CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

Home » AWS

AWS

AWS Snowball Edge And Hyper Converged Infrastructure Will Revolutionize Global Enterprises

The recent announcement by Amazon AWS of a portable Snowball EC2 compute platform represents a significant advance in hybrid cloud/data center computing. When combined with a Hyper Converged Infrastructure  (HCI) super computer and Zero Trust Network, enterprises across a broad range of vertical markets can transform their operational model.1st Generation Hybrid: Two-Stack Architecture

The 1st generation of hybrid cloud/data center was characterized by a two-stack design with legacy apps in the data center and new apps in AWS. Application developers loved the idea of experimenting with AWS Marketplace but the IT department didn’t like the fact that apps could not be ported back into their data center. Additionally the two-stack architecture suffered from disaster recovery and security issues if there was a cloud outage.

VMware noticed the issues IT departments were having with 1st generation hybrid environments and offered vSphere in AWS. VMware’s solution improved load balancing and disaster recovery for legacy applications but it didn’t address the problem of AWS app portability.  Thus many global-scale enterprises waited on the sidelines for something better.

2nd Generation Hybrid Infrastructure: AWS Snowball Edge + HCI Super Computer 

The recent announcement of Snowball Edge by AWS represents a significant advance in hybrid infrastructure. For the first time enterprises can run apps using AWS software logic on a “physical” EC2 instance inside their data center. When combined with a Petaflop-scale Hyper Converged Infrastructure (HCI) super computer enterprises can operate a common application environment for legacy and new AWS apps across the data center and cloud infrastructure.

Looking at the image below we have a high level architecture of a 2nd generation hybrid compute architecture. The Snowball Edge in the data center allows enterprises to run software with embedded AWS logic outside the cloud. To allow enterprises to run legacy as well as compute intensive applications like machine learning there is a high performance Hyper Converged Infrastructure (HCI) super computer paired with the Snowball Edge. In the AWS cloud we have the enterprise’s VPC as well as vSphere environment. Connecting the Data Center and AWS environments we can have any combination of broadband satellite, SDWAN or VXLAN/MLPS.

One of the challenges with such a fluid architecture is routing users to the correct Secure Enclave and blocking self-propagating malware. A SDP-based Zero Trust Network ensures that users are only connected to authorized applications irrespective of where the workload sits.  Unlike standard VPNs, SDP blocks self-propagating malware from moving thru the hybrid compute environment by locking down physical and virtual network interfaces.

Some of the new technical capabilities of a 2nd generation hybrid cloud include:

Workload optimization: While EC2 is great for the majority of workloads sometimes a super computer is better for applications needing millions I/O operations per second. A 2nd generation infrastructure allows hyper-scale computing across super computing and cloud fabric for large data set machine learning or Smart Cities IoT management applications.

Partitioned Compute: The partitioning features of Snowball Edge and a Hyper Converged Infrastructure (HCI) allow for the creation of Secure Enclaves that can only be accessed by authorized users after their compute device has been remotely attested by a Zero Trust Network.  Lateral movement within the hybrid environment is blocked using encrypted APIs.

Disaster Recovery: A pure cloud-centric enterprise is a great idea except if one loses access to the cloud or it’s down. The Snowball-HCI combination allows enterprises to have true active:active redundancy that is synchronized in real time.

Micro Data Center: One interesting aspect of the Snowball-HCI super computer combination is that you can have a two box data center! The small footprint of a Micro Data Center opens the door to edge computing in a broad range of vertical market applications where installing racks of gear is impossible.

Vertical Market Applications

In addition to improving cost structure and functionality for enterprises, 2nd generation hybrid computing holds the promise to revolutionize vertical markets:

Finance & Healthcare: Financial and medical institutions have strict requirements on encryption and access control for regulated data that make it difficult to utilize a public cloud. The 2nd generation hybrid infrastructure provides regulated entities a way to develop business logic in AWS marketplace while processing sensitive data on a Hyper Converged Infrastructure (HCI) at their data center.

Energy & Transportation: Energy and transportation companies build expensive satellite networks to backhaul telemetry to centralized data centers. 2nd generation hybrid compute can reduce the need for expensive satellite communications by processing data in Micro Data Centers. Moreover the integrated security and intelligence of a Micro Data Center edge node allows for load balancing across multiple satellite providers to improve redundancy and cost structure.

Emergency Services: A hurricane, flood or earthquake can easily destroy the communications and compute infrastructure of a whole region. The autonomous operational capabilities of a Micro Data Center combined with 4G coverage and broadband satellite allows emergency personnel to “light up” impacted areas within 48 hours of an event. Moreover the ability to ingest live video feeds from drones and helicopters and fuze them provides on-site personnel improved situational awareness.

Smart Cities: Looking to the near future, the collection and processing of IoT sensor Petabyte-scale data is the single biggest challenge to Smart Cities. The massive data that energy, transportation and environmental sensors generate will overload any compute or network infrastructure. In contrast, 2nd generation architectures provide a high performance distributed compute model where IoT sensor data is first processed at Micro Data Centers and then transferred to centralized management systems. Additionally the Secure Enclave features of 2nd generation  infrastructure can be used to remove personal identifiable information while maintaining relevant data to ensure Smart Cities don’t become a giant surveillance system.

The ability to mix and match applications in a 2nd generation hybrid infrastructure frees enterprises to provision the optimal combination for each project thereby reducing cost and improving agility.  Moreover the ability to operate in a completely disconnected autonomous mode simplifies disaster recovery.

Related topics:

 

Secure Enclaves: Foundation For The Cloud-Based Enterprise

This is the first in a series of blog posts examining a cloud-based enterprise. In this post we’ll introduce how a Secure Enclave can help enterprises migrate to a cloud-based model.

The two dominant themes in enterprise architecture today is the desire to save money by utilizing cloud services and threat of state-sponsored cyberattacks. The goal of a Secure Enclave is to help enterprises meet both objectives by implementing a trusted access control solution in the cloud.

All IaaS and SaaS providers utilize a shared security model in which they take responsibility for the data inside their boundary but expect the enterprise to be responsible for everything outside their perimeter. For example, enterprises are responsible for all damage due to stolen passwords or unauthorized access to compute instances. Thus the security challenge for cloud-based enterprises to how to enable perimeter security when all they have is the cloud?

A Secure Enclave utilizes a Software Defined Perimeter (SDP) security model to create a protected IaaS instance inside which role-based access control,  trust assessment, certificate management and addressing functions can be deployed. Additionally a Secure Enclave can also protect IaaS and SaaS applications from network-based cyberattacks including self-propagating malware.

Looking at the high level architecture below we see Secure Enclaves supporting trusted access control functions for IaaS and SaaS applications.

Secure Enclave Vidder Junaid Islam

 

The first task of a Secure Enclave is to implement trusted access control to IaaS and SaaS applications. Trusted access control combines role-based access control with device trust assessment. Trust assessment allows enterprises to conduct a remote posture check on user devices before granting access to cloud services. For example, enterprises can verify if a device has updated software and is running endpoint protection. If the device is acceptable then one or more SAML assertions are generated based on the role of the individual.

Secure Enclaves can also be used protect IaaS instances from network-based cyberattacks. Only authorized users and their devices are granted TCP connectivity to IaaS compute instances.  Moreover to block the new generation of self-propagating malware, only application layer connectivity is granted to authorized devices.

One of the unique features of a Secure Enclave is how it protects SaaS applications from stolen passwords. Enterprises can utilize the federation capabilities to SaaS apps to re-direct sign-in requests to their SAML IdP. However only users who have access to the protected IdP can get the SAML assertion. Thus Secure Enclaves can be used to provide transparent multi-factor authentication to SaaS.

In the next post we’ll take a deeper look at the trusted access control functions of the Secure Enclave.

Defense in Depth: Protecting the Organization’s Data

Editor’s note: in this post Marty Meehan provides context on an economical, scalable and highly secure defense in depth solution leveraging PKWARE’s Smartcrypt and QuintessenceLabs. – bg

The stakes get higher every day. External security threats grow more sophisticated and unpredictable. Internal controls become more complicated and challenging to implement. When data breaches do occur, the information exposure, financial impact and PR damage can take years to repair. Security managers around the globe are facing the unavoidable truth that network and device protection are not enough. True information security requires persistent data-level protection, so that information remains inaccessible even after a security breach. Until now, organizations have had to choose between two approaches when implementing data-level protection: passphrases or public-key infrastructure (PKI). Each has significant drawbacks. Passphrases, the more common approach, are difficult to create, store, and exchange in a way that maintains the security of the protected data. PKI, provides stronger protection, but presents serious challenges in usability and key management. The shift toward mobile technology and cloud-based services has slowed PKI’s already low rate of adoption.

PKWARE’s Smartcrypt is a revolution in enterprise data centric security management enabling companies to maintain complete control over their protected data. The Smartcrypt solution combines the strength and reliability of PKI-based encryption with the ease and simplicity of passphrase-based security utilizing quantum key generation technology. Smartcrypt targets protecting the core of an organization’s asset: its data. The Smartcrypt Platform consists of an end-user application and a web-based manager console. It also includes a Software Development Kit (SDK) that is available in every major programming language. The robust security solution offers both data and field level protection that can be added right into workflows, repeatable processes and applications with minimal effort, and also used independently, as needed.

Persistent Protection and Remarkable Ease of Use

Featuring a variety of platform-specific user interfaces, the application supports a wide variety of encryption systems, key types, and key interfaces. Smartcrypt also features Smartkeys, an embedded key management solution that simplifies and automates the most challenging aspects of key management.

Once data is encrypted with the Smartcrypt application, the protection stays with the data everywhere it is used, shared, or stored. The application automatically creates, synchronizes, and exchanges encryption keys, ensuring that only authorized parties can access protected data.

The Smartcrypt Manager: Enterprise Control and Visibility

The Smartcrypt Manager console provides centralized key and policy management. The web-based administration console includes granular controls for configuration, policy, and approval management. Smartcrypt’s Data Security Intelligence feature provides complete visibility into which files are encrypted, which users have accessed them, and where the events took place.

When auditors, IT personnel, or DLP scanners need to review encrypted data, Smartcrypt’s policy keys provide reliable access. The solution can be configured so that every encryption operation contains one or more public keys, ensuring that the organization never loses access to its own data. Customers can elect to use Smartkeys or their own third-party generated keys (in X.509 or PGP format).

The Smartcrypt Application: Enterprise-Wide Data Protection

The Smartcrypt application operates on all major Enterprise IT platforms from mainframe to mobile and simplifies data protection for the organization in a way that no one thought possible. Strong data-level encryption, embedded key management and PKWARE’s industry-leading compression technology are combined into a single seamless solution out of the box.

The Smartcrypt application includes Smartkey technology to ease key creation and management. Smartcrypt also integrates seamlessly with existing PGP and X.509 public key security infrastructures.

All key creation, synchronization, and exchange operations take place in the background, making it easy to securely store and exchange data with partners and customers.

Policy controls can easily be created using the Smartcrypt Manager to enforce usage, standards and best practices across the enterprise or at the department or group level. Smartkeys: Key Management Made Easy At the core of the Smartcrypt application and management console is PKWARE’s revolutionary Smartkey technology. With Smartkeys, businesses gain across-the-board control of who can decrypt files and read data. Smartcrypt employs Quintessence Labs’ Quantum True Random Number generation technology to generate Smartkeys that give users the ability to quickly and easily protect sensitive data.

A Smartkey is generated and utilized by the Smartcrypt application for a specific file, folder, or other protected asset. With Smartkeys, user access to protected files and folders can be added or revoked at any time—even if the files have been shared, copied, renamed, transferred, or emailed—ensuring full lifecycle protection.

Smartkeys are automatically generated, shared, and synchronized between authenticated devices without changing or interrupting user workflows.

Smartcrypt also allows users to encrypt data for external parties such as vendors or partners. A cloud-based key server stores and distributes keys based on the organization’s security policies, even for external users who are granted access after the encryption takes place.

In addition to the encryption applied to the protected data, each Smartkey itself is encrypted and exchanged according to a policy-driven access list. This innovative approach allows security managers to respond quickly when a user loses a protected device, or when access needs to be revoked from an individual or group. By simply changing the encryption on the Smartkey, administrators can block unwanted access without the need to re-encrypt large amounts of data.

How Smartcrypt Benefits Your Organization:

Securely Exchange Data

Smartcrypt applies persistent encryption to files before they are exchanged with outside partners and customers. This enables an organization to retain control over information regardless of how many times that information is copied, backed up or forwarded. This approach also allows users to exchange sensitive information through cloud services or protocols like email and FTP that provide little security on their own.

Exceed Compliance Requirements

Compliance standards in government, healthcare, and financial sectors mandate the protection of data at rest and in motion. Smartcrypt facilitates mandated separation of duties, protection from insider threats, and integration with DLP processes. The Data Security Intelligence capabilities included provide visibility into what sensitive information is being protected and by who, and where it is transmitted and/or accessed.

Protect Cross Platform

From mainframe to mobile phone, Smartcrypt provides complete cross-platform encryption. With integrations for common applications like Office and Outlook, Smartcrypt can be used to protect information stored on end-user devices, network shares, and even file sharing services. Smartcrypt is also easily integrated into back-office and batch processing workflows.

Enhance DLP

Organizations need flexible data security solutions that work with data loss prevention technology and processes. Smartcrypt can be integrated with existing DLP strategies to enable sensitive information discovery and encrypted remediation.

The Smartcrypt Platform Highlights:

Enterprise Cross Platform

  • An end-to-end encryption application available for every enterprise operation system

Embedded Key Management (Smartkeys)

  • Automatic public/private key generation, synchronization and exchange
  • Quantum true random number generation (Quintessence Labs)
  • Exchange and manage keys with external collaborators
  • Retain control over data after it has left the organization
  • Access to data can change without re-encryption
  • Delivery of keys to enterprise IT, Audit and DLP people and technology

Advanced Platform Control

  • Provides visibility, policy, control, discovery using the Web interface to the Manager console
  • Easily revoked or automatically expired access control to protected files

High Performance

  • Takes advantage of IBM and Intel hardware encryption accelerators
  •  Data compressed up to 95% before encryption, resulting in significant storage/transit savings

Existing PKI

  • Support for OpenPGP encryption and key formats
  • Support for X.509 certificate based encryption
  • Support for passphrase based encryption

Key Storage and Retrieval

  • Software: PKCS#11, LDAP, CAPI/CNG, Keychain, Keystore, ICSF- CKDS, PKDS, KMIP, Security Server, RACF, ACF2, Top Secret
  • Smartcards including PIV / CAC
  • Hardware: KMIP HSM

Algorithms

  • Encryption: 3DES, AES128, AES192, AES256, CAST5 IDEA, AE-x
  • Signing: SHA-1, SHA-256, HA-384, SHA-512
  • Strict checking and check revocation status (optional)

About PKWARE:

For three decades, PKWARE has provided encryption and compression software to more than 30,000 enterprise customers, including 200 government entities. Inventor of the .ZIP file format, PKWARE’s smart encryption security solutions armor the data itself and eliminate vulnerabilities wherever data is used, shared, and stored. PKWARE’s security solutions include robust key management capabilities that support key stores, and their inherent encryption keys, typically found on enterprise-wide IT platforms. These key stores may house symmetric or asymmetric keys used for securing sensitive data. Additionally, PKWARE’s most recent product offering, Smartcrypt, employs Smartkey technology that reduces complexities associated with key generation and key usage for Smartcrypt users. PKWARE’s partnership with QuintessenceLabs extends Smartcrypt key management support and key generation capabilities using their Trusted Security Foundation and true random number generation technology.

About Quintessence Labs:

QuintessenceLabs is a global leader in quantum cybersecurity. At the forefront of the commercial development of quantum security solutions, thet deliver unique solutions integrating high-value cybersecurity with advances in quantum technology. These include the world’s fastest true random number generator; advanced key and policy manager and integrated encryption solutions for on premise or in-cloud implementations.

Track the most disruptive technologies by diving into our categorized index:

Artificial Intelligence Companies – A fast overview of Artificial Intelligence companies we believe are poised to cause the most positive disruption in the enterprise.

Big Data Companies – Reference to the greatest, most disruptive Big Data companies in the tech ecosystem.

Business Intelligence Companies – We assess these to be the Business Intelligence Companies most impactful for delivering real decision advantage.

Cybersecurity Companies – We apply our deep expertise in cybersecurity to assessing the best across multiple categories including:

Cloud Computing Companies – We include both platform and software as a service providers, capturing only the most innovative and disruptive.

Collaborative Tool Companies – These are the firms that help humans connect to humans to create, manage and lead.

Infrastructure Companies – Critical enterprise foundations for business agility.

IoT Companies – Internet of Things and Industrial Internet of Things are here. How do you manage them?

Mobile Companies – Help manage, configure, secure and optimize these very powerful capabilities.

Robotics Companies – Including innovations in Robotic Process Automation, Drones, and industrial robotics.

Services Companies – We only track a few, the ones we really know well.

Tech Titans – These are the big players. We track the tech titans closely since their capabilities change continuously.

VC, PE and Finance Companies – Keeping an eye on the investors can give indications of coming developments.

You can also use our topical pages to get up to speed quickly on the current status of the major megatrends. See our pages on Cloud Computing, Artificial Intelligence, Mobility, Big Data, Robotics, Internet of Things, Cybersecurity and Blockchain and Cryptocurrencies.

We also provide special pages focused on high interest topics, including Science Fiction, Entertainment, Cyber War, Tech Careers, Training and Education and Tech Tips.

Quickstart Guide: Stand up your cloud-based servers with Rackspace

This content requires a login to read. If you are a CTOvision Pro member, please make sure you are logged in.

If you are not yet a member, please try our free trial! Here is more info:

CTOvision Pro is our subscription only research and analysis service. This service leverages our proven ability to spot, analyze and accelerate disruptive technologies to provide mission impacting, actionable information.

We deliver actionable insights that will make direct contributions to your success. Subscribing gives you a leg up over your competition by making sure you are always aware of what is possible in enterprise IT.

CTOvision Pro members receive:

  • Exclusive content
  • A special newsletter with insights and summaries of our latest reports
  • Access to our “Ask the CTO” feature
  • In depth analysis on enterprise IT
  • Overviews on and projections/assessments on the future of IT
  • Special reports on Big Data, Cloud Computing, Cyber Security
  • Special reporting on Federal IT

Our high value reports will help you know the difference between leading edge and bleeding edge and fantasy. Know which technology is about to disrupt the market and beat out existing programs and projects. And be the first to find out which company holds the greatest potential of helping you succeed in your enterprise mission and business pursuits.

Start Your Free Seven Day Trial of CTOvision Pro

More Content

Cyber War

Optimizing Corporate Intelligence with OODA Loop

This post is part of our Intelligent Enterprise series, which providing insights aimed at corporate strategists seeking competitive advantage through better and more accurate decision-making. The first post provided foundational insights into A Practitioner’s View of Corporate Intelligence. This one dives into actionable recommendation on ways to optimize a corporate intelligence effort. It is based on a career serving large scale analytical efforts in the US Intelligence Community and in applying principles of intelligence in corporate America.

SciFi

Science Fiction Gadgets You Can Get Today

Technology is advancing pretty fast, at times influenced by the exciting world of Science Fiction. This video captures 10 of the tech developments first seen in SciFi that are available now. A key point of this, if you want to know what is in our future, watch more SciFi!  

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]