I need to help!

10/100/1000 Etherner 2Oz Bluetooth 207 Cable line 209 Cloud 199 Commerce server 212 Content deliverynetwork (CDN) Z2O Database tier 212 Digital subscriber line (DSL) 208 Domain name 2ll Elastic 199 Encapsulated 2Is Ethernet 207 File Transfer Protocol (ftp) 2lZ Hop 209 https 217 Hypertext Transfer Protocol

(http) 2tz ICANN (Internet Corporation for

Assign-ed Names and Numbers) 2L0

IEEE802.3protocol 202 IEEE 802.11 protocol 202

Infrastructure as a service (IaaS) ZIg Internet 206 Internet seMce provider (ISp) ZOB Intranet 206 IP address 2L0 IPv4 2ll IPv6 2ll Local area network (LAN) 206 Network 206 Over the Internet 201 Packet analyzer 230 Packetsniffers 230 Platform as a seryice (paaS) 2Ig Pooled 200 Private cloud. 224 Private IP address 2lO Protocol 206 Public IP Address 2LO Remote action system Z2B Servertier 212 Service -oriented architecture

(soA) 2t3

,*#

Using Your Knowledge

Simple Mail Tiansfer Protocol (smtp) zt7

Small office/home office (soHo) 206

Software as a service (SaaS) Zlg TCP/IP protocol architecture 216 Telediagnosis 228 Telelawenforcement 228 Telesurgery 228 Textmining 233 The lnternet zOG Three-tierarchitecture 212 Tunnel 224 URL (Uniform Resource

Locator) 2lL User tier 2L2 Virtual private cloud (VpC) 225 Virtual private network (VpN) 223 WANwireless 209 Web page 2t2 Web servers 212 Wide area network (WAN) 206

MyMlSLab Go to mymislab.com to comprete the probrems marked with this icon ft.

6-1. Define cloud and explain the three key terms in your definition. Using Figure 6-3 as a guide, compare and contrast cloud-based and in-house hosting. In your opinion, explain the three most important factors that make cloud-based hosting preferable to in_house hosting.

6-2. Apple invested more than $1 billion in the North Carolina data center shor,rm in Figure 6-2. For Apple to spend such

. a sum, it must perceive the iCloud as being a key com_ ponent of its future. Using the principles listed in Figure 3-12 (page 95), explain all the ways that you believe the iCloud will give Apple a competitive advantage over other mobile device vendors.

6-3. Suppose you manage a group of seven employees in a small business. Each of your employees wants to be con_ nected to the Internet. Consider two alternatives:

Alternative A: Each employee has his or her olrm device and connects individually to the lnternet.

Alternative B: The employees, computers are connected using a LAN, and the network uses a single device to con_ nect to the Internet. a. Sketch the equipment and lines required for each

alternative. b. Explain the actions you need to take to create each

alternative. c. Which of these two altematives would you recommend?

6-4. Go to http://aws.amazon.com and search for AWS da_ . tabase offerings. Explain the differences among Simple

Database Service, Amazon Relational Store, and MongoDB. \iVhich of these three would you recommend for storing AllRoad parts' 3D printing design files? (By the way, whenever you query the Internet for any AWS

236 cHAPTEFI ei The Ctoud

product, be sure to include the keYword AI4IS in your

search. Otherwise, your search will result in Amazon's

lists of books about ihe item you're searching for')

6-5. Suppose Lucas wants AllRoad to set up a private internet'

andie justifies this request on the basis of better security'

Using the collaboration IS you built in Chapter 2 (pages

rc-74), collaborate with a group of students to answer the fol-

lowing questions.

The cloud is causing monumental changes in the informa-

tion systems services industry' In every c'ty' Y,o'will still see

the trucks of local independent software vendors (ISVs) driv-

ing to their clients'o '"t "p and maintain local area networks'

,"it"rr, and software' Youi[ know the trucks by the Microsoft'

Otu"l", and Cisco logos on their sides' For years' those small'

local colnpanies have surwived' some very profitably' on their

ubrt rr ro set up and maintain LANs' connect user computers

to the Internet, set up servers' sell Microsoft Exchange licenses'

and install other software on both servers and user computers'

Once everything is installed'' these companies continued

to earn revenue by providing maintenance for problems that

inevitably developed and support for new versions of software'

connecting new user computers' and so forth' Their eustom-

"rr rrury, b"ut generally are smaller companies

of' say' 3 to 50

employees-companies that are large enough to need email'

Internet connections, and possibly some entry-level software

applications such as QuickBooks'

1. Using the knowledge of this chapter alit ttre intuition of the

members of your i"u*' *t'*t"arize threats that cloud ser-

vices Present to such ISVs'

2. Suppose your team owns and manages one of these ISVs'

You learn that more and more of your clients are choosing

SaaScloudserviceslikeGoogleforemail,ratherthanset- ting uP local email servers'

a. \try'hat, if anl'thing, can you do to prevent the encroach-

ment of SaaS on Your business? -:.

FinQtoud Forever ' ' 'Wett, at Least for

In 1937, the Securities and Exchange Commission (SEC) set

out rules that stipulated records retention requirements for

securitiesbrokersanddealers.TheSEC!Concernwas(and ;Jt;;;ffi ofi!'financial transactionsrnot be altered

after

the fact, that they be retained for a stipulated period of time'

Explain why that is not a good decision' and rebut his

claim about security by suggesting that AlIRoad use a

VPC. Iustiff Your suggestion'

6-6. In five sentences or less' explain how the cloud will affect

job prospects for you between now and2024'

Given your answer to question 2a' identif,i three alterna-

tive waYs You can resPond'

,*t.i ot,n" three responses identified in your answer

to question 2b wouldyou choose? |ustiffyour choice'

3. Even if SaaS eliminates the need for email and other local

servers, there will still remain viable services that you can

provide. Name and describe those services'

4. Suppose instead of attempting to adapt an existing ISV to the

thr# of cloud services, you andyour teammates decide to set

up an entirely new business' one that will succeed in the pres-

ence of SaaS and other cloud services' Looking at businesses

in and around yonr campus' identifir and describe the IS

needs those businesses will have in the cloud services world'

5. Describe the IS services that your new business could pro-

videforthebusinessneedsyouidentifledinyouranswerto question 4.

6. Given your answers to questions l-5''would you rather be

an existing ISV attempting to adapt to this new world or an

entirely ,r"* .o-put'yt Compare and contrast the advan-

tages and disadvantages ofeach alternative'

7. Changing technology has' for centuries' eliminated the

need for certain ptod"tt' and services and created the

need for new products and services' What is new' today'

however, is the rapid pace at which new technology is cre-

ated and adapted' Using cloud services as an example' cre-

ate a statement of the f,osture that business professionals

should take with t"gu'd to technology in order to thrive in

this fast-changing et''ironment' Notice the verb in this as-

signment is thriue, andnotittsl suruiue'

th6 Required lnterval' ' ' and that indexes be created so that

the records can be readily

searched.

In 1937, the rules assumed that such records were recorded

on paper media' With the rise of information systems storage'

in 1997 the SEC updated the rules by stating that such records

,caur be kept electronically, provided that the storage devices lilE rqrite once, read many times (WORM) devices. This rule rmns readily accepted by the financial services industry because tffiefrrst CDs and DVDs were WORM devices.

Howeveq, as technology developed, broker-dealers andnowever, as tecnnology oeveropeo, oroK mrfter financial institutions wanted to store records using regu- iltur disk storage and petitioned the SEC for guidance on how dfrey might do that. In May 2003, the SEC interpreted the rule lflnr enable the storage of such records on read-\,\Tite medium, pruvided that the storage mechanism included software that runruld prohibit data alternation:

A broker-dealer would not violate the requirement in paragraph (fX2XiiXA) of the rule if it used an electronic storage system that prevents the overvlriting, erasing or otherwise altering of a record during its required retention period through the use ofintegrated hardware and software control codes. Rule I7a-4 requires broker- dealers to retain records for specified lengths oftime. Therefore, it follows that the non-erasable and non-rewriteable aspect of their storage need not continqe beyond that period.

The Commission's interpretation does not include storage sys- tems that only mitigate the risk a record i,vill be overwritten or erased. Such systems-which may use software applications to protect electronii records, such as authentication and approval policies, passwords or other extrinsic security controls-do not maintain the records in a manner that is non-rewriteable and non- erasable. The external measures used by these other systems do not prevent a record from being changed or deleted. For example, they might limit access to records through the use of passwords. Additionally, they might create a "finger print" of the record based on its content. If the record is changed, the fingerprint will indicate that it was aftered (but the original record would not be preserved). The ability to ovgrurite or erase records stored on these systems makes them non-compliantwith Rule l7a- (f).s

Notice the SEC specifically excludes extrinsic controls such i6 authentication, passwords, and manual procedures because It believes it would be possible for such systems to be readily ,misused to overwrite records. The SEC is striking a fine line in 'this ruling; if, for example, someone were to tamper with the

Case Study 5 237

storage systems' software, it would be possible to overwrite data. Apparently, the SEC assumes such tampering would be illegal and so rare as to not be a concern.

Given this ruling, organizations began to develop systems in compliance. The NASDAQ OMX Group, a multinational cor- poration that owns and operates the NASbAQ stock market as well as eight Euroilean exchanges, began to develop FinQloud, a cloud-based storage system that was developed to be com- pliant with the SEC's (and other regulating organizations') rulings. NASDAQ OMX operates in 70 different markets, in 50 countries worldwide, and claims that it processes one out of 10 stock transactions worldwide. lo

Figure 6-25 shows the fundamental structure of the FinQloud system. On the back end, it uses Amazon's 53 prod- uct to provide scalable, elastic storage. When financial in- stitutions submit records to FinQloud for storage, FinQloud processes the data in such a way that it cannot be updated, encrlpts the data, and transmits the processed, encrypted data to AWS, where it is encrypted yet again and stored on 53 devices. Data is indexed on 53 and can be readily read by au- thorized users. NASDAQ OMX then claimed that FinQloud's processing and encryption is done is such a way that it meets the SEC requirement.

Of course, NASDAQ OMX knew that this statement would be perceived as self-serving, so it hired two independent companies to verify that claim: Jordan & Jordan, a securi- ties industry consulting company, and Cohasset Associates, a document-processing consulting company. According lo The Wall Street Journal, both organizations concluded that when properly configured, FinQloud meets the requirements of the SEC's rule (Rule 17a-3) as well as a similar rule set out by the Commodities Futures Trading Commission. I I

Consequently, NASDAQ OMX customers can use FinQloud and as long as they can demonstrate that they have properly configured it, their auditors will find this systein to be in com- pliance with the SEC rulings.

Figure 6-25 Domponents of the Fin0toud System

fu.S. Securities and Exchange Commission, "SEC Interpretation: Electronic Storage of Broker-Dealer Records," Iast modified May 5, 2003, W : / / www. sec. go u/ r u I es/ i n t e r p/ 34 - 4 7806.h lm.t'NASDAq OMli "NASDAQ OMX FinQloud," accessed May 2013, http://wwunasdaqomx.com/technologlt/yourbusiness/finqloud/. ItGreg MacSweeney, "Nasdaq OMX FinQloud R3 Meets SE-C/CFTC Regulatory Requiiements, Say Consuliantsi' April ts,i}Ib, 'hnp://www.wallstreetandtech.com/data-management/nasdaq-omx-finqloud-r3-meets-seccfrc-re9240152909.

238 cHAprEFl e The Ctoud

GIUESTIctNb

6-7. In your own words, summarize the dealer-broker record retention requirements.

6-8. Reread the SEe 's 2003 interpretation. In your own words, explain the difference between "integrated hardware and software control codes" and software applications that use "authentication and approval policies, passwords, or other extiinsic controlsl'Give an example of each.

6-9. Clearly, in the view of the SEC, the likelihood of compro- mise of an integrated system of hardware and software is considerably less than the likelihood of'compromise of a system of authentication, passwords, and procedures. fustifu this view

6-10. Do you agree with the view in question 6-9? \Mhy or why not?

6-ll. Investigate |ordan & Jordan' (wwwjandj.com) and Cohasset Associates (www.cohasset.com). If you were a consultant to a financial institution, to what extent would you rely on the statements of these organizations?

6-12. If you were a consultant to a financial institution, what else might you do to veri$z that Fineloud complies with the SEC ruling and its 2003 interpretation?

6-13. Explain how the knowledge that you have gained so far in this course helps you to understand the SEC,s 2003 interpretation. Summarize how your knowledge would help you if you worked for a financial institution. Cast your answers to this question in a way that you could use in a job interyiew.

MyMlSLab Go to mymislab.com forAuto-graded writing questions as well as the following Assisted-graded writing questions;

6'14. suppose that you work atAllRoad parts and Kelly tells you that she doesnt believe that cheap,elastic provisioning of servers is possible.,,There has to be a catch somewhere," she says.Write a one-page memo to her explaining how the cloud works. ln your memo, include the role of standards for cloud prlcessing.

6' I 5. Suppose you manage .a sales department that uses the SaaS product Salesforce .com. one of your key salespeople refuses to put his data into that system...l just dont believe that the competition cant steal my data, and I'm not taking that risk." How do you respond to him?

5- !5. Mymislab only - comprehensive writing assignment for this chapter.