My name is Lyron Andrews.
Thank you for continuing in this course.
Now we are going to consider Secure Data Center Design and Supporting Controls.
It should be said, at the outset of our discussion,
that most of you taking this course are not part of a company's
technology where they are considering building out a data center, so
why are we focusing on it in this course?
Well,
the CCSP considers it from the standpoint of what you should
expect from your cloud service providers.
For instance,
if you do a security assessment report on the cloud service provider,
what does the resilience and the availability level look like?
What do protection levels look like for them to actually protect
their own systems that you are now dependent on?
We began with the data center design standards and what they have to
say along the matter of building out data centers.
Well if you go down to the basics,
cloud consumers are not the ones who are actually building out the data centers,
but having an understanding of what the standard is can be helpful to
know the current state of where you are consuming services, and could
possibly be part of pass‑through assessments or compliance assessments
that your organization has to abide by regionally, nationally, or
according to international law.
The logical design should proceed the physical design.
When we think of the logical design,
we're really considering the cloud infrastructure
including measures to limit remote access,
monitoring the cloud infrastructure,
creating substantive tenant partitioning and isolation, and
allowing for patching and updating of systems in the cloud
environment in a live manner.
The other thing that you would think about from a cloud service
perspective is that the logical design is best described in terms
from the customer's business vocabulary.
So locations, processes,
workflows, and roles from the business domain can be
included in the logical domain.
An important aspect of logical network design is that it is part of the
requirements set for a solution to a customer problem.
The logical design precedes the physical design so that you are not locked
in to some functionless state based upon first doing a physical design.
After determination of business requirements is made, there is a deep
research of cloud service providers that could reveal that a selection of
two or more providers is necessary. Proprietary nomenclature methods and
technologies espoused by the provider of choice could be potentially
detrimental to meeting the stated business requirement when it becomes
necessary to link multiple services for a consuming organization. Think of
data formats and how one cloud service provider may save that information
and then it becomes unreadable when you try to extract that information from
that cloud service provider to move it to another location.
One of the most important characteristics of what is called cross‑cutting
aspects in ISO 17789 is this idea of portability and interoperability. During
the trial period of consuming cloud services, it's important to understand
that your service aggregation of multiple service is to consider the
capabilities that support moving from one platform to another, and also
interoperating between platforms.
ISO 22237 relates the data center facilities and infrastructures.
It has six elements including location recommendation,
power distribution, control systems, monitoring and security,
security for protection classes, and then operational and management security.
From the standpoint of location and site selection, the cloud
service provider is going to be very concerned about what kind of
materials are used in order to build out their data centers.
Depending on where you are in the world,
the construction materials could be intractably mandated by local,
regional, or state law. Also, what is the configuration that is being used,
and fire protection mandates and laws, and also, the quality construction that
would occur based upon the requirements of that business? Consideration should
also be given to the environmental impact that a data center will have upon
the surrounding environment.
Are there alternative renewable energy sources that are available, and
the possible effect that the environment will have upon the personnel
related to the previous use of the land,
for instance, was it formally used as environmental waste?
Understanding what the output could mean to the overall environment,
recent studies have shown that data centers are one of the biggest
contributors to the carbon footprint of the world.
Renewable energy then is what many of the top providers are actually seeking.
Let's just consider what the top three that own most of the market are doing.
As example,
Amazon has become the world's largest corporate purchaser of renewable energy.
The company's total renewable energy investment to date would
supply 6.5 GW of electricity production capacity.
That's enough to power 1.7 million US homes for a single year. Amazon
announced plans to add 26 utility‑scale wind and solar energy project
totaling 3.4 GW of electricity production.
Google has reached 100% of global electricity in its renewable energy portfolio.
They state that they are proud in 2020 to again match this 100% global
electricity renewable process for a number of consecutive years.
They were the first company of their size to achieve the milestone back
in 2017. Microsoft has various activities that are targeting 2030 for
being first in reducing their carbon footprint,
including more water that they replenish than consume, and
zero waste and carbon‑negative behavior.
Next,
we'll consider what design resilience means from a protection class perspective.