage during annual enrollment periods. She is aware that her private cloud will need to be certified against FISMA through the FedRAMP accreditation process required for all federal agencies, departments, and contractors as well as being under HIPAA purview. These compliance frameworks will place the burden of effort around logging, reporting, and policy. While technical controls will require Alice to use Public Key Infrastructure to encrypt wire-level communication, and SELinux for Mandatory Access Controls, Alice will invest in tool development to automate the reporting. Additionally, comprehensive documentation is expected covering application and network architecture, controls, and other details. The FedRAMP classification of Alice's system is High per FIPS-199. Alice will leverage existing authentication/authorization infrastructure in the form of Microsoft Active Directory, and an existing enterprise SEIM deployment that she will use to build new views and correlation rules to better monitor the state of her cloud.
Case study: Bob, the public cloud provider
Bob is the lead architect for a company deploying a new public cloud, focused on Infrastructure as a Service (IaaS). While this cloud will be open for any consumer with a valid credit card to have access to utility computing and storage, the primary focus will be enterprise customers. This means Bob's primary certification concern is PCI compliance, and his tooling will be developed around the auditing and reporting there, as well as the specific domains included in the PCI audit. As Bob's team is technically skilled in the Linux domain, he will be utilizing LDAP for federation. With plans to scale the cloud rapidly, Bob selects an open source log management deployment built for large-volumes of events with a highly customizable view. Data privacy and security concerns are the top barrier to adoption of the cloud, so Bob will also implement strict internal processes and two-factor authentication around sensitive assets, as well as allowing customers to leverage this for logins as well.