1 of 13

Building the Cloud Foundation:

Empowering Higher Ed with Terraform templates, Security risk assessments, and Collaboration

2025 Cloud Forum

Hallah Hussien, Cloud Engineer

Kelly Rivera, Lead Cloud Engineer

2 of 13

Account Request

Campus partner fills out a Google form which then creates a ticket for the Cloud Team as well as a record in our cloud account database.

The Cloud Team then creates the account with Terraform scripts

3 of 13

How does the campus partner find the Cloud Team?

Building the Cloud Foundation: Empowering Higher Ed

Word of mouth
Research Cyber Infrastructure Team collaboration
Cloud Team service pages
Help Desk Inquiry
Attending Cloud Team Events on Campus
Academic Technology Team Collaboration

4 of 13

Architecture Consultation

User sends an email which turns into a ticket

Example:

I have a several large projects that require the use of high throughput computing services and was interested in learning more about any services the UW public cloud team may have? Also, I created and manage the Global Mosquito Observation Dashboard (GMOD). Our pipeline is “frozen” due to the government funding pause. I’m hoping to restructure my pipeline so that I can manage it without the use of a 3rd party (in this case, the state department). Does UW Public Cloud services allow for any functionality in hosting and automating, data from four API sources that can be curated, cleaned, and sent to our dashboard?

Building the Cloud Foundation: Empowering Higher Ed

Pam (Hallah)

Thank you-

The UW Madison has managed instances of AWS, GCP and Azure. I’d like to share three concepts to help you get started securely in the public cloud.

The first is understanding the concept of shared responsibility. All three public clouds have a shared responsibility model, and I believe AWS is the best at explaining it concisely: AWS is responsible for security OF the cloud, and you are responsible for security IN the cloud. This means that AWS is going to be responsible for the physical access and hardware in their data centers, their global network connectivity.

Us users are responsible for securing the virtual resources we will be using, the data that will be flowing through these resources & network connections, ensuring encryption is used when needed, and maintaining the OS.

The second is Data Protection. We need to protect the data by defining what interactions are necessary with it. In some cases, a public cloud architect or a developer may not require access to ANY of the data they are supporting. Therefore creating provisioning process that result in appropriately sized access to your workload is important to limit the risk associated with the services in use. I recommend studying up on the IAM features available in the public cloud you are using and provisioning based on least privilege.

The third point is the first :) . Start with security. Once you have your account provided by the public cloud team, and you are architecting your services, always check in with the inherent security tools such as security hub or defender to review current findings. If you do not have security hub available in your AWS account then you can always inquire with the Public Cloud Team about migrating to a managed Org that has these tools already enabled. These tools go beyond traditional endpoint security alerting of viruses or trojan infections, and can report on misconfigurations of your services. Of course, the Public Cloud Team has implemented these tools for you in addition to traditional virus or infection alerting in tools like AWS’s Guard Duty. Finally, always review the docs. It can be hard to find time, however public cloud documentation is necessary to review prior to implementing a service. As a public cloud architect or engineer, you are wearing the networking, endpoint, sys admin, and security hats among others. It can be hard to specialize in all of these areas, so let the docs support the secure deployment of your resources.

NEXT SLIDE>

5 of 13

Building the Cloud Foundation: Empowering Higher Ed

Architecture Consultation

Cloud Team member sets up meeting to discuss the project including requesting and architecture diagram diagram

Campus Partner talks the Cloud Team member through the project

Cloud Team member gives feedback to the campus partner

6 of 13

Security recommendations and referral to cybersecurity team for risk assessment
Architecture recommendations
Offer any Terraform templates that may apply
Referral to other DoIT (central IT) teams
Cost Recommendations

Building the Cloud Foundation: Empowering Higher Ed

Architecture Consultation - Feedback

1. Standardization: A security baseline provides a standardized set of security configurations, policies, and controls that all systems and resources in the cloud environment must adhere to. This consistency ensures that security measures are applied uniformly across all assets.

2. Risk Reduction: By implementing a security baseline, organizations can reduce the risk of security breaches, data loss, and other security incidents. The baseline helps to establish a minimum level of security that must be maintained, thereby minimizing potential vulnerabilities and exposures

3. Compliance Requirements: Many industries and regulatory bodies have specific compliance requirements regarding data security and privacy. A security baseline helps organizations ensure that they meet these compliance standards by providing guidelines for implementing necessary security controls and measures.

4. Efficiency: Having a predefined security baseline streamlines the security management process. Instead of starting from scratch for each new cloud deployment or resource, organizations can use the baseline as a foundation, saving time and effort in configuring and securing cloud environments.

5. Scalability: As cloud environments grow and evolve, maintaining consistent security becomes increasingly challenging. A security baseline provides a scalable approach to security management, allowing organizations to apply the same security standards regardless of the size or complexity of their cloud infrastructure.

6. Auditing and Monitoring: A security baseline serves as a reference point for auditing and monitoring activities. It enables organizations to track deviations from the baseline configuration, identify potential security gaps or violations, and take corrective actions promptly.

7. Resilience: By establishing a security baseline, organizations can improve their overall security posture and resilience against cyber threats and attacks. Consistently applied security controls help to fortify defenses and mitigate the impact of security incidents.

7 of 13

Building the Cloud Foundation: Empowering Higher Ed

Deploying Lego Block Terraform Pieces

Service Account User - AWS IAM User with secret stored in AWS Secrets Manager

S3 Bucket - Best practice settings applied for replication, backup, and security

VPC - AWS VPC with private and public subnets, route tables, security groups, etc

S3 Website with Cloudfront and basic Authentication

8 of 13

Risk Assessments

Cloud Risk Analyst from UW’s Cybersecurity Risk Management and Compliance team runs through a list of questions with the customer about their workload, operational procedures, and policies to assess the risk level of the workload

Building the Cloud Foundation: Empowering Higher Ed

9 of 13

Risk Assessments

An engineer from the Cloud Team goes through AWS Security Hub, GCP Security Center, or Azure Defender for Cloud with the customer to teach the customer how to use the tool and come up with a list of to do items. These items are also worked into the risk assessment’s final report

The Cloud Risk Analyst composes a report which is then signed off by the risk executive for the project.

Building the Cloud Foundation: Empowering Higher Ed

10 of 13

Risk Assessment

Building the Cloud Foundation: Empowering Higher Ed

11 of 13

Events

Building the Cloud Foundation: Empowering Higher Ed

Office Hours - Weekly
Immersion Days
Research Days - AWS, Azure, and GCP
Collaboration with professors for workshops
Presentations at University Conferences

IT Professionals Conference
Research Bazar
Madison Information Security Team (MIST) - Security collaboration group

(Kelly)

In the ever-evolving world of cloud computing, the dynamic and rapidly changing nature of cloud environments makes secure configuration a moving target.

Manual configuration methods are not only susceptible to human error but also incredibly time-consuming, which is a luxury we can’t afford in the fast-paced digital arena.

The stakes are high; any security misconfiguration, no matter how minor, can serve as a gateway for cyber threats.

This is why automation is crucial. It brings a level of precision, consistency, and efficiency that manual processes simply cannot match.

By automating the configuration process and remediation we can ensure that security measures are not only deployed swiftly but also maintained accurately over time, keeping our cloud infrastructure resilient against the threats of tomorrow.

12 of 13

University of Wisconsin - Madison

Speaker Bio

Kelly Rivera - Lead Cloud Engineer

Kelly Rivera is the Lead Cloud Engineer of the UW Madison DoIT Public Cloud Team. She graduated from Madison College with a degree in Web Software development. After graduation, Kelly worked in private industry for a local software company as a Cloud Engineer where she honed her skills in cloud management, automation, and infrastructure as code including Terraform.

When she was looking for her next opportunity she wanted to find an organization which would allow her to make a positive difference in the world using technology. The University's commitment to research and educating the next generation drew her to take a position on the Cloud Team at DoIT.

As Lead Cloud Engineer, Kelly helps researchers, educators, administrators, and other university partners design projects in the cloud. With a background in training, she provides partners not only a solution but also the tools necessary to educate themselves about cloud. She empowers researchers to use the cloud as a tool to enable their research and make changes in the world around us.

13 of 13

University of Wisconsin - Madison

Hallah Hussien

Hallah Hussien is a dynamic and accomplished tech professional with a passion for all things cloud. She has dedicated the past 7 years to mastering the intricacies of cloud technologies and their real-world applications in both private industry and academia.

As a Cloud Engineer at the University of Wisconsin-Madison, Hallah plays a pivotal role in architecting and optimizing cloud solutions that drive innovation and efficiency. Her expertise encompasses a wide range of cloud platforms and services, and she possesses a unique ability to distill complex technical concepts into accessible insights for both technical and non-technical audiences.

Beyond her professional pursuits, Hallah is an avid advocate for diversity and inclusion in the tech industry. She believes in fostering an environment where individuals from all backgrounds can thrive and contribute their unique perspectives to the ever-evolving tech landscape.