| | DECEMBER 20188CIOReviewMove to the cloud! That is the battle cry heard all across CIO shops as they look to leverage the benefits that cloud computing promises. Most efforts are focused on the technical challenges that such a move requires: Identify which systems to move and when, choose providers, design architectures, and then migrate. Too often, as IT professionals, we overlook the most important aspect of cloud migrations--the cultural changes necessary to make such a migration truly successful. In fact, there are really three cultural changes which must take place if an organization is to be successful in their pursuit of a cloud migration.Culture of the AdministratorThree years ago when I first began discussing the idea of moving to the cloud, the very first group of people to raise concerns were system and network administrators from within my own CIO organization. These were dedicated, hardworking professionals who had spent years, and in some cases over a decade, building and maintaining the existing IT environment. They took great pride in what they had accomplished, and rightfully so. Suddenly, there is talk about "abandoning" what they had built and placing systems and capabilities into an "unknown" environment partially or completely beyond their reach. Next came the questions: "What was wrong with the current way of doing business?"; "Why not spend the money improving our in-house capability?" And most importantly "What is going to happen to my job?" These questions, especially the last one, are key indicators of the need for a culture change. Migrating to the cloud is often seen by administrators as a personal attack, that somebody can do their job better than they can, and these feelings must be addressed for a successful migration to the cloud. It is important to deal honestly with IT staff when discussing a migration to the cloud if you hope to change the existing culture. While one might highlight the benefits of the cloud from a capabilities standpoint (availability, expandability, survivability, etc.) there is much more required. Beyond the benefits, it is necessary to address the future roles of existing staff. Depending on your migration, this may mean they are merely administering boxes they don't physically touch anymore or they might not have those responsibilities at all. You might explain they will do more engineering work or interfacing with customers on requirements. Also, the bills required for a cloud environment become "must pay" vice being able to defer upgrades and replacements to later years due to budget needs. Finally you might explain the new training they will receive and the new marketable skills they will be learning. Whatever the case, just remember, this is personal to them and they need to understand what their role will be in this new world if you expect them to accept and support it.Culture of IT SecurityOrganizational CISO's and the professionals working in SOCs see themselves as the warriors of IT, standing guard at the digital walls of the enterprise, defending against the ever growing digital threats, both externally and internally. They are committed to reducing risks to their organization and beating back the "bad guys" with the tools at their disposal. They work hard to gain and maintain visibility across the entire enterprise in order to detect and deal with threats as early as possible. The cloud holds many challenges for IT Security professionals. Sure, things like FedRamp and Government dedicated clouds seek to alleviate some of these concerns, but they are not completely eliminated. Living in the cloud requires a new mindset for these security professionals.Cloud hosting introduces a large set of unknowns for IT Security professionals. They now have to rely on others outside their organization to help guard against intruders. There is no longer a single digital wall encircling the enterprise, the enemy is everywhere. Defense is now multi-dimensional vice linear and they need a comprehensive knowledge of their new environment. These are all very real concerns and will require a new mindset. You will have to help them understand that their role may be one more of oversight vice "hands on". They have to become the interface to vendors and develop new tools and processes for By Gary Barlet, CIO, USPS OIGCREATING A CLOUD CULTURE Gary Barlet
< Page 7 | Page 9 >