Compliance Complexity and the Almighty Audit

By Nicole Hemsoth

June 12, 2010

There are a host of issues that often get wrapped into cloud security discussions ranging from network and data security to the protection of private health and financial information, but for many, security means more than just knowing data is security, it means being able to prove it. In great detail, no less.

Growing regulation governing mounting data complicates efforts for technology to keep pace with the law, which for some industries, barriers to migration for private clouds alone can create enormous challenges. What this all boils down to is compliance and what that can be pared down to, at least on the individual enterprise level, is the notion of the much-dreaded audit.

Audits are not a particular concern for all HPC applications in the cloud, certainly, but for sectors like financial services, this concern is enough to dissuade broad adoption of any cloud model — no matter how tenuous it might be at first. Furthermore, since regulation is swift and revisions are frequent, organizations are understandably concerned about how new regulation might influence their current IT environment.

Grounded Concerns Versus Lofty IT Goals

LogLogic, a San Jose, Calif.-based company offering security and log management services, recently released a report that suggested enterprises are focused on security and compliance over new technology investments. More specifically, LogLogic discussed how financial services firms in particular are still hesitant to adopt cloud — no matter what model or approach. According to their survey, “more than 75 percent of respondents are concerned about increasing government regulation” since, shall we say “enhancement” of existing regulatory measures further complicates IT at every level for those who are under the most compliance-related scrutiny.

Although the report did not go into deep specific differences between private and public clouds, it does highlight some of the critical barriers to wider cloud adoption in industries with intense regulation considerations underpinning nearly every single element of IT. The report was based on surveys with members of some of the largest international banking giants as well as numerous investment and insurance firms. It found, not surprisingly, that security was one of the biggest concerns but wrapped up in that overarching (and valid) concern are the more specific matters of transparency.

Compliance and Security Concern Trump Cloud Investments

The financial services sector is one of the most compelling to watch because they have historically been routine early adopters of technological innovation. Throw in a network, however, and the situation changes dramatically, especially with the increasingly stringent regulations that apply to specific HPC applications in the cloud that deal with personal financial and health information, for example. However, with penalities that are stiff enough to bury companies that are not compliant, the obvious driver here is keeping pace with regulation, certainly not investing in “new” technologies and ways of handling IT that might throw them into ruin.

I talked with LogLogic’s Bill Roth and Lex Van Den Berghe about some of the more specific concerns and trends that reflect the hesitancy of the financial services sector and the word that kept cropping up was “audit.” In addition to more generalized issues about data security as a whole, concerns about audits cannot be underestimated.

As Bill Roth of LogLogic noted, “In terms of the level of security required for those in the financial services industry since they’re so heavily regulated, cloud-based providers and HPC in the cloud in general still does not have the security regimes needed to satisfy a lot of regulators.” This statement is not based exclusively on the findings of this one report; the company has carried out similar studies with similar conclusions in the life sciences as well with focus on HIPPA compliance with similar conclusions.

It All Comes Down to the Audit

While LogLogic has a direct stake in helping firms overcome auditing angst, the points Roth and Van Den Berghe makes are difficult to take issue with. When asked about what the primary concern was for those they spoke with during their study, there was no question that fear of the almighty audit and its associated fines was enough to make any enterprise think twice about sending their business into a network.

As Bill Roth notes, “At the fundamental business level it is all about audits; the survey calls out that the two most important regulatory regimes people are concerned about are Sarbanes-Oxley and PCIS for credit card processing. SOX is governmental, PCIS is industry-based — people’s biggest concern is not being audited, not getting fined.

An example of the biggest requirements (two biggest) are section 404 of SOX as well as PCI rule 10. If you go to the site, the list of regulations looks scary but it’s not that much (changing default passwords on firewall) but as rule 10 states — you have to log everything; among other things, you are required to log all state changes to your firewalls so when you have an audit, there is a clear audit trail of what went on in the case of a breach.”

Are New Regulations Taking the Cloud into Account?

There is a new version of PCI specific 1.3 is coming out for final draft June 30 that has been modified to address the cloud specifically and to tighten areas of concern about wireless networking, tokenization and cloud as an overarching concept. Tokenization, which refers to personal information being stored as a token rather than a directly-accessible tide of information, is an important issue in current debates about cloud and compliance since it means that privileged data can be stored in a more secure offsite location. Elements of that are taken into consideration to allay concerns about where data is being stored, which helps appease auditors and lawyers.

Bill Roth added to this thought by discussing the HITECH Act of 2009, which just went into effect in February and now adds stiff penalties in the form of dramatic fines and now jail time to the direct misuse and mishandling of personal information. “The effect of this has been both good and bad — laws like this have a chilling effect on the move to cloud for more conservative companies who will now look several times before they engage, but it also motivates the rest of us to do better on security and auditing frameworks and technologies to roll things out sooner — the point is, no one wants to wear an orange jumpsuit.”

It’s Not Just the Enterprise That Should Be Worried…

There is no doubt that the increase in regulation is going to affect far more than the enterprises as they make sure they are compliant. Cloud vendors are going to face mounting challenges as well as they tailor their agreements to be suitable for those businesses who have made the brave decision to put some of their operations into the public cloud in particular.

Chris Hoff, a network and information security architecture expert who currently serves as the Director of Cloud and Virtualization and Data Center Solutions at Cisco Systems stated in January, “Almost all of the cloud providers I have spoken to are being absolutely hammered by customers acting on their ‘right to audit’ clauses in contracts. This is a change in behavior. Most customers have traditionally not acted on these clauses as they used them more as contingency/insurance options. With the uncertainty relating to confidentiality, integrity and availability of cloud services, this is no more. Cloud providers continue to lament that they really, really want a standardized way of responding to these requests.”

Compliance and auditing over time could mean that the ever-so attractive cloud pricing models that have brought some on board already could start to increase as cloud vendors keep pace with the staffing and support required to contend with their end of agreements.

The ultimate question becomes to what degree will compliance alone negate the benefits of using clouds in the first place? And moreover, why should firms bother with clouds when they have much bigger metaphorical fish to fry?

For more on the regulatory environment for another sector that this is of particular importance to, the life sciences industry, check out some of the more recent posts from Bruce Maches.

Subscribe to HPCwire's Weekly Update!

Be the most informed person in the room! Stay ahead of the tech trends with industy updates delivered to you every week!

Google Launches New Machine Learning Journal

March 22, 2017

On Monday, Google announced plans to launch a new peer review journal and “ecosystem” Read more…

By John Russell

Swiss Researchers Peer Inside Chips with Improved X-Ray Imaging

March 22, 2017

Peering inside semiconductor chips using x-ray imaging isn’t new, but the technique hasn’t been especially good or easy to accomplish. Read more…

By John Russell

LANL Simulation Shows Massive Black Holes Break “Speed Limit”

March 21, 2017

A new computer simulation based on codes developed at Los Alamos National Laboratory is shedding light on how supermassive black holes could have formed in the early universe contrary to most prior models which impose a limit on how fast these massive ‘objects’ can form. Read more…

Quantum Bits: D-Wave and VW; Google Quantum Lab; IBM Expands Access

March 21, 2017

For a technology that’s usually characterized as far off and in a distant galaxy, quantum computing has been steadily picking up steam. Read more…

By John Russell

HPE Extreme Performance Solutions

HFT Firms Turn to Co-Location to Gain Competitive Advantage

High-frequency trading (HFT) is a high-speed, high-stakes world where every millisecond matters. Finding ways to execute trades faster than the competition translates directly to greater revenue for firms, brokerages, and exchanges. Read more…

Intel Ships Drives Based on 3-D XPoint Non-volatile Memory

March 20, 2017

Intel Corp. has begun shipping new storage drives based on its 3-D XPoint non-volatile memory technology as it targets data-driven workloads. Read more…

By George Leopold

Researchers Recreate ‘El Reno’ Tornado on Blue Waters Supercomputer

March 16, 2017

The United States experiences more tornadoes than any other country. About 1,200 tornadoes touch down each each year in the U.S. Read more…

By Tiffany Trader

Trump Budget Targets NIH, DOE, and EPA; No Mention of NSF

March 16, 2017

President Trump’s proposed U.S. fiscal 2018 budget issued today sharply cuts science spending while bolstering military spending as he promised during the campaign. Read more…

By John Russell

CPU-based Visualization Positions for Exascale Supercomputing

March 16, 2017

In this contributed perspective piece, Intel’s Jim Jeffers makes the case that CPU-based visualization is now widely adopted and as such is no longer a contrarian view, but is rather an exascale requirement. Read more…

By Jim Jeffers, Principal Engineer and Engineering Leader, Intel

Quantum Bits: D-Wave and VW; Google Quantum Lab; IBM Expands Access

March 21, 2017

For a technology that’s usually characterized as far off and in a distant galaxy, quantum computing has been steadily picking up steam. Read more…

By John Russell

Trump Budget Targets NIH, DOE, and EPA; No Mention of NSF

March 16, 2017

President Trump’s proposed U.S. fiscal 2018 budget issued today sharply cuts science spending while bolstering military spending as he promised during the campaign. Read more…

By John Russell

CPU-based Visualization Positions for Exascale Supercomputing

March 16, 2017

In this contributed perspective piece, Intel’s Jim Jeffers makes the case that CPU-based visualization is now widely adopted and as such is no longer a contrarian view, but is rather an exascale requirement. Read more…

By Jim Jeffers, Principal Engineer and Engineering Leader, Intel

US Supercomputing Leaders Tackle the China Question

March 15, 2017

Joint DOE-NSA report responds to the increased global pressures impacting the competitiveness of U.S. supercomputing. Read more…

By Tiffany Trader

New Japanese Supercomputing Project Targets Exascale

March 14, 2017

Another Japanese supercomputing project was revealed this week, this one from emerging supercomputer maker, ExaScaler Inc., and Keio University. The partners are working on an original supercomputer design with exascale aspirations. Read more…

By Tiffany Trader

Nvidia Debuts HGX-1 for Cloud; Announces Fujitsu AI Deal

March 9, 2017

On Monday Nvidia announced a major deal with Fujitsu to help build an AI supercomputer for RIKEN using 24 DGX-1 servers. Read more…

By John Russell

HPC4Mfg Advances State-of-the-Art for American Manufacturing

March 9, 2017

Last Friday (March 3, 2017), the High Performance Computing for Manufacturing (HPC4Mfg) program held an industry engagement day workshop in San Diego, bringing together members of the US manufacturing community, national laboratories and universities to discuss the role of high-performance computing as an innovation engine for American manufacturing. Read more…

By Tiffany Trader

AMD Expands Exascale Vision at IEEE HPC Symposium

March 7, 2017

With the race towards exascale heating up – for example, the Exascale Computing Program PathForward awards are expected soon – AMD delivered more details of its exascale vision at last month’s 23rd IEEE Symposium on High Performance Computer Architecture. The chipmaker presented an “Exascale Node Architecture (ENA) as the primary building block for exascale machine” including descriptions of component, interconnect, and packaging strategy along with simulation benchmarks to bolster its case. Read more…

By John Russell

For IBM/OpenPOWER: Success in 2017 = (Volume) Sales

January 11, 2017

To a large degree IBM and the OpenPOWER Foundation have done what they said they would – assembling a substantial and growing ecosystem and bringing Power-based products to market, all in about three years. Read more…

By John Russell

TSUBAME3.0 Points to Future HPE Pascal-NVLink-OPA Server

February 17, 2017

Since our initial coverage of the TSUBAME3.0 supercomputer yesterday, more details have come to light on this innovative project. Of particular interest is a new board design for NVLink-equipped Pascal P100 GPUs that will create another entrant to the space currently occupied by Nvidia's DGX-1 system, IBM's "Minsky" platform and the Supermicro SuperServer (1028GQ-TXR). Read more…

By Tiffany Trader

Tokyo Tech’s TSUBAME3.0 Will Be First HPE-SGI Super

February 16, 2017

In a press event Friday afternoon local time in Japan, Tokyo Institute of Technology (Tokyo Tech) announced its plans for the TSUBAME3.0 supercomputer, which will be Japan’s “fastest AI supercomputer,” Read more…

By Tiffany Trader

IBM Wants to be “Red Hat” of Deep Learning

January 26, 2017

IBM today announced the addition of TensorFlow and Chainer deep learning frameworks to its PowerAI suite of deep learning tools, which already includes popular offerings such as Caffe, Theano, and Torch. Read more…

By John Russell

Lighting up Aurora: Behind the Scenes at the Creation of the DOE’s Upcoming 200 Petaflops Supercomputer

December 1, 2016

In April 2015, U.S. Department of Energy Undersecretary Franklin Orr announced that Intel would be the prime contractor for Aurora: Read more…

By Jan Rowell

Is Liquid Cooling Ready to Go Mainstream?

February 13, 2017

Lost in the frenzy of SC16 was a substantial rise in the number of vendors showing server oriented liquid cooling technologies. Three decades ago liquid cooling was pretty much the exclusive realm of the Cray-2 and IBM mainframe class products. That’s changing. We are now seeing an emergence of x86 class server products with exotic plumbing technology ranging from Direct-to-Chip to servers and storage completely immersed in a dielectric fluid. Read more…

By Steve Campbell

Enlisting Deep Learning in the War on Cancer

December 7, 2016

Sometime in Q2 2017 the first ‘results’ of the Joint Design of Advanced Computing Solutions for Cancer (JDACS4C) will become publicly available according to Rick Stevens. He leads one of three JDACS4C pilot projects pressing deep learning (DL) into service in the War on Cancer. Read more…

By John Russell

BioTeam’s Berman Charts 2017 HPC Trends in Life Sciences

January 4, 2017

Twenty years ago high performance computing was nearly absent from life sciences. Today it’s used throughout life sciences and biomedical research. Genomics and the data deluge from modern lab instruments are the main drivers, but so is the longer-term desire to perform predictive simulation in support of Precision Medicine (PM). There’s even a specialized life sciences supercomputer, ‘Anton’ from D.E. Shaw Research, and the Pittsburgh Supercomputing Center is standing up its second Anton 2 and actively soliciting project proposals. There’s a lot going on. Read more…

By John Russell

Leading Solution Providers

HPC Startup Advances Auto-Parallelization’s Promise

January 23, 2017

The shift from single core to multicore hardware has made finding parallelism in codes more important than ever, but that hasn’t made the task of parallel programming any easier. Read more…

By Tiffany Trader

HPC Technique Propels Deep Learning at Scale

February 21, 2017

Researchers from Baidu’s Silicon Valley AI Lab (SVAIL) have adapted a well-known HPC communication technique to boost the speed and scale of their neural network training and now they are sharing their implementation with the larger deep learning community. Read more…

By Tiffany Trader

CPU Benchmarking: Haswell Versus POWER8

June 2, 2015

With OpenPOWER activity ramping up and IBM’s prominent role in the upcoming DOE machines Summit and Sierra, it’s a good time to look at how the IBM POWER CPU stacks up against the x86 Xeon Haswell CPU from Intel. Read more…

By Tiffany Trader

Nvidia Sees Bright Future for AI Supercomputing

November 23, 2016

Graphics chipmaker Nvidia made a strong showing at SC16 in Salt Lake City last week. Read more…

By Tiffany Trader

IDG to Be Bought by Chinese Investors; IDC to Spin Out HPC Group

January 19, 2017

US-based publishing and investment firm International Data Group, Inc. (IDG) will be acquired by a pair of Chinese investors, China Oceanwide Holdings Group Co., Ltd. Read more…

By Tiffany Trader

US Supercomputing Leaders Tackle the China Question

March 15, 2017

Joint DOE-NSA report responds to the increased global pressures impacting the competitiveness of U.S. supercomputing. Read more…

By Tiffany Trader

Trump Budget Targets NIH, DOE, and EPA; No Mention of NSF

March 16, 2017

President Trump’s proposed U.S. fiscal 2018 budget issued today sharply cuts science spending while bolstering military spending as he promised during the campaign. Read more…

By John Russell

Intel and Trump Announce $7B for Fab 42 Targeting 7nm

February 8, 2017

In what may be an attempt by President Trump to reset his turbulent relationship with the high tech industry, he and Intel CEO Brian Krzanich today announced plans to invest more than $7 billion to complete Fab 42. Read more…

By John Russell

  • arrow
  • Click Here for More Headlines
  • arrow
Share This