ACCS-VA 2022

In 2014 we moved our IT operations into a new data center; a large, beautiful data center! Wall to wall glass windows, hundreds of blinking, Dell-blue lights, and "state of the art" blade servers--a showcase for every high-profile visitor group arriving on campus. At least, until one of those visitor groups was the APA. They made some mention of glass walls, frequent visitor tours, ease of access, and a lack of physical security. In hindsight, that was a relatively easy problem to fix. The next APA visit "observation" was much more formidable.
It became a multi-year, multi-departmental, multi-process, and multi-vendor challenge.

Our INTERNAL information security was nearly flawless, but our EXTERNAL information security—in this new CLOUD data space was immature. In many respects, the changes we made toward the cloud were almost unnoticed. In three to four years, we had quietly transitioned nearly 25% of our internal data services to third party cloud hosts. We had made assumptions about 3rd party vendor security, but rarely "pressed to test."

This presentation is our story about changing our own internal processes and pressing cloud-based data service vendors to PROVE they care about our data as much as we do.