10/100/1000 Etherner 2Oz Bluetooth 207 Cable line 209 Cloud 199 Commerce server 212 Content deliverynetwork (CDN) Z2O Database tier 212 Digital subscriber line (DSL) 208 Domain name 2ll Elastic 199 Encapsulated 2Is Ethernet 207 File Transfer Protocol (ftp) 2lZ Hop 209 https 217 Hypertext Transfer Protocol (http) 2tz ICANN (Internet Corporation for Assign-ed Names and Numbers) 2L0 IEEE802.3protocol 202 IEEE 802.11 protocol 202 Infrastructure as a service (IaaS) ZIg Internet 206 Internet seMce provider (ISp) ZOB Intranet 206 IP address 2L0 IPv4 2ll IPv6 2ll Local area network (LAN) 206 Network 206 Over the Internet 201 Packet analyzer 230 Packetsniffers 230 Platform as a seryice (paaS) 2Ig Pooled 200 Private cloud. 224 Private IP address 2lO Protocol 206 Public IP Address 2LO Remote action system Z2B Servertier 212 Service -oriented architecture (soA) 2t3 ,*# Using Your Knowledge Simple Mail Tiansfer Protocol (smtp) zt7 Small office/home office (soHo) 206 Software as a service (SaaS) Zlg TCP/IP protocol architecture 216 Telediagnosis 228 Telelawenforcement 228 Telesurgery 228 Textmining 233 The lnternet zOG Three-tierarchitecture 212 Tunnel 224 URL (Uniform Resource Locator) 2lL User tier 2L2 Virtual private cloud (VpC) 225 Virtual private network (VpN) 223 WANwireless 209 Web page 2t2 Web servers 212 Wide area network (WAN) 206 MyMlSLab Go to mymislab.com to comprete the probrems marked with this icon ft. 6-1. Define cloud and explain the three key terms in your definition. Using Figure 6-3 as a guide, compare and contrast cloud-based and in-house hosting. In your opinion, explain the three most important factors that make cloud-based hosting preferable to in_house hosting. 6-2. Apple invested more than $1 billion in the North Carolina data center shor,rm in Figure 6-2. For Apple to spend such . a sum, it must perceive the iCloud as being a key com_ ponent of its future. Using the principles listed in Figure 3-12 (page 95), explain all the ways that you believe the iCloud will give Apple a competitive advantage over other mobile device vendors. 6-3. Suppose you manage a group of seven employees in a small business. Each of your employees wants to be con_ nected to the Internet. Consider two alternatives: Alternative A: Each employee has his or her olrm device and connects individually to the lnternet. Alternative B: The employees, computers are connected using a LAN, and the network uses a single device to con_ nect to the Internet. a. Sketch the equipment and lines required for each alternative. b. Explain the actions you need to take to create each alternative. c. Which of these two altematives would you recommend? 6-4. Go to http://aws.amazon.com and search for AWS da_ . tabase offerings. Explain the differences among Simple Database Service, Amazon Relational Store, and MongoDB. \iVhich of these three would you recommend for storing AllRoad parts' 3D printing design files? (By the way, whenever you query the Internet ...

1. 10/100/1000 Etherner 2Oz
Bluetooth 207
Cable line 209
Cloud 199
Commerce server 212
Content deliverynetwork (CDN) Z2O
Database tier 212
Digital subscriber line (DSL) 208
Domain name 2ll
Elastic 199
Encapsulated 2Is
Ethernet 207
File Transfer Protocol (ftp) 2lZ
Hop 209
https 217
Hypertext Transfer Protocol
(http) 2tz
ICANN (Internet Corporation for
Assign-ed Names and
Numbers) 2L0
IEEE802.3protocol 202
IEEE 802.11 protocol 202
Infrastructure as a service (IaaS) ZIg
Internet 206
Internet seMce provider (ISp) ZOB
Intranet 206
IP address 2L0
IPv4 2ll

2. IPv6 2ll
Local area network (LAN) 206
Network 206
Over the Internet 201
Packet analyzer 230
Packetsniffers 230
Platform as a seryice (paaS) 2Ig
Pooled 200
Private cloud. 224
Private IP address 2lO
Protocol 206
Public IP Address 2LO
Remote action system Z2B
Servertier 212
Service -oriented architecture
(soA) 2t3
,*#
Using Your Knowledge
Simple Mail Tiansfer Protocol
(smtp) zt7
Small office/home office
(soHo) 206
Software as a service (SaaS) Zlg
TCP/IP protocol architecture 216
Telediagnosis 228
Telelawenforcement 228
Telesurgery 228
Textmining 233
The lnternet zOG
Three-tierarchitecture 212

3. Tunnel 224
URL (Uniform Resource
Locator) 2lL
User tier 2L2
Virtual private cloud (VpC) 225
Virtual private network (VpN) 223
WANwireless 209
Web page 2t2
Web servers 212
Wide area network (WAN) 206
MyMlSLab
Go to mymislab.com to comprete the probrems marked with this
icon ft.
6-1. Define cloud and explain the three key terms in your
definition. Using Figure 6-3 as a guide, compare and
contrast cloud-based and in-house hosting. In your
opinion, explain the three most important factors
that make cloud-based hosting preferable to in_house
hosting.
6-2. Apple invested more than $1 billion in the North Carolina
data center shor,rm in Figure 6-2. For Apple to spend such
. a sum, it must perceive the iCloud as being a key com_
ponent of its future. Using the principles listed in Figure
3-12 (page 95), explain all the ways that you believe the
iCloud will give Apple a competitive advantage over other
mobile device vendors.
6-3. Suppose you manage a group of seven employees in a
small business. Each of your employees wants to be con_
nected to the Internet. Consider two alternatives:

4. Alternative A: Each employee has his or her olrm device
and connects individually to the lnternet.
Alternative B: The employees, computers are connected
using a LAN, and the network uses a single device to con_
nect to the Internet.
a. Sketch the equipment and lines required for each
alternative.
b. Explain the actions you need to take to create each
alternative.
c. Which of these two altematives would you recommend?
6-4. Go to http://aws.amazon.com and search for AWS da_
. tabase offerings. Explain the differences among Simple
Database Service, Amazon Relational Store, and
MongoDB. iVhich of these three would you recommend
for storing AllRoad parts' 3D printing design files? (By
the way, whenever you query the Internet for any AWS
236 cHAPTEFI ei The Ctoud
product, be sure to include the keYword
AI4IS in your
search. Otherwise, your search will result
in Amazon's
lists of books about ihe item you're
searching for')
6-5. Suppose Lucas wants AllRoad

5. to set up a private internet'
andie justifies this request on the basis
of better security'
Using the collaboration IS you built
in Chapter 2 (pages
rc-74), collaborate with a group
of students to answer the fol-
lowing questions.
The cloud is causing monumental
changes in the informa-
tion systems services industry' In every
c'ty' Y,o'will still see
the trucks of local independent software
vendors (ISVs) driv-
ing to their clients'o '"t "p
and maintain local area networks'
,"it"rr, and software' Youi[ know the trucks
by the Microsoft'
Otu"l", and Cisco logos on their sides'
For years' those small'
local colnpanies have surwived' some
very profitably' on their
ubrt rr ro set up and maintain LANs' connect
user computers

6. to the Internet, set up servers' sell
Microsoft Exchange licenses'
and install other software on both
servers and user computers'
Once everything is installed'' these
companies continued
to earn revenue by providing maintenance
for problems that
inevitably developed and support
for new versions of software'
connecting new user computers'
and so forth' Their eustom-
"rr
rrury, b"ut generally are smaller companies
of' say' 3 to 50
employees-companies that are large
enough to need email'
Internet connections, and possibly
some entry-level software
applications such as QuickBooks'
1. Using the knowledge of this chapter
alit ttre intuition of the
members of your i"u*' *t'*t"arize threats that

7. cloud ser-
vices Present to such ISVs'
2. Suppose your team owns and manages
one of these ISVs'
You learn that more and more of
your clients are choosing
SaaScloudserviceslikeGoogleforemail,ratherthanset-
ting uP local email servers'
a. try'hat, if anl'thing, can you do to
prevent the encroach-
ment of SaaS on Your business? -:.
FinQtoud Forever ' ' 'Wett, at Least
for
In 1937, the Securities and Exchange Commission
(SEC) set
out rules that stipulated records retention
requirements for
securitiesbrokersanddealers.TheSEC!Concernwas(and
;Jt;;;ffi ofi!'financial transactionsrnot be altered
after
the fact, that they be retained for
a stipulated period of time'
Explain why that is not a good decision'

8. and rebut his
claim about security by suggesting that
AlIRoad use a
VPC. Iustiff Your suggestion'
6-6. In five sentences or less' explain
how the cloud will affect
job prospects for you between now and2024'
Given your answer to question 2a'
identif,i three alterna-
tive waYs You can resPond'
,*t.i ot,n" three responses identified in your
answer
to question 2b wouldyou choose? |ustiffyour
choice'
3. Even if SaaS eliminates the need for
email and other local
servers, there will still remain viable services
that you can
provide. Name and describe those services'
4. Suppose instead of attempting to adapt an
existing ISV to the
thr# of cloud services, you andyour teammates
decide to set

9. up an entirely new business' one that
will succeed in the pres-
ence of SaaS and other cloud services'
Looking at businesses
in and around yonr campus' identifir and
describe the IS
needs those businesses will have in the
cloud services world'
5. Describe the IS services that your new
business could pro-
videforthebusinessneedsyouidentifledinyouranswerto
question 4.
6. Given your answers to questions l-5''would
you rather be
an existing ISV attempting to adapt
to this new world or an
entirely ,r"* .o-put'yt Compare and contrast
the advan-
tages and disadvantages ofeach alternative'
7. Changing technology has' for centuries'
eliminated the
need for certain ptod"tt' and services and
created the

10. need for new products and services'
What is new' today'
however, is the rapid pace at which
new technology is cre-
ated and adapted' Using cloud services
as an example' cre-
ate a statement of the f,osture that
business professionals
should take with t"gu'd to technology
in order to thrive in
this fast-changing et''ironment' Notice
the verb in this as-
signment is thriue, andnotittsl suruiue'
th6 Required lnterval' ' '
and that indexes be created so that
the records can be readily
searched.
In 1937, the rules assumed that such
records were recorded
on paper media' With the rise of information
systems storage'
in 1997 the SEC updated the rules by stating
that such records

11. ,caur be kept electronically, provided that the storage devices
lilE rqrite once, read many times (WORM) devices. This rule
rmns readily accepted by the financial services industry because
tffiefrrst CDs and DVDs were WORM devices.
Howeveq, as technology developed, broker-dealers andnowever,
as tecnnology oeveropeo, oroK
mrfter financial institutions wanted to store records using regu-
iltur disk storage and petitioned the SEC for guidance on how
dfrey might do that. In May 2003, the SEC interpreted the rule
lflnr enable the storage of such records on read-,Tite medium,
pruvided that the storage mechanism included software that
runruld prohibit data alternation:
A broker-dealer would not violate the requirement in paragraph
(fX2XiiXA) of the rule if it used an electronic storage system
that
prevents the overvlriting, erasing or otherwise altering of a
record
during its required retention period through the use ofintegrated
hardware and software control codes. Rule I7a-4 requires
broker-
dealers to retain records for specified lengths oftime. Therefore,
it follows that the non-erasable and non-rewriteable aspect of
their storage need not continqe beyond that period.
The Commission's interpretation does not include storage sys-
tems that only mitigate the risk a record i,vill be overwritten or
erased. Such systems-which may use software applications to
protect electronii records, such as authentication and approval
policies, passwords or other extrinsic security controls-do not
maintain the records in a manner that is non-rewriteable and
non-
erasable. The external measures used by these other systems do

12. not prevent a record from being changed or deleted. For
example,
they might limit access to records through the use of passwords.
Additionally, they might create a "finger print" of the record
based
on its content. If the record is changed, the fingerprint will
indicate
that it was aftered (but the original record would not be
preserved).
The ability to ovgrurite or erase records stored on these systems
makes them non-compliantwith Rule l7a- (f).s
Notice the SEC specifically excludes extrinsic controls such
i6 authentication, passwords, and manual procedures because
It believes it would be possible for such systems to be readily
,misused to overwrite records. The SEC is striking a fine line in
'this ruling; if, for example, someone were to tamper with the
Case Study 5 237
storage systems' software, it would be possible to overwrite
data. Apparently, the SEC assumes such tampering would be
illegal and so rare as to not be a concern.
Given this ruling, organizations began to develop systems
in compliance. The NASDAQ OMX Group, a multinational cor-
poration that owns and operates the NASbAQ stock market as
well as eight Euroilean exchanges, began to develop FinQloud,
a cloud-based storage system that was developed to be com-
pliant with the SEC's (and other regulating organizations')
rulings. NASDAQ OMX operates in 70 different markets, in 50
countries worldwide, and claims that it processes one out of 10
stock transactions worldwide. lo
Figure 6-25 shows the fundamental structure of the
FinQloud system. On the back end, it uses Amazon's 53 prod-

13. uct to provide scalable, elastic storage. When financial in-
stitutions submit records to FinQloud for storage, FinQloud
processes the data in such a way that it cannot be updated,
encrlpts the data, and transmits the processed, encrypted
data to AWS, where it is encrypted yet again and stored on 53
devices. Data is indexed on 53 and can be readily read by au-
thorized users. NASDAQ OMX then claimed that FinQloud's
processing and encryption is done is such a way that it meets
the SEC requirement.
Of course, NASDAQ OMX knew that this statement would
be perceived as self-serving, so it hired two independent
companies to verify that claim: Jordan & Jordan, a securi-
ties industry consulting company, and Cohasset Associates, a
document-processing consulting company. According lo The
Wall Street Journal, both organizations concluded that when
properly configured, FinQloud meets the requirements of the
SEC's rule (Rule 17a-3) as well as a similar rule set out by the
Commodities Futures Trading Commission. I I
Consequently, NASDAQ OMX customers can use FinQloud
and as long as they can demonstrate that they have properly
configured it, their auditors will find this systein to be in com-
pliance with the SEC rulings.
Figure 6-25
Domponents of the Fin0toud System
fu.S. Securities and Exchange Commission, "SEC
Interpretation: Electronic Storage of Broker-Dealer Records,"
Iast modified May 5, 2003,
W : / / www. sec. go u/ r u I es/ i n t e r p/ 34 - 4 7806.h
lm.t'NASDAq OMli "NASDAQ OMX FinQloud," accessed May
2013,
http://wwunasdaqomx.com/technologlt/yourbusiness/finqloud/.
ItGreg MacSweeney, "Nasdaq OMX FinQloud R3 Meets SE-

14. C/CFTC Regulatory Requiiements, Say Consuliantsi' April
ts,i}Ib,
'hnp://www.wallstreetandtech.com/data-management/nasdaq-
omx-finqloud-r3-meets-seccfrc-re9240152909.
238 cHAprEFl e The Ctoud
GIUESTIctNb
6-7. In your own words, summarize the dealer-broker record
retention requirements.
6-8. Reread the SEe 's 2003 interpretation. In your own words,
explain the difference between "integrated hardware and
software control codes" and software applications that
use "authentication and approval policies, passwords, or
other extiinsic controlsl'Give an example of each.
6-9. Clearly, in the view of the SEC, the likelihood of compro-
mise of an integrated system of hardware and software is
considerably less than the likelihood of'compromise of
a system of authentication, passwords, and procedures.
fustifu this view
6-10. Do you agree with the view in question 6-9? Mhy or
why not?
6-ll. Investigate |ordan & Jordan' (wwwjandj.com) and
Cohasset Associates (www.cohasset.com). If you
were a consultant to a financial institution, to what
extent would you rely on the statements of these
organizations?
6-12. If you were a consultant to a financial institution, what

15. else might you do to veri$z that Fineloud complies with
the SEC ruling and its 2003 interpretation?
6-13. Explain how the knowledge that you have gained so far
in this course helps you to understand the SEC,s 2003
interpretation. Summarize how your knowledge would
help you if you worked for a financial institution. Cast
your answers to this question in a way that you could
use in a job interyiew.
MyMlSLab
Go to mymislab.com forAuto-graded writing questions as well
as the following
Assisted-graded writing questions;
6'14. suppose that you work atAllRoad parts and Kelly tells you
that she doesnt
believe that cheap,elastic provisioning of servers is
possible.,,There has to be a
catch somewhere," she says.Write a one-page memo to her
explaining how the
cloud works. ln your memo, include the role of standards for
cloud prlcessing.
6' I 5. Suppose you manage .a sales department that uses the
SaaS product Salesforce
.com. one of your key salespeople refuses to put his data into
that system...l
just dont believe that the competition cant steal my data, and
I'm not taking
that risk." How do you respond to him?
5- !5. Mymislab only - comprehensive writing assignment for
this chapter.