Reference no: EM132411140

Risk, Security and Management

Task Overview

VideoDev Ltd is a video and production development company which works for clients across Australia and New Zealand. The company is considering moving some of its computer infrastructure into the Cloud. The VideoDev Board is contemplating this move as a way to increase the company's flexibility and responsiveness, as well as to achieve some savings on the cost of maintaining their ICT infrastructure.

VideoDev has engaged you as a consultant to advise them on the use of Cloud Computing in their daily operations. They have some 100 video production, engineering and support staff that work on different projects for clients in Australia and New Zealand.

You were recently engaged to advise on re-factoring their video processing application to use a microservices approach. The VideoDev Board is keen to start to move to this direction as it sees the possibilities that it will open up for VideoDev in the future. They have also decided to start planning to migrate their existing web services from their two on-premise data centres to a public cloud.

The company is considering the following strategic proposal:

They plan to retain the Sydney data centre for data storage. This would entail updating their Active Directory and data storage infrastructure, and moving all other infrastructure into the Cloud.

They plan to move all their Web Services into the Cloud in order to provide an increased responsiveness to customer demand as well as an enhanced level of HA (High Availability) in supplying data to their customers and staff.

They are considering changing their current web software architecture to take advantage of the flexibility and scalability that can be gained by moving to a Microservices model (this would entail the use of such services as AWS Lambda or Azure Functions, Containers, Data Services, and Cloud Edge capability and monitoring).

The VideoDev Board is contemplating this strategy as a way to increase the company's flexibility and responsiveness. The Board also expects to achieve significant savings on the cost of maintaining their ICT infrastructure by closing one of their existing data centres. They appreciate that this would entail retraining for their existing ICT staff so that they can manage the new Cloud based infrastructure.

You have also advised the VideoDev Board that their Threat and Risk Assessment (TRA) needs to be updated as a result of these architectural changes. The Board has asked you to update the TRA as a matter of urgency.

The Board is also concerned about how this strategy will affect their BCP (Business Continuity Plan) and their backup and disaster recovery strategies.

Tasks

Your team has been engaged to provide a report for the VideoDev Board on their proposed strategy.

Team Setup
This assignment is a team assignment. The rationale for using a team approach is that most IT risk management assessments are normally done by teams of between 2-5 Architects, Information Security experts, Operations and Business leaders for each problem. You will be assigned to a team and the team, as a whole, will be responsible for the development of the risk assessment.

Team Member Responsibilities

Each team member will be assessed on:

The final risk assessment presented by the team;
The individual contributions that they have made to the risk assessment. This will be shown by the entries that they have made in the

Need only given Task

Task 1 Discuss briefly what you would recommend should be included in VideoDev's BCP as a result of their adoption of a Microservices approach. You will need to consider, as a minimum, the issues of application resilience, backup and disaster recovery. This section should be no more than 2 pages.

Task 2. Discuss the requirements that VideoDev will need to consider in order to conduct remote administration, resource management and SLA management for its proposed MicroService approach. This section should be no more than two to three pages in length.

The tasks:

The team's task is to prepare a report for VideoDev that discusses the following:

Describe which Cloud architectures you would employ to assist VideoDev to meet the Board's strategy of moving their web services to a MicroService approach?
Describe each of the architectures that you would use, along with your reasons for deploying it.
Describe the benefits and issues that would be the result of your deployment of these architectures.
Describe the risks that you see associated with this new MicroServices strategy. You should name and describe each risk that you identify, and then describe a possible control for the risk. This should be presented in a tabular form.
Describe the general Information Security steps and controls that you would recommend to the Board to secure these MicroServices. You will need to explain to the Board your reasons for recommending these particular security steps.
Discuss briefly what you would recommend should be included in VideoDev's BCP as a result of their adoption of a Microservices approach. You will need to consider, as a minimum, the issues of application resilience, backup and disaster recovery. This section should be no more than 2 pages.
Discuss the requirements that VideoDev will need to consider in order to conduct remote administration, resource management and SLA management for its proposed MicroService approach. This section should be no more than two to three pages in length.
The VideoDev board wants to know what you recommend as the best migration strategy and process for the migration of their web services to a MicroService approach.
Describe the steps that you would include in the plan to migrate these services.
What are the critical points and issues that you see occurring at each of these steps? Explain why you see these points or issues as critical.

Presentation
The team is to provide a written report with the following headings:

Proposed Architectures
Risk report for Microservices
Proposed Information Security controls
BCP Changes
MicroService Administration and SLA Management
MicroService Migration Strategy
As a rough guide, the report should not be longer than about 8,000 words. The report is to be loaded into the Team Resource area in Interact.

Attachment:- Case VideoDev.rar