Compliance Complexity and the Almighty Audit

By Nicole Hemsoth

June 12, 2010

There are a host of issues that often get wrapped into cloud security discussions ranging from network and data security to the protection of private health and financial information, but for many, security means more than just knowing data is security, it means being able to prove it. In great detail, no less.

Growing regulation governing mounting data complicates efforts for technology to keep pace with the law, which for some industries, barriers to migration for private clouds alone can create enormous challenges. What this all boils down to is compliance and what that can be pared down to, at least on the individual enterprise level, is the notion of the much-dreaded audit.

Audits are not a particular concern for all HPC applications in the cloud, certainly, but for sectors like financial services, this concern is enough to dissuade broad adoption of any cloud model — no matter how tenuous it might be at first. Furthermore, since regulation is swift and revisions are frequent, organizations are understandably concerned about how new regulation might influence their current IT environment.

Grounded Concerns Versus Lofty IT Goals

LogLogic, a San Jose, Calif.-based company offering security and log management services, recently released a report that suggested enterprises are focused on security and compliance over new technology investments. More specifically, LogLogic discussed how financial services firms in particular are still hesitant to adopt cloud — no matter what model or approach. According to their survey, “more than 75 percent of respondents are concerned about increasing government regulation” since, shall we say “enhancement” of existing regulatory measures further complicates IT at every level for those who are under the most compliance-related scrutiny.

Although the report did not go into deep specific differences between private and public clouds, it does highlight some of the critical barriers to wider cloud adoption in industries with intense regulation considerations underpinning nearly every single element of IT. The report was based on surveys with members of some of the largest international banking giants as well as numerous investment and insurance firms. It found, not surprisingly, that security was one of the biggest concerns but wrapped up in that overarching (and valid) concern are the more specific matters of transparency.

Compliance and Security Concern Trump Cloud Investments

The financial services sector is one of the most compelling to watch because they have historically been routine early adopters of technological innovation. Throw in a network, however, and the situation changes dramatically, especially with the increasingly stringent regulations that apply to specific HPC applications in the cloud that deal with personal financial and health information, for example. However, with penalities that are stiff enough to bury companies that are not compliant, the obvious driver here is keeping pace with regulation, certainly not investing in “new” technologies and ways of handling IT that might throw them into ruin.

I talked with LogLogic’s Bill Roth and Lex Van Den Berghe about some of the more specific concerns and trends that reflect the hesitancy of the financial services sector and the word that kept cropping up was “audit.” In addition to more generalized issues about data security as a whole, concerns about audits cannot be underestimated.

As Bill Roth of LogLogic noted, “In terms of the level of security required for those in the financial services industry since they’re so heavily regulated, cloud-based providers and HPC in the cloud in general still does not have the security regimes needed to satisfy a lot of regulators.” This statement is not based exclusively on the findings of this one report; the company has carried out similar studies with similar conclusions in the life sciences as well with focus on HIPPA compliance with similar conclusions.

It All Comes Down to the Audit

While LogLogic has a direct stake in helping firms overcome auditing angst, the points Roth and Van Den Berghe makes are difficult to take issue with. When asked about what the primary concern was for those they spoke with during their study, there was no question that fear of the almighty audit and its associated fines was enough to make any enterprise think twice about sending their business into a network.

As Bill Roth notes, “At the fundamental business level it is all about audits; the survey calls out that the two most important regulatory regimes people are concerned about are Sarbanes-Oxley and PCIS for credit card processing. SOX is governmental, PCIS is industry-based — people’s biggest concern is not being audited, not getting fined.

An example of the biggest requirements (two biggest) are section 404 of SOX as well as PCI rule 10. If you go to the site, the list of regulations looks scary but it’s not that much (changing default passwords on firewall) but as rule 10 states — you have to log everything; among other things, you are required to log all state changes to your firewalls so when you have an audit, there is a clear audit trail of what went on in the case of a breach.”

Are New Regulations Taking the Cloud into Account?

There is a new version of PCI specific 1.3 is coming out for final draft June 30 that has been modified to address the cloud specifically and to tighten areas of concern about wireless networking, tokenization and cloud as an overarching concept. Tokenization, which refers to personal information being stored as a token rather than a directly-accessible tide of information, is an important issue in current debates about cloud and compliance since it means that privileged data can be stored in a more secure offsite location. Elements of that are taken into consideration to allay concerns about where data is being stored, which helps appease auditors and lawyers.

Bill Roth added to this thought by discussing the HITECH Act of 2009, which just went into effect in February and now adds stiff penalties in the form of dramatic fines and now jail time to the direct misuse and mishandling of personal information. “The effect of this has been both good and bad — laws like this have a chilling effect on the move to cloud for more conservative companies who will now look several times before they engage, but it also motivates the rest of us to do better on security and auditing frameworks and technologies to roll things out sooner — the point is, no one wants to wear an orange jumpsuit.”

It’s Not Just the Enterprise That Should Be Worried…

There is no doubt that the increase in regulation is going to affect far more than the enterprises as they make sure they are compliant. Cloud vendors are going to face mounting challenges as well as they tailor their agreements to be suitable for those businesses who have made the brave decision to put some of their operations into the public cloud in particular.

Chris Hoff, a network and information security architecture expert who currently serves as the Director of Cloud and Virtualization and Data Center Solutions at Cisco Systems stated in January, “Almost all of the cloud providers I have spoken to are being absolutely hammered by customers acting on their ‘right to audit’ clauses in contracts. This is a change in behavior. Most customers have traditionally not acted on these clauses as they used them more as contingency/insurance options. With the uncertainty relating to confidentiality, integrity and availability of cloud services, this is no more. Cloud providers continue to lament that they really, really want a standardized way of responding to these requests.”

Compliance and auditing over time could mean that the ever-so attractive cloud pricing models that have brought some on board already could start to increase as cloud vendors keep pace with the staffing and support required to contend with their end of agreements.

The ultimate question becomes to what degree will compliance alone negate the benefits of using clouds in the first place? And moreover, why should firms bother with clouds when they have much bigger metaphorical fish to fry?

For more on the regulatory environment for another sector that this is of particular importance to, the life sciences industry, check out some of the more recent posts from Bruce Maches.

Subscribe to HPCwire's Weekly Update!

Be the most informed person in the room! Stay ahead of the tech trends with industy updates delivered to you every week!

AWS Embraces FPGAs, ‘Elastic’ GPUs

December 2, 2016

A new instance type rolled out this week by Amazon Web Services is based on customizable field programmable gate arrays that promise to strike a balance between performance and cost as emerging workloads create requirements often unmet by general-purpose processors. Read more…

By George Leopold

AWS Launches Massive 100 Petabyte ‘Sneakernet’

December 1, 2016

Amazon Web Services now offers a way to move data into its cloud by the truckload. Read more…

By Tiffany Trader

Weekly Twitter Roundup (Dec. 1, 2016)

December 1, 2016

Here at HPCwire, we aim to keep the HPC community apprised of the most relevant and interesting news items that get tweeted throughout the week. Read more…

By Thomas Ayres

HPC Career Notes (Dec. 2016)

December 1, 2016

In this monthly feature, we’ll keep you up-to-date on the latest career developments for individuals in the high performance computing community. Read more…

By Thomas Ayres

Lighting up Aurora: Behind the Scenes at the Creation of the DOE’s Upcoming 200 Petaflops Supercomputer

December 1, 2016

In April 2015, U.S. Department of Energy Undersecretary Franklin Orr announced that Intel would be the prime contractor for Aurora: Read more…

By Jan Rowell

IBM and NSF Computing Pioneer Erich Bloch Dies at 91

November 30, 2016

Erich Bloch, a computational pioneer whose competitive zeal and commercial bent helped transform the National Science Foundation while he was its director, died last Friday at age 91. Bloch was a productive force to be reckoned. During his long stint at IBM prior to joining NSF Bloch spearheaded development of the “Stretch” supercomputer and IBM’s phenomenally successful System/360. Read more…

By John Russell

Pioneering Programmers Awarded Presidential Medal of Freedom

November 30, 2016

In an awards ceremony on November 22, President Barack Obama recognized 21 recipients with the Presidential Medal of Freedom, the Nation’s highest civilian honor. Read more…

By Tiffany Trader

Seagate-led SAGE Project Delivers Update on Exascale Goals

November 29, 2016

Roughly a year and a half after its launch, the SAGE exascale storage project led by Seagate has delivered a substantive interim report – Data Storage for Extreme Scale. Read more…

By John Russell

AWS Launches Massive 100 Petabyte ‘Sneakernet’

December 1, 2016

Amazon Web Services now offers a way to move data into its cloud by the truckload. Read more…

By Tiffany Trader

Lighting up Aurora: Behind the Scenes at the Creation of the DOE’s Upcoming 200 Petaflops Supercomputer

December 1, 2016

In April 2015, U.S. Department of Energy Undersecretary Franklin Orr announced that Intel would be the prime contractor for Aurora: Read more…

By Jan Rowell

Seagate-led SAGE Project Delivers Update on Exascale Goals

November 29, 2016

Roughly a year and a half after its launch, the SAGE exascale storage project led by Seagate has delivered a substantive interim report – Data Storage for Extreme Scale. Read more…

By John Russell

Nvidia Sees Bright Future for AI Supercomputing

November 23, 2016

Graphics chipmaker Nvidia made a strong showing at SC16 in Salt Lake City last week. Read more…

By Tiffany Trader

HPE-SGI to Tackle Exascale and Enterprise Targets

November 22, 2016

At first blush, and maybe second blush too, Hewlett Packard Enterprise’s (HPE) purchase of SGI seems like an unambiguous win-win. SGI’s advanced shared memory technology, its popular UV product line (Hanna), deep vertical market expertise, and services-led go-to-market capability all give HPE a leg up in its drive to remake itself. Bear in mind HPE came into existence just a year ago with the split of Hewlett-Packard. The computer landscape, including HPC, is shifting with still unclear consequences. One wonders who’s next on the deal block following Dell’s recent merger with EMC. Read more…

By John Russell

Intel Details AI Hardware Strategy for Post-GPU Age

November 21, 2016

Last week at SC16, Intel revealed its product roadmap for embedding its processors with key capabilities and attributes needed to take artificial intelligence (AI) to the next level. Read more…

By Alex Woodie

SC Says Farewell to Salt Lake City, See You in Denver

November 18, 2016

After an intense four-day flurry of activity (and a cold snap that brought some actual snow flurries), the SC16 show floor closed yesterday (Thursday) and the always-extensive technical program wound down today. Read more…

By Tiffany Trader

D-Wave SC16 Update: What’s Bo Ewald Saying These Days

November 18, 2016

Tucked in a back section of the SC16 exhibit hall, quantum computing pioneer D-Wave has been talking up its new 2000-qubit processor announced in September. Forget for a moment the criticism sometimes aimed at D-Wave. This small Canadian company has sold several machines including, for example, ones to Lockheed and NASA, and has worked with Google on mapping machine learning problems to quantum computing. In July Los Alamos National Laboratory took possession of a 1000-quibit D-Wave 2X system that LANL ordered a year ago around the time of SC15. Read more…

By John Russell

Why 2016 Is the Most Important Year in HPC in Over Two Decades

August 23, 2016

In 1994, two NASA employees connected 16 commodity workstations together using a standard Ethernet LAN and installed open-source message passing software that allowed their number-crunching scientific application to run on the whole “cluster” of machines as if it were a single entity. Read more…

By Vincent Natoli, Stone Ridge Technology

IBM Advances Against x86 with Power9

August 30, 2016

After offering OpenPower Summit attendees a limited preview in April, IBM is unveiling further details of its next-gen CPU, Power9, which the tech mainstay is counting on to regain market share ceded to rival Intel. Read more…

By Tiffany Trader

AWS Beats Azure to K80 General Availability

September 30, 2016

Amazon Web Services has seeded its cloud with Nvidia Tesla K80 GPUs to meet the growing demand for accelerated computing across an increasingly-diverse range of workloads. The P2 instance family is a welcome addition for compute- and data-focused users who were growing frustrated with the performance limitations of Amazon's G2 instances, which are backed by three-year-old Nvidia GRID K520 graphics cards. Read more…

By Tiffany Trader

Think Fast – Is Neuromorphic Computing Set to Leap Forward?

August 15, 2016

Steadily advancing neuromorphic computing technology has created high expectations for this fundamentally different approach to computing. Read more…

By John Russell

The Exascale Computing Project Awards $39.8M to 22 Projects

September 7, 2016

The Department of Energy’s Exascale Computing Project (ECP) hit an important milestone today with the announcement of its first round of funding, moving the nation closer to its goal of reaching capable exascale computing by 2023. Read more…

By Tiffany Trader

HPE Gobbles SGI for Larger Slice of $11B HPC Pie

August 11, 2016

Hewlett Packard Enterprise (HPE) announced today that it will acquire rival HPC server maker SGI for $7.75 per share, or about $275 million, inclusive of cash and debt. The deal ends the seven-year reprieve that kept the SGI banner flying after Rackable Systems purchased the bankrupt Silicon Graphics Inc. for $25 million in 2009 and assumed the SGI brand. Bringing SGI into its fold bolsters HPE's high-performance computing and data analytics capabilities and expands its position... Read more…

By Tiffany Trader

ARM Unveils Scalable Vector Extension for HPC at Hot Chips

August 22, 2016

ARM and Fujitsu today announced a scalable vector extension (SVE) to the ARMv8-A architecture intended to enhance ARM capabilities in HPC workloads. Fujitsu is the lead silicon partner in the effort (so far) and will use ARM with SVE technology in its post K computer, Japan’s next flagship supercomputer planned for the 2020 timeframe. This is an important incremental step for ARM, which seeks to push more aggressively into mainstream and HPC server markets. Read more…

By John Russell

IBM Debuts Power8 Chip with NVLink and Three New Systems

September 8, 2016

Not long after revealing more details about its next-gen Power9 chip due in 2017, IBM today rolled out three new Power8-based Linux servers and a new version of its Power8 chip featuring Nvidia’s NVLink interconnect. Read more…

By John Russell

Leading Solution Providers

Vectors: How the Old Became New Again in Supercomputing

September 26, 2016

Vector instructions, once a powerful performance innovation of supercomputing in the 1970s and 1980s became an obsolete technology in the 1990s. But like the mythical phoenix bird, vector instructions have arisen from the ashes. Here is the history of a technology that went from new to old then back to new. Read more…

By Lynd Stringer

US, China Vie for Supercomputing Supremacy

November 14, 2016

The 48th edition of the TOP500 list is fresh off the presses and while there is no new number one system, as previously teased by China, there are a number of notable entrants from the US and around the world and significant trends to report on. Read more…

By Tiffany Trader

Intel Launches Silicon Photonics Chip, Previews Next-Gen Phi for AI

August 18, 2016

At the Intel Developer Forum, held in San Francisco this week, Intel Senior Vice President and General Manager Diane Bryant announced the launch of Intel's Silicon Photonics product line and teased a brand-new Phi product, codenamed "Knights Mill," aimed at machine learning workloads. Read more…

By Tiffany Trader

CPU Benchmarking: Haswell Versus POWER8

June 2, 2015

With OpenPOWER activity ramping up and IBM’s prominent role in the upcoming DOE machines Summit and Sierra, it’s a good time to look at how the IBM POWER CPU stacks up against the x86 Xeon Haswell CPU from Intel. Read more…

By Tiffany Trader

Beyond von Neumann, Neuromorphic Computing Steadily Advances

March 21, 2016

Neuromorphic computing – brain inspired computing – has long been a tantalizing goal. The human brain does with around 20 watts what supercomputers do with megawatts. And power consumption isn’t the only difference. Fundamentally, brains ‘think differently’ than the von Neumann architecture-based computers. While neuromorphic computing progress has been intriguing, it has still not proven very practical. Read more…

By John Russell

Dell EMC Engineers Strategy to Democratize HPC

September 29, 2016

The freshly minted Dell EMC division of Dell Technologies is on a mission to take HPC mainstream with a strategy that hinges on engineered solutions, beginning with a focus on three industry verticals: manufacturing, research and life sciences. "Unlike traditional HPC where everybody bought parts, assembled parts and ran the workloads and did iterative engineering, we want folks to focus on time to innovation and let us worry about the infrastructure," said Jim Ganthier, senior vice president, validated solutions organization at Dell EMC Converged Platforms Solution Division. Read more…

By Tiffany Trader

Container App ‘Singularity’ Eases Scientific Computing

October 20, 2016

HPC container platform Singularity is just six months out from its 1.0 release but already is making inroads across the HPC research landscape. It's in use at Lawrence Berkeley National Laboratory (LBNL), where Singularity founder Gregory Kurtzer has worked in the High Performance Computing Services (HPCS) group for 16 years. Read more…

By Tiffany Trader

Micron, Intel Prepare to Launch 3D XPoint Memory

August 16, 2016

Micron Technology used last week’s Flash Memory Summit to roll out its new line of 3D XPoint memory technology jointly developed with Intel while demonstrating the technology in solid-state drives. Micron claimed its Quantx line delivers PCI Express (PCIe) SSD performance with read latencies at less than 10 microseconds and writes at less than 20 microseconds. Read more…

By George Leopold

  • arrow
  • Click Here for More Headlines
  • arrow
Share This