As more organizations embrace cloud-based services, securely migrating to the cloud is becoming an important capability. Keith Weller, former Vice President, Enterprise Technology Services, American Cancer Society (ACS), spearheaded a highly successful migration initiative where they transitioned a 5000-square-foot donation processing on-premise data center to the cloud. Keith and his team completed the implementation on time (in eight weeks), under budget, and helped the organization realize savings of $18 million in real estate and $2 million in technology costs (projected over three years). In this podcast, Keith shares some highlights of this cloud migration best practice.

Time Stamps

00:49 -- Keith, share some highlights of your professional journey.

03:27 -- Provide the listeners with a context for what led the American Cancer Society to consider moving to the cloud.

07:56 -- Based on a discussion that we were having to plan this podcast, you mentioned that you will have to get it done in about three months. Is that correct?

11:03 -- Is there anything else that you would like to share, by way of highlights, when you all were planning the migration and then implementing it?

15:52 -- Talking about the security aspect of the migration, you mentioned following the NIST cybersecurity framework, and complying with the PCI DSS requirements. During our planning meeting, you shared some of the accomplishments under the categories of identify, protect, detect, respond, and recover. Would you like to provide listeners with certain specifics, like what they should be mindful of when they have to undertake such an initiative?

18:04 -- You mentioned the migration vendor. I'm sure listeners might be curious to know how to identify such a vendor. And what factors go into the selection process? And how valuable did you find their service?

20:59 -- For this particular migration initiative, you all decided to go with Microsoft Azure. I assume that is because American Cancer Society was heavily invested in the Microsoft platform, and it made logical sense to stay with the same ecosystem to reduce application dependency-related challenges. Is that what your advice will be for organizations looking to identify a suitable cloud service provider? How should they go about the cloud vendor selection process?

23:15 -- Keith, what is your thought on the challenges that I gleaned from the State of the Cloud report? Do you agree with them?

28:25 -- I think that maybe the SLAs should be written up in a manner and a fashion whereby there should be more joint responsibility and joint accountability. The service provider and client should work as a team to ensure the data is safe, and secure, and there's a constant review to ensure the security level and posture are being maintained. What are your thoughts?

31:57 -- Anything in particular that you want to touch upon in the context of the phased migration effort?

37:47 -- So Keith, I'd like to give you the opportunity to say a few final words before we close our discussion for today.

Memorable Keith Weller Quotes/Statements

"Being in the cloud actually makes it a lot easier to govern your security, have better visibility of your assets, and make quicker security improvements."

"If you're trying to do very challenging, time-constrained work, having everyone engaged and bought into the process is very important. And having a clear vision and goals is also important."

"It would be nice if the three big cloud providers were more engaged as a team, securing data and helping make sure that they partner with their customers to ensure that's done right."

"And it's not just infrastructure people, it's not just security people, but it's also important for Development and QA to understand those core principles of security."

"Every dollar that's spent on operational costs is a dollar taken away from cancer research or services."

Connect with Host Dr. Dave Chatterjee and Subscribe to the Podcast

Please subscribe to the podcast, so you don't miss any new episodes! And please leave the show a rating if you like what you hear. New episodes release every two weeks.

Connect with Dr. Chatterjee on these platforms:

LinkedIn: https://www.linkedin.com/in/dchatte/

Website: https://dchatte.com/

Cybersecurity Readiness Book: https://www.amazon.com/Cybersecurity-Readiness-Holistic-High-Performance-Approach/dp/1071837338

Welcome to the Cybersecurity Readiness Podcast

Series with Dr. Dave Chatterjee. Dr. Chatterjee is the author of

the book Cybersecurity Readiness: A Holistic and

High-Performance Approach, a SAGE publication. He has been

studying cybersecurity for over a decade, authored and edited

scholarly papers, delivered talks, conducted webinars and

workshops, consulted with companies and served on a

cybersecurity SWAT team with Chief Information Security

officers. Dr. Chatterjee is Associate Professor of

Management Information Systems at the Terry College of

Business, The University of Georgia. As a Duke University

Visiting Scholar Dr. Chatterjee has taught in the Master of

Engineering in Cybersecurity program at the Pratt School of

Engineering.

Hello, everyone, I'm delighted to

welcome you to this episode of the Cybersecurity Readiness

Podcast Series. Our discussion today will revolve around

securely migrating to the cloud. Our guest speaker Keith Weller

is the Chief Information Security Officer at

International Market Centers. He has had some great experience

leading American Cancer Society's (his previous

employer), cloud migration initiatives. I've had the

pleasure of knowing Keith for a while, he's been a guest speaker

in my professional MBA class, he talked about this cloud

migration initiative in my class, and I felt that this was

a best practice that could benefit the wider professional

community. So I'm delighted that Keith is going to be spending

some time on the show today, talking about this initiative.

Keith, welcome! Before we get into the details, please share

some highlights of your professional journey.

Thanks, Dave. I'm really happy to be here. So

yeah, over the past 20 years, I've had experience in security

and infrastructure, primarily in the FinTech nonprofit, and now

currently real estate retail sectors. The last three years,

I've been focusing mainly on security and cloud. In previous

roles I have built out offshore BPO and an internal SOC

capability for FinTech, which was one of the Forbes fastest

growing companies list for over five years straight. I developed

infrastructure and security for a leading edge SaaS platforms

for the financial and health services customers. In my

American Cancer Society (ACS) role, I consolidated, cost

optimized, and made highly available infrastructure for a

segment at American Cancer Society, nonprofit that unified

organizationally for the first time in 100 years. With that I

saved over 20 million per year. And one of the big projects

which we're all probably talking about was migrating 5000 square

foot donation processing on-premise data center to the

cloud in eight weeks. As part of that, I help them mature the

speed of business capabilities and our security posture. And

the past year, I've been with International Market Center,

where I have greatly improved the security posture, including

security oversight for launch of a global buyer seller ecommerce

marketplace.

Fantastic. In fact, listeners might be

interested in hearing about some of the stats that I've gleaned

from the Flexera State of the Cloud report. It's the latest

report, the data was collected in late 2021. There were 753

respondents, the organizations range from ones with 100

employees, right up to once with 10,000 plus employees. So they

had a pretty broad cross section of organizations. The

respondents were global cloud decision makers and users. So

it's a very comprehensive and well done report. They publish

it every year, and I follow it religiously. A couple of things

I wanted to highlight here, just to further contextualize our

discussion, especially the significance of the discussion.

First, the fact that cloud adoption continues to become

more mainstream, second, heavy users, that is those who are

running more than 25% of the workload in the cloud, are up to

63%, an increase from 59% in 2021. Also, another interesting

finding is that more than half of the respondents are planning

to move at least some of their sensitive data to the cloud. And

when it comes to cloud challenges, security continues

to be the number one challenge for the last 10 years. So

therefore, to have somebody like Keith, talk to us about cloud

migration, of migrating to the cloud, and how to do it securely

is a terrific opportunity. So Keith, coming back to you,

provide the listeners with a context as to what led American

Cancer Society to consider moving to the cloud.

Yeah. So before this major migration, we were

already in Azure for about three years. But it was not a

significant portion of our of our business processes, we did

migrate to Office 365, for our email moving off of Lotus Notes

previously, as well. But the big driver for this was, a lot of

this happened during the COVID 19 pandemic, American Cancer

Society is very dependent, or was at the time very dependent

on in person events. And because of that, we were looking at a

$200 million per year revenue shortfall. Wow. So across the

organization, we had to find ways to either make up that

money through additional revenue opportunities or reduce costs.

And at the time, we had an on- premise data center that was in

locally in our headquarters in downtown Atlanta. And it was

very costs not just the data center that we had, but also the

real estate that we were in was very costly. So in order to

vacate that real estate, we also had to vacate the data center.

By doing that, it would save us about 600,000 per month for

lease costs, and a data center reduction of 162k. Additionally,

we were the previous year, we did a digital transformation

where we moved a lot of our CRM and ERP to SaaS based solutions.

But didn't we wanted to make sure that we've kind of had that

that's speed of execution that cloud provided. There are a lot

of opportunities to overall increase and I feel being in the

cloud actually makes it a lot easier to govern your security

and have better visibility of your assets and, and make

quicker security improvements. So that was another big factor

of that. And it also allowed us to better enable disaster

recovery, because this was a systems that we had was for

primarily for donation processing. So we need a really

rock solid system. So it allowed us to improve our disaster

recovery and availability and things like that. So those are

kind of the big drivers for that project.

That was quite an undertaking. And again,

based on our discussion that we were having to plan this

podcast, you mentioned that you'll have to get it done in

about three months. Is that correct?

Yeah, that's correct. We were trying to make

quick decisions and find quick ways to reduce costs. Basically,

I got a call one day from our head of real estate wasn't

really super knowledgeable with technology and basically asked,

How can you get out of the datacenter by the end of the

month? And I said, Well, that's definitely challenging. I did

take some videos and pictures just to maybe give a conceptual

idea of what was in there, because it was 5000 square foot

data centers, there was a significant amount of work to

vacate that. But so we did have a aggressive timeline. At first,

I thought, hey, this is a good challenge. I think we can do

this. I think this could help the organization if we can do it

quickly. So I said, let me get back to you. And let's see what

we can do. The other part of that was that this was a

business critical system that was responsible for our donation

processing at a time where our revenue was down. So we cannot

afford any other kind of hiccups in our downtime. It was a PCI

DSS regulated environment. So there was a lot of security

links to that where we had to make sure where we were going

was set up very well from a security perspective and had

good security foundations. We actually before that, we didn't

have really good data and application inventory. So we had

to work on kind of rationalizing that environment. As you as if

you just move throw everything in the cloud, it can get quite

expensive. So the more we could kind of reduce that footprint,

the better. So we needed to make sure we were very clear on how

our data and our applications work. So, when we moved up

there, things would continue to flow. And the, just getting out

of that on-premise data center was probably the most complex

effort IT related effort ever undertaken. And it was the most

difficult part of actually exiting that that real estate.

So it was it was a big challenge. But I met with the

team. And I said, and I came up with three months. And I said,

why can't we do three months. And we basically talked through

all the blockers, and the options, and we determined that

if we did an all-hands-on-deck, we could accomplish that. It was

a challenge for everyone, but we we knew it was important. And we

basically stack ranked our options. And we tried to

quantify with the best approach. So that actually helped us think

through all the challenges and potential timelines. And we

actually ended up accomplishing the mission and doing it on time

and under budget.

Incredible. As you share this experience, it

brings back memories of a few other very successful technology

driven business transformations, which were done on time and

under budget. One commonality across these transformation best

practices is that they were all motivated by a critical business

need. In this particular case, as you mentioned, Keith, loss of

revenue was the primary driver. And that got everybody involved

and engaged. So there was an organization wide buy in. Also,

when you say that it was an all hands on deck kind of an

operation. And I'm thinking about some of the details that

you shared with me earlier. It's very encouraging, that the team

comprised off not only the technology people, but also the

business people. So there was cross functional involvement,

which is exactly how any kind of technology driven change must be

managed. And so this is so good to hear. Thanks for sharing. Is

there anything else that you would like to share, by way of

highlights when you all were planning the migration and then

implementing it?

Yeah. So I would definitely agree, agree that

buy-in is is key, if you're trying to do very challenging,

time constrained work, having everyone engaged and bought in

to the process. And having a clear vision and the goals

across the whole team is really important. So for sure, when

when we did this project, everyone was bought in, I was

the project sponsor, as well as the tech lead. So I was

responsible for bringing together all these cross

functional teams and included all of my all key members of IT

included security, quality assurance, the supply chain,

legal, then we had people from the business that had to do the

testing, we had to coordinate with them, we had to make sure

certain things were done during certain accounting periods of

the month, so that things wouldn't be affected. So that

was really important. Additionally, we engaged with a

migration vendor, because it was obviously a pretty big task, we

didn't want to kind of learn along the way in eight weeks, it

wouldn't work. So we engaged with them. And as a kind of a

combined partner with ACS, we had a combined team. And we just

had to keep focused, not get distracted. And so we were using

Microsoft Azure for about three years. A lot of people were

familiar with it. But there were also new people in IT that were

kind of learning and we didn't want them to be kind of like

asking a bunch of questions that weren't, like aligned with kind

of the mission, right? We wanted to just keep focused, not get

distracted. And a lot of times, there's decisions that come

along the way and you want to try and make those decisions

quick. So it doesn't sort of slow down the process. And we

try to go with as much as best practice and if there was some

discrepancy of using best practices, like why shouldn't we

use it, so it kept us a little focused, better focus that way.

And that really helped us we we tried to make sure that security

was ingrained in every step of the process. Again, it was a PCI

environment, and generally as a security professional, I want to

make sure that's a foundation of anything we do. Today. We had

our IT architects that were responsible for helping provide

the scope of work We had a hybrid environment and making

sure all the documentation was available. And just having kind

of that, again, that all-hands-on-deck mentality,

let's get this done, let's be focused, we had the help of the

project management team to keep us laser focused as well and

making sure that we're properly communicating with the business

partners. Sometimes when you're doing a project this complex,

you don't want to miss some communication, and people are

expecting something and then some some form of the business

comes, comes to a stop, especially one revenue

generation is so important. So yeah, it was it was I was

actually very proud of the whole experience just because we work

all together as a team that just get get important things done.

And it really helped from a financial standpoint.

Yeah, that's quite phenomenal. quite

phenomenal. Talking about the security aspect of the

migration, you mentioned following the NIST cybersecurity

framework, and complying with the PCI DSS requirements. During

our planning meeting, you shared some of the accomplishments

under the categories of identify, protect, detect,

respond, and recover. Would you like to provide listeners with

certain specifics, like what they should be mindful of when

they have to undertake such an initiative?

Yeah, so I think the key thing here is making

sure that your asset, your application is fully documented,

your data flows are fully documented that you, you want to

make sure, especially when you're moving and we did a sort

of a lift and shift to the cloud, that you do not have,

you're not properly securing various aspects of that data

flow. So to make sure that proper foundations are in place,

when we move, move those applications and data to the

cloud, that's a key thing with and a lot of that is working

with architecture, application architecture team, working with

the security team, you know, it being a PCI DSS regulated

environment, we definitely worked very closely with our

migration partner, to make sure that we had the right blueprints

in place and the foundations in place, there's actually PCI DSS

blueprints that that we used to make sure the foundation was

right. And also make sure that all of your kind of your

security configurations are correct, in the firewall, and

the network security groups and things like that. We did do a

external pen test afterwards, just to make sure that we didn't

kind of miss some key NIST security controls. Because

again, it was it was very important to highly secure the

environment.

Yep. That makes a lot of sense. In fact,

you mentioned about this migration vendor. I'm sure

listeners might be curious that how do you go about identifying

such a vendor? And what, what factors goes into the selection

process? And how valuable did you find their service?

Yeah, so, it sort of starts with the actual, I

guess from the start, we started with a concept, how quickly can

we get out of the data center. So we did explore four different

options. One was a virtual lift and shift to Azure, which was

our existing cloud partner at the time. Another was we had a

colocation facility in Austin, Texas, we were looking to

potentially migrate there. And then we were looking at a

physical and virtual lift and shift to new equipment in

Atlanta. And based on all those and kind of our quantitative

approach to comparing the options, we definitely decided

that moving to Azure was the quickest and most likely cost

conscious, the lowest risk, and a lot. And also, obviously,

being in the cloud allows you to be more quick to innovation and

things like that. So we started with that. And then since it was

a nonprofit, we had a Microsoft partner that works with

nonprofit and government and things like that. And they they

actually recommended a few migration partners, and we ended

up going with one that was very experienced with this and they

actually have they I think they actually created the the actual

migration tool that Microsoft uses for a lot of these

initiatives. So they definitely seemed like the right fit for

us. We were lucky, as a nonprofit, we were able to find

some funding to make the cost of migration, significantly less,

which obviously, that helped with the other part of the

financial discussion. So, yeah, that and they they did really

well, they were very methodical, you could tell that they've done

this many times before. And they they, like I said, they helped

keep us on track. They, they, they did these rapid pace

migrations. So it helped having that experience. They were very

technical, too. So there was really no period where we felt

like we were kind of stuck or kind of couldn't get past a

hurdle, because they've really had a lot of good answers.

Because of that experience.

That's good to know. And this is very useful

information for folks who are planning such a migration. For

this particular migration initiative, you all decided to

go with Microsoft Azure. I assume that is because American

Cancer Society was heavily invested in the Microsoft

platform, and it made logical sense to stay with the same

ecosystem to reduce application dependency related challenges.

Is that what your advice will be for organizations looking to

identify a suitable cloud service provider? How should

they go about the cloud vendor selection process?

Yeah, I think I think it depends on the

organization for for us to be honest, as a nonprofit,

Microsoft gave us very significant funding for this

project. In my view, there is some, since we already had O 365

(Office 365) as well, we were already using their identity and

access management solution. So there was sort of a tie in

there, it and again, since we already had that footprint, we

had eight weeks, obviously, Google and Amazon have great

products. But if you're trying to do this at rapid pace, it's

there's a lot less barriers, if you're using an existing vendor,

where you already have sort of that core foundation in place,

you already have that relationship in place. But I

think it's important for organizations to not be stuck on

one vendor and kind of look at it on a case by case basis, what

makes the most sense for them as a business. And again, you you

know, we did a lot of cost analysis. And for sure, in this

case, the Microsoft Azure was the was the best option. And

there was a the other thing was we already had some in house

experience with it. So that also kind of reduced some of the

barriers. So I think it really is sort of a case by case what

what fits with that specific business needs. There's a lot of

great options out there. So yeah, I would always be open to

looking at what fits best for you.

Makes sense. Makes sense. Maybe in

this context, I will again, share with listeners some

findings from the Flexera, State of the Cloud report. The top

four cloud migration challenges are number one, understanding

application dependencies, number two, assessing technological

feasibility, number three, assessing on-premise versus

cloud costs, and number four, selecting the right cloud

provider. And in fact, Keith kind of touched upon some of

these. And when he talks about going with their existing cloud

provider, because they've had good experiences, that hopefully

took away one of those challenges. Keith, what are your

thought of these challenges that I gleaned from the State of the

Cloud report? Do you agree with them?

Oh, absolutely. Yeah, I mean, the application

dependency is is key to having a successful understanding that

application dependency is the key to having a successful

migration for us. It we did. So we didn't refactor anything

because of the timelines. But we did a lift and shift. So it was

basically a virtual machine, a virtual machine. So that did

help a bit. But there were scenarios when when we did that

migration up where as much as we try to document things ahead of

time, and you know how it is you can have a data center and as

around for years, and then there's certain things that

maybe something's not captured. And I think one as part of the

testing there was there was some functionality that wasn't

working. And it was just because there was some application

talking to another application, and it wasn't documented. And we

didn't have the right firewall rules allow that communication.

So I would say, overall, it's just obviously good practice to

have that document in real time and keep that for just general

good practice. The other things were, you know, like I said, I

already talked about the decision on the on the cloud

vendor. Sorry, what were the other over two?

Sure, sure. The first one was understanding

application dependencies. The second one was assessing tech

feasibility. The third one was assessing on-premise versus

cloud costs.

Yeah, so So we, again, we already kind of had

experience with Azure, we knew a lot of the capabilities that

were there, we weren't necessarily taken advantage of

all them. But we did, like the future capabilities that we

could add. Like I said, we did do a sort of lift and shift. But

the as the next phase was kind of a refactoring and simplifying

and lowering the cost of our presence. One thing about the

kind of comparison of costs, is, a lot of times sometimes people

throw in the soft costs. And it's not a direct factor from a

financial perspective. But it is important to be very clear on

what your costs are. I mean, it took us about just maybe three

weeks just to firm up that kind of cost comparison and making

sure we itemize each one. it In our case, it was a little

easier, because we knew we were just eliminating that data

center, we were moving out of the facility. So we were able to

like save on internet costs and various things like that. So it

did make a lot easier. It can get quite expensive to be in the

cloud, if you don't manage it well, right. So if you're not

have good visibility on your costs, you're not using things

like micro services or partial compute you over over allocate

compute and things like that. It can be quite costly versus

on-prem. But I think if you have good visibility into those cost

factors it and in my experience, it's it's generally cheaper.

From a security perspective, it's it's easier to manage and

cheaper, because you kind of have a visibility of all your

assets, where sometimes in the on prem world, you can kind of

get the sprawl of systems. And it's just kind of hard to track

it all and make sure you don't have that security technical

debt. That happens a lot. So it definitely saved a lot of time

from engineers support perspective, which I think over

time allowed ACS to not have as much staff dedicated to the kind

of caring care and feeding of systems. And it allowed them to

do kind of more transformative work and help to grow the

business and things like that.

Awesome. In fact, I wanted to re emphasize

what you just shared, shared, or you highlighted the importance

of managing the cloud. When I talk about cloud in the

classroom, I associate cloud as a reflection of the technology

outsourcing phenomenon. And when you outsource something, though,

cost is often the driver. But in my humble opinion, you outsource

something to a service provider, because they are better at it

than your organization is or wants to be because your

organization has a mission, that the reason they were formed, and

that's what they need to focus on. So if somebody else can

better manage the tech, let them do it. But having said that,

it's also important to recognize that you still have to provide

oversight. It's not like out of sight out of mind. You still

have to stay on top of security, top of Cloud spend. And this is

where Keith I wanted your thoughts. When I look at these

breaches happening, like the Capital One, data was breached,

they were residing on the Amazon web server. Obviously Capital

One is still responsible for their data. Amazon is providing

them the server providing them with the details on how to

secure it, but I am of the opinion that maybe the SLAs

should be written up in a manner and a fashion, whereby there

should be more joint responsibility and joint

accountability whereby the host, the service provider, and the

client work as a team to ensure the data is safe, secure, and

there's a constant review to make sure the security level and

posture is being maintained. What are your thoughts?

Yeah, I mean, that would be fantastic. I mean, as

it as it is, now, the core responsibility of securing your

data is on the actual owner of the data. So I guess, I guess

the one, so you said a good few good things. And I'll get back

to the like, the one good thing is, as a business, you want to

focus on your core things that you're good at. ACS, they're not

a IT company, there, so spending a lot of time patching servers

and, and various care and feeding of data centers was not

where we wanted to be. But it would be nice if the three big

cloud providers were more engaged in kind of as a team,

securing data and helping make sure that they partner with

their customers to make sure that's being done, right. They

do provide a lot of great tools for I've been using the SIEM

(Security Information and Event Management) on Microsoft Azure,

it's a great tool, but of course, it's very dependent on

configuring it right, and making sure you have the right logs

that you're ingesting, and then you have the right rules and

playbooks and things like that. So it's in there, again, that's

a lot of dependency on the customer to either do that

themselves or work with a partner to help with that. Say,

I think that would be fantastic. If the cloud providers were a

little more engaged in that, I would be totally for that.

Good to hear that. Good to hear that. So

we are kind of coming to the close of our discussion. So I

wanted to check off a few things. You may have mentioned

this Keith, but I wanted to maybe highlight it again. One of

the success factors of this initiative that we're talking

about, was also the very meticulous phased migration

effort. You describe the details in your slide deck, Keith. And

I'm going to read off some of the the phases, the first phase

involved Assessing Azure, the second phase was Assessment of

Readiness, the third phase, entailed creating a landing

zone, and the final phase involved the actual migration,

migration, plus having a good disaster recovery in place.

Would you like to and I know there's a lot of detail, we may

not have time for all the details, anything in particular

that you want to touch upon, in the context of the phased

migration effort?

Yeah, I mean, for me, just generally, in

technology, having the right foundations in place, sets you

up for success later on. Right. So part of part of that is the

actual assessment of your environment, and what the

architecture will be, and making sure that you have the right

standards and controls in place initially, because if you try to

do that later, then it becomes a more challenging effort. What's

nice about these all-hands-on-deck type efforts

is you get everyone engaged upfront, to make sure that

they're all aligned with that kind of foundation. And

sometimes if you do that a year or two later, it's already

sprawled, you already have the parts of your data that you

don't have visibility into and various, you don't have certain

policies applied to certain things. So again, I think, since

we had experience in Azure, but we weren't like experts in it,

that's why it was it was good to have that partner to help make

sure that's in place. And then as part of the kind of the

readiness is making sure that the team from your company is

able to support it. So and it's important for them to kind of

have a good understanding upfront. So as we're going

through the project, it moves quick, more quickly with

informed people. And then so we did have a lot of we had

significant training that was done from just first with Azure

101. And then Azure governance and Azure security because we

wanted to make sure we put those foundations in place, but we

wanted to make sure we kept with them We kept, kept governance

and kept that security mindset. And the understanding that we

again, we are responsible for the security of our data,

Microsoft kind of like and the other cloud providers kind of

like, let you go with that, it's up to you to, to manage that. So

it was important for everybody in the team. And it's not just

infrastructure people, it's not just security people, but it's

also important for Development and QA to understand those those

kind of core principles of security. So all those people

were engaged, to make sure that it was it was built into sort of

our DNA, I guess. And then having having a well defined

landing zone was important too, because if you don't have your

resources, some of its just tagging and naming and stuff

like that, if you don't name those, or tag them, and you kind

of just put them all over the place, it actually makes it

harder to manage the costs and things because you're not really

clear what, what what this resource is for. And it just

makes it harder for you to manage that. And then the

landing zone had kind of the kind of lockdown networking IAM

(Identity and Access Management) structures and Role Based Access

Controls and the Azure blueprints and things like that.

A lot of people just think about the migration phase, but those

those first three phases, I think, are core for long term

success. And then there's the migration phase, which in our

case, also included giving DR (Disaster Recovery) fully

functioning DR, which becomes much easier to enable when

you're in the cloud. And there's a lot of CISOs that try to do

implement DR on- prem, and sometimes it just drags out, and

it's just like knowing the environment and things like

that, especially as part of the migration, it actually sets us

up for DR. Because the migration configuration was associated to

the DR failover. So it helped a lot with that. And if you're

doing yourself or if you're doing it with a partner, again,

it's the migration, it's very important to kind of have steps

planned out, well, you're on the same page with things you're,

you're engaged with the business because there will be some

downtime, you're engaged with them as well to make sure that

the testing is done. And in our case, we wanted to make sure we

had enough testing during the migration because we were

shutting down the servers at the end of it. And if we miss

something, there's kind of no going back. So the testing was

pretty important for us too. So yeah, I mean, it was it was a

great project. And I was very happy that we were able to kind

of work together and kind of use that phased approach, methodical

phased approach because it allowed us to stay focused.

Yeah, absolutely. In fact that as

you're talking about testing, I'm looking at the timeline,

where you mentioned about doing testing, right from week two,

right till the very end, right, right, right till week eight. So

constant testing is a huge best practice, I would say. And once

again, we don't have enough time to go into all the security best

practice details, that you all were able to accomplish. But

basically complying with the NIST framework framework,

complying with the PCI DSS framework, those are all great

accomplishments, and at a higher level bottom line, as you said

earlier, you all were able to complete the implementation in

eight weeks on time, under budget, and help the

organization realize a savings of $18 million in real estate

and $2 million in technology costs projected over three

years. That's phenomenonal. Working for an organization

organization like American cancer society that does so much

good. Much needed. I think it's it's indeed a noble cause. And I

want to recognize you and your team for doing such great work,

which indirectly has helped the global population. Because you

want an organization like ACS American Cancer Society to

survive and thrive. And these initiatives are essential to

allow the organizational engine to be running and be running

efficiently and effectively for the long run. So Keith, I'd like

to give you the final opportunity to say a few final

words with before we close our discussion for today.

Yeah, thank you again, for allowing me to share

the journey on this podcast. Yeah, I mean, just just with the

American Cancer Society, every dollar that's spent on

operational costs is a dollar taken away from cancer research

or services, So, whenever you can do something like this and

help help the organization survive, it's rewarding and it

just It just helps with the overall goal of eliminating

cancer as a disease worldwide. So, yeah, I mean, I'll just, I

guess close with a few things. Again, just any, any rapid pace

projects, including cloud migration requires kind of that

all-hands-on-deck cross functional teams working

together, clearly defined roles and what's success. And when

that happens, like, really hard things can get done, like things

that you don't think. And just sort of reiterating, knowing

your application dependencies is really important. And the data

flows helps minimize downtime when you're doing this

migration, and even performance issues. Another thing that I

want just to close out that with this, this rapid paced

migration, sometimes you don't want to over test, right? So you

want to make sure you test the core functionalities and data

flows first. And then if you can worry about some of the smaller

or less important test cases later. That's one thing that we

kind of learned in this project that we're trying to, like, be

so thorough in our testing, that we start to fall behind in our

schedule. So what we did was we refocused and we focused on

those core tests. And then we did the other testing later once

the actual workloads were uploaded. So that was probably

one of the biggest takeaways that I got from that. And then

lastly, just from a security perspective, if you can't really

protect your, your environment, if you don't have good

visibility of it. So one of the one of the big things that was

helpful from a security perspective was adding a SIEM

tool, I would just say, well, and one thing I learned from

this is it can get very complex to set this up and make sure the

use cases and the playbooks are set up. So if if you are a small

security shop or a small IT shop and maybe consider utilizing a

partner for that, so yeah, but hopefully, hopefully that was

helpful in sharing some of my experiences. And it was it was

really enjoyable to talk about it.

It was extremely helpful. I'm sure the

listeners will find great value in all your recommendations and

sharing your experiences with this cloud migration. Much

needed discussion. So thank you again, Keith, for your time, and

I look forward to future discussions with you. For sure.

Thank you, Dave. A special thanks to Keith Weller for his

time and insights. If you like what you heard, please leave the

podcast a rating and share it with your network. Also,

subscribe to the show, so you don't miss any new episodes.

Thank you for listening, and I'll see you in the next

episode.

The information contained in this podcast is for

general guidance only. The discussants assume no

responsibility or liability for any errors or omissions in the

content of this podcast. The information contained in this

podcast is provided on an as-is basis with no guarantee of

completeness, accuracy, usefulness, or timeliness. The

opinions and recommendations expressed in this podcast are

those of the discussants and not of any organization.