Decide the Blockers: “What has – or will – stop us?” Time Budget Resources Culture Skills Gap Bureaucracy Assess Internal Readiness: “Where are we now?” “How do we qualify ourselves?” Levels 1-6 Confirm Use Cases: “Who is this for – do they want it – will they use it?” Choose from at least 44 Use Case examples Assess Intended Adoption: “What is the consumption [rate] for our Big Data initiative – per Use Case?” (Levels 1-6) Assess Costs: “What’s our Bottom’s Up Costs?” People Hardware Software Licenses Data Center(s) Backup/DR Storage Network Vendors Data Cleansing Support Deploy User Training UAT User Rollout Develop Internal Bill-Of-Material (BoM): “What is the break-down if we had to hand over a BoM” Bill-of-IT Other Cost Centers Business Units – Marketing/Finance/Sales/HR) Which Data?: “How do we decide on which Data to evaluate?” CAP Theorem-per Distributed Systems
Capability Service Abstraction Need some introductory words… Security and Privacy Management Security and Privacy topics have been the subject of multiple standards efforts as offered by the following table. Requirement Standards Group Related Standards Infrastructure Security INCITS CS1 & ISO/IEC JTC 1/SC 27 ISO/IEC 15408-2009 Information technology — Security techniques — Evaluation criteria for IT security ISO/IEC 27010:2012 Information technology — Security techniques — Information security management for and inter-organizational communications ISO/IEC 27033-1:2009 Information technology — Security techniques — Network security ISO/IEC TR 14516:2002 Information technology — Security techniques — Guidelines for the use and management of Trusted Third Party services Data Privacy ISO/IEC 29100:2011 Information technology — Security techniques — Privacy framework Data Management, Securing data stores, Key management, and ownership of data ISO/IEC 9798:2010 Information technology — Security techniques — Entity authentication ISO/IEC 11770:2010 Information technology — Security techniques — Key management Integrity and Reactive Security ISO/IEC 27035:2011 Information technology — Security techniques — Information security incident management ISO/IEC 27037:2012 Information technology — Security techniques — Guidelines for identification, collection, acquisition and preservation of digital evidence Table Name Here:------> Each of these standard efforts by various organizations must coordinate and calibrate their efforts into a complementary series of standards that do not muddy the compliance waters resulting in an intuitive sequence of guidelines that are not open to multiple interpretations. Each organization needs to have their standards reviewed and mechanisms identified to apply these complimentary capabilities to the data service abstraction layer. How to transform these standards into a beneficial tool (one among many) in the areas of security and privacy is demonstrated by the following Audit/Digital Forensics RACI Matrix: Big Data Supporting: Security & Privacy (Audit/Digital Forensics) Baseline Management Reference Checklist for RACI (Responsible, Accountable, Consulted & Informed) Big Data Security & Privacy (Audit/Digital Forensics) RACI Checklist (Responsible, Accountable, Consulted & Informed)