Cloud Computing and SOA Convergence in Your Enterprise: A Step ...

Creating the Governance Model 153
A few things must be considered here in terms of security on the context
of governance: First, you need to leverage “good enough” security, meaning
that the security solution you implement must be appropriate for the application
and information you are protecting. Many who implement security
tend to go overboard with the security approaches and technology they look
to leverage, selecting a solution that is too expensive and places too many
limitations on the users.
Second, create your security approach using use cases, looking at how security
needs to exist at every level of the system. Sometimes, those who design
security, as related to governance, focus more on that last security
technology article they read and not enough on how the application needs to
leverage security. There is a huge difference.
Creating the Governance Model
Now that we have a basic understanding of service governance, let’s return to
the creation of our governance model as outlined in Figure 8.1. We create this
governance model for a few core purposes: first, to work from the general notion
of governance as related to our problem domain to the specifics of the
implementation, such as designing and implementing policies. We start from
the most general and move to the most specific. Second, to make sure we have
a complete service-level, information-level, and process-level understanding
of the problem domain, and how all of those assets should be governed, both
on-premise and within the cloud computing assets.
Define Policies
Policies, as related to governance, are declarative electronic rules that define the
correct behaviors of the services. They can be rules that are not electronically
enforced, such as policies created by IT leaders who create rules that everyone
must follow but that are not automated. Or, they can be policies outlining
proper behavior during service execution, typically enforced electronically using
governance technology. Both are important, which is why we discuss policies
as things that may exist inside or outside of governance technology.
For our purposes, we call general policies macro policies and service-specific
policies micro policies.