so you're preparing to migrate a
application to the cloud that manages
sensitive data in regulated industry so
what are you going to do well the first
stage is you need to validate that the
crypto platform you're going to use
which might be the one that your CSP
offers or it might be a third party
meets your security requirements and
just reading the marketing information
from the provider is not enough you need
an independent view you could put your
internal red team on the job you could
hire external pen tests or you could use
some of our software to check the
security of the CSP's crypto service
the next thing you need to do is
inventory the cryptography in the
application so it's not enough to just
look at the libraries and see what are
the keys you need to know what
operations that application actually
does with its keys the ones that really
handle the sensitive data the ones for
which you want to be sure that the keys
are safely managed off the virtual
machine where the application is going
to be running Cryptosense Analyzer
platform can help you do this you plug
our agent or profiler into your
application while it runs and the result
on our platforms output is a full
inventory of the cryptography and a map
of how it's used
we call it the crypto cartography
the next step is to map that cartography of
crypto to your crypto service so to
make your migration plan work out how
that application is going to work once
it's plugged into that service then once
it's running you need to keep checking
that as the application develops over
time because typically now it's in the
cloud you're going to want to speed up
your development process and iterate and
deploy more quickly that the
cryptography stay secure so for this you
can integrate our cryptosense analyzer
platform into your CI a tool chain this
way the cryptography is being audited in
every build or every overnight chest and
you can make sure that it fulfills the
requirements of your policy that you set
in your go to cloud plan
