This workshop will take place on 26 April 2024, from 10:00 to 12:30 CEST, and it is jointly organised by GÉANT and EUNIS – the European University Information Systems organisation.
Working in the cloud presents enormous advantages for R&E institutions and community members, but it can also pose particular challenges. To start with, the cloud comes at a loss of direct control over specific locations and hardware; it can sometimes mean more complicated and ambiguous ownership and responsibility for services, software and data; as well as dispersed access and usage protocols and security measures. Keeping control is one of the main challenges of using the cloud as a secure service environment.
During this workshop, different universities will share how they are affected by and how they try to anticipate the challenges of data control and security presented by the cloud. The effects of not having physical control over machines, programs, people, data will be addressed – for instance in relation to ID and access management, data classification, compliance, copyright, pathing – as well as the challenges of migrating to cloud services.
The workshop will also cover national (through NRENs, as in the case of SURF) and international (through GÉANT) security baseline approaches to manage security and actor’s behaviour (e.g. vendors), as well as other cloud security checklist approaches.
Who should attend
This workshop addresses practical matters and is particularly aimed at technical and managerial staff working on and responsible for secure cloud environments, in particular GÉANT NREN cloud service delivery managers and EUNIS SIG Cloud members. Information officers, licensing managers and heads of services & products within universities may also find the workshop beneficial.
Agenda
- 10:00-10:10 CEST – Welcome & opening, introduction of collaborative programme – Denise Dittrich, EUNIS; Maria Ristkok, GÉANT Clouds
- 10:10-10:20 CEST – Brief introductions attendees
- 10:20-10:40 CEST – Setting the stage: Examples of ‘Loss of Control’ challenges for institutions. Different universities will sketch their situation with regard to moving into the cloud while maintaining control, how do they deal with new security challenges.
- Effects of not having the physical control over machines, programs, people, data: e.g. ID/access management/data classification, compliance/copyright, pathing – Espen Grøndahl, Oslo University & Asbjørn Reglund Thorsen, Sikt
- Challenges with migration to cloud services – MS365 example – Dr. Christoph Glowatz, HS Düsseldorf
- 10:40-10:55 CEST – Comments/recognition/additions
- 10:55-11:35 CEST – The SURF security baseline (national approach Netherlands)
- 11:35-12:05 CEST – More Checklists and Baselines
- GEANT-NREN security baseline – Including a comparison with the SURF baseline – Alf Moens, GÉANT
- Checklist/Questionnaire for the Procurement of Cloud-Services in practice – the Stuttgart University approach – Oliver Göbel, University of Stuttgart
- GÉANT cloud checklist – Including security requirements – Garvan Mc Feeley, HEAnet
- 12:05-12:20 CEST – Q&A / Open discussion
- Any other checklists and facts sheets used?
- Examples of approaches/solutions that worked/failed?
- Moving to the cloud, what to do first to keep control, and stay secure?
- 12:20-12:27 CEST – Evaluation and poll
- 12:27-12:30 CEST – Closing – Denise Dittrich, EUNIS; Maria Ristkok, GÉANT Clouds
Notes:
- Presentations will be recorded and made available via GÉANT and EUNIS
- Discussions will not be recorded but will be reported on in an article
- Registration and approval are required prior to attending the workshop