Jeroline
All right, everyone.
Jeroline
Let's get started.
Jeroline
Welcome and thank you for joining us today.
Jeroline
I'm Jeroline and I'll be your host for today's webinar.
Jeroline
And you are joining Pcloudy's webinar on can't use public device clouds.
Jeroline
Here's how regulated comp uh companies test at scale.
Jeroline
So, quick housekeeping rules before we begin.
Jeroline
Your mics are muted.
Jeroline
So, if you have any questions, drop them in the QA box that you see at the bottom of your screen and we'll get to them at the end of the webinar.
Jeroline
And also please note we are recording today's session.
Jeroline
So uh we will be sending you the links of this webinar right after uh the session and feel free to share it with anyone on your team who might find it useful.
Jeroline
And now let me introduce our speaker for today's webinar Shueb has about 15 years of experience in quality engineering and heads solution engineering at Pcloudy.
Jeroline
He works closely with enterprises in BFSI, healthcare, and government organizations where putting data on a public cloud for testing simply isn't an option.
Jeroline
So, he'll be walking us through how these companies are still managing to test at scale without compromising on compliance or security.
Jeroline
So, over to you Shueb.
Shueb
Hey, thank you so much Jeroline.
Shueb
Hey, welcome everyone.
Shueb
Um so very good morning, good afternoon and good evening people who have joined in across different part of the world.
Shueb
All right.
Shueb
So, so today's topic will be uh you know how regulated companies uh test at scale uh you know while you cannot use the public cloud devices.
Shueb
Right.
Shueb
So that's the topic today.
Shueb
So feel free to uh pitch in with your uh thoughts any questions that you get across uh we'll try to answer them towards the end of this uh webinar.
Shueb
Uh yeah so with that uh let me get started right.
Shueb
So so let me start uh with a quick uh question here.
Shueb
Right.
Shueb
So how many of you here in this in the organizations have heard about this question?
Shueb
So we need real devices for testing compliance won't allow public clouds so use emulators right and that's where the tension actually begins right so today we are talking something very specific not generic testing nor cloud not generic about the cloud but how regulated companies like banks healthcare finance insurance defense and the moment testing at scale when public cloud is not an option.
Shueb
Right?
Shueb
So, so before we talk about testing, so we need to understand why compliance matters in these environments.
Shueb
Right?
Shueb
So, when we talk about the compliance, right?
Shueb
So, for enterprises, compliance isn't just an uh check mark, right?
Shueb
It's about a survival.
Shueb
So where we are protecting the customer sensitive data.
Shueb
So it can be financial records, uh health data, defense systems.
Shueb
So it's about the system integrity.
Shueb
So if the system is failing, it's not just about the downtime, right?
Shueb
It's actually the national risk, it's also a financial risk and as well as the human risk.
Shueb
And uh when we talk about the stakeholders, it's about to build that stakeholders trust right across boards, across different regulators, auditors and even customers right and an important thing is how do we scale securely right and most enterprises don't struggle with growth rather they struggle with not increasing the risk here.
Shueb
So when security team pushes pushes backs on the tools right it's not because they don't like innovation right it's because their mandate is to protect the organization and u what happens when compliance has been ignored right even unintentionally.
Shueb
So the result of non-compliance is is not a small penalty right there are regulatory there are regulatory fines there's license suspensions criminal liability at extreme cases operational shutdowns and uh you know even reputational damage that never fully recovers.
Shueb
So in regulated se sectors one breach can actually undo decad of credibility.
Shueb
So when a QA team says let's just try a public cloud device the compliance is actually hearing right.
Shueb
So it's less risk regulator exposure but that's the tension.
Shueb
So now let's try to zoom out and understand why this tension u looks different in regulated sectors versus the commercial sectors.
Shueb
So the difference between regulated and uh commercial sector is not digitally maturity right it's actually a regulatory accountability.
Shueb
So in commercial sectors uh the shade clouds are acceptable.
Shueb
The vendor logging is fine.
Shueb
Experimentation is always encouraged.
Shueb
Whereas when you compare this with regulatory industries in audit trails are very much mandatory and the data residency is pretty much enforced and the infrastructure visibility is required here.
Shueb
So access and access must be traceable and most importantly the risk tolerance is nearly zero and so when someone says why don't they just use the cloud like everyone else right it's because their accountability model is fundamentally different so and this regulatory intensity is directly impacting the testing so let's try to understand what is the core problem here right so in reality real device testing at scale becomes nearly impossible, right?
Shueb
Uh the corporate fire firewall blocks outbounds connections.
Shueb
Air gap networks prevent external access, right?
Shueb
And also more importantly the internal builds contain propriarity code, right?
Shueb
So test and and also the sometimes the test data may include PII.
Shueb
So sometimes even the mass data cannot leave the parameters.
Shueb
So on top of that they must comply with multiple standards simultaneously adhering to all the security standards be it ISO sock to GDPR PCIDSS HIPPA CMI and so on.
Shueb
So when someone says just upload the build to a public cloud for these organizations they simply don't allow right.
Shueb
So this is a core constraint and everything that follows stems from this.
Shueb
So what does this create in real life?
Shueb
So in reality if you look at it real device testing at scale becomes near impossible right the corporate firewall blocks the outbound connections and uh air gap networks prevent external access and uh every new tool goes through you know months of security review right so teams default to you know emulators and we all know emulators do not replicate uh be from camera behavior to GPS sensors real performance but they are safe from a complaint perspective.
Shueb
So safety wins over accuracy here, right?
Shueb
So that's what we have seen and that's where the quality begins uh to degrade.
Shueb
So why does this happen?
Shueb
Because of one major assumption, right?
Shueb
So assumptions that makes real device testing non-compliant.
Shueb
Right?
Shueb
So the assumptions really so that so let's try to understand how the assumption really goes.
Shueb
So the real device testing requires cloud and cloud means data at risk and when data lives there is a compliance risk right and what happens with compliance risk it's a rejection.
Shueb
So the conclusion becomes real device testing is non-compliant.
Shueb
Is the cloud the problem in real time or is the sharable cloud the problem?
Shueb
See if you look at it cloud as a technology is not not the issue.
Shueb
Data living the controlled boundaries is the actual issue.
Shueb
So this is where the uh actual architectural misunderstanding lies and because of these assumptions teams feels they only have two options.
Shueb
One is option one is limited local devices.
Shueb
It can be few devices, contentions, no parall runs, manual scheduling or option two is emulators where there's no real hardware validations, no sensor testing, simulated performance.
Shueb
Neither option scales here.
Shueb
So neither option satisfies engineering expectations as well, but both satisfy compliance barely, right?
Shueb
So teams compromise.
Shueb
So now let's understand what does the compro uh the compromise actually lead to right so the result of testing on emulators and limited devices leads to the automation backlog grows the CI/CD pipeline breaks when the devices are unavailable the release cycles are getting delayed and also the production bugs are increased right because emulator environments cannot match the real world behavior and u you know QA teams are always being blamed for slow releases.
Shueb
So compliance teams are blamed for blocking tools but neither is the real problem.
Shueb
So the the real problem lies is the infrastructure architecture and this is the point compliance teams are not villains in this history.
Shueb
So when we talk about the compliance and the securities right compliance and security teams are actually protecting the enterprises.
Shueb
So their job is to prevent the data leakage unauthorized access and regulatory violations and of course they are guardians.
Shueb
So when we talk about guardians they are the true protectors of uh the system right.
Shueb
Right.
Shueb
So the friction between the Q and the compliance is not actually culture but it's architectural.
Shueb
So both teams want stability and at the same time both teams want to scale but they are operating within the flawed deployment assumptions.
Shueb
So what are the compliance teams actually worried about right they fear the sensitive data exposure and also loss of control in third party environments.
Shueb
privacy violations through logging or recording.
Shueb
What they are looking at is they want visibility, traceability, access control and when testing infrastructure removes those sphere the resilient disappears.
Shueb
So this is where the shift begins right.
Shueb
So how do we resolve this dilemma?
Shueb
So how do we ensure uh speed and security the control and scale compliance and as well as flexibility.
Shueb
So traditionally organizations thought they had to choose but what if the deployment model itself evolves right and uh that's what that's where the new shift comes in.
Shueb
The future is not on on-prem versus cloud.
Shueb
It is actually a controlled flexibility.
Shueb
So when you look at it, the modern testing infrastructure can be deployed inside the enterprises cloud, inside secured parameters or in an isolated private environments, right?
Shueb
Uh wherein uh the parallel executions, the enterprises own audit logs, compliance aligned by design and even when deployment adopts to government scalable becomes possible.
Shueb
And this actually leads to something very powerful.
Shueb
So if you look at the two sides of the same coin, right?
Shueb
Control versus scale.
Shueb
The engineering requires parallel execution, CI/CD integrations, hardware diversities, compliance requires data containment, audit traceability and access controls.
Shueb
These are not opposing forces.
Shueb
If deployment is rigid, compliance block speeds and if deployment adopts the government, both can coexist.
Shueb
Right?
Shueb
So this is the architectural resolution.
Shueb
And let me uh now show you how this works in practice.
Shueb
So our secured deployment options, right?
Shueb
So we want enterprises to start small uh which is basically a plugandplay lab solutions within their network wherein uh the data is not leaving their enterprises and u gradually scale with private load deployment that maintain isolations and enterprise grade controls.
Shueb
So the key idea here is you don't give up scale right.
Shueb
So you change where and how it is being deployed.
Shueb
So we'll try to understand how this really happens right.
Shueb
So when you look at it when you're scaling it with flexibility on the private load environment uh the the the infrastructure becomes pretty much scalable there is no infrastructure maintenance hassle and it is pretty much secured in the uh Pcloudy is data center right where we adhere to all the data center securities policies and so on plus 24/7 technical support and also enterprise access controls and behind this is the the enterprisegrade security where we are talking about uh what are all the certifications that matter right so when it comes to certifications we are compliant with sock 2 ISO 2701 GDPR HIPPA and uh others and when it comes to global data centers we have presence across uh different locations in India we have a couple of locations uh one in UAE one in US and also one in Singapore and we will be expanding towards uh Europe European region alone also few one more in uh US and followed by the Canada region right so the security posters is built and it is not retrified here so this is what it uh no compliance terms confidence and uh now let's see it in terms of how this security controls can be uh adopted what you see so there are a lot of benefits in terms of uh security layers there is additional security that gets added uh there is SSO that that can that can be simply uh implemented right so which is very seamless and secure logging in via either Google Microsoft authentications or even the other different uh SSOs that we adhere to right so that's something which add additional layer of security there's a custom sample that can be integrated uh with your IDPS uh which can you know instant enable and uh make sure the login are pretty secure two-actor authentications to fa that's something which can be uh deployed where it adds a protective layer against any unauthorized access uh with these two factor authentications either through SMSS or even through third party apps and when we talk about the data encryption uh the data is very much encrypted both at rest as well as in and transit so we use different data encryption policies uh it is AES 256 encryptions uh which is currently in place and uh and uh yeah that that is something where we follow as for the data encryption uh policy side.
Shueb
And when it comes to uh penetration testing, we pretty much do uh regular penetration testing where our platform underos automated and independent penetration testings uh annually, right?
Shueb
So to meet the very highest security standards and when it comes to uh the data uh residency yeah so it is very much regional as we mentioned in the previous uh slide the data centers are hosted across different region and so the data storage in different countries like in US Europe or even APAC regions which very much meets the the compliance and also the regulatory terms and uh there are few more advanced controls that are in place U you know that that is something uh which we can quickly discuss is uh talk about the white labeling right the the platform can be very much uh customized with your brand logos colors and domains to create a consistent experience uh for your different teams right so white labeling is something which most of the enterprises uh you know follow and there is domain controls as well where you can manage the domain specific policies uh for better governance all right so that's something which can be uh implemented as well and along with that a user provisionings right so where uh you know users can be added automatically manage the users either revoking the users creations of teams restrictions of uh users across different providers so that is something which is possible and and it is done via your identity identity provider right so pretty much from the user uh provisioning standpoint we pretty much adhere and when it comes to uh permissions uh even permissions can be very much customized right so you can actually set the role-based access to ensure every team members gets exactly what they need, right?
Shueb
And it's nothing more, right?
Shueb
So you may you may your teams may be distributed across uh different parts, right?
Shueb
And uh different teams, different projects and uh everyone's need is different, right?
Shueb
So you can actually segregate the devices among different teams by creating um you know different teams and adding you know specific teams to those specific devices.
Shueb
So, so it's ex exactly what they want and what they get, right?
Shueb
So, that's more on the permission side and plus uh our platform is very robust in terms of uh APIs uh where you can go ahead and then extract uh and analyze the uh test data uh not just that even automate workflows and build custom dashboards to uh track the KPIs.
Shueb
Right?
Shueb
So these uh uh these are additional uh controls and enterprises uh which can be customized and on top of it there are few more enhanced um security controls that could be added right even IPSec uh is something which can be configured right which will be configured both at uh the Pcloudy's data center on versus the uh enterprise uh firewall right so so that's a one-time activity uh where the firewalls are configured at both the parties and uh yeah pretty much controlled environment all the data uh will be within your uh you know tunnel right so the tunneling is something which uh we take care of it so there are various different connectivity options as well u we can help you walk through in detailed architecture if if you guys have further interest on understanding how this compliances and securities are implemented uh we'll be happy to uh schedule more calls around it so with that um I open up for uh Q&A.
Shueb
If there are any specific questions uh please feel free to go ahead.
Shueb
I think we are very well ahead of the time.
Shueb
So we can pretty much discuss here any any specific questions around the security and the compliances anything around the public cloud security uh where we'll be more than happy to answer your queries.
Shueb
All right, I can see few questions coming in.
Shueb
So let me uh start uh by taking this uh question.
Shueb
So so I have a question from a user.
Shueb
It says if a public load tools are so soft to an ISO certified where are they still rejected?
Shueb
Right.
Shueb
Okay.
Shueb
So see certifications are great actually great.
Shueb
Right.
Shueb
So they show the vendor uh follows all the strong policies practices.
Shueb
But when it comes to the regulated enterprises, they aren't just evaluated on based on the certifications but rather they are evaluated on control.
Shueb
Right?
Shueb
So in a shared public cloud the infrastructure is uh of course multi-enerant and it is being vendor managed.
Shueb
Uh audit auditors generally they usually ask do you fully control uh where your data runs and who can accesses it.
Shueb
So if the answer is the vendor manages that then it becomes little uncomfortable in that case right so so it's not about uh distrust it's about the ownership right so so public cloud as well follows all the security complaints it's it's all about the need uh for the regulated industries yeah hope that answers your question all right so I can see a few more questions coming in this is more related to uh testing.
Shueb
So, so the user who says uh why not rely on emulators?
Shueb
Okay.
Shueb
So, as I speak in my um in earlier slides, right?
Shueb
So, emulators cannot simulate real behaviors.
Shueb
Uh so, they don't replicate the real hardware.
Shueb
So few functions like the camera quakes, the GPS drifts, network instability, that there is a GPU uh rendering differences and um yeah if your users are on real devices, your validation should be uh too there, right?
Shueb
So emulators know reduce compliance risk but increases the uh the production risk.
Shueb
there are high chances of uh you know bugs that are being missed because they do not uh simulate the real behavior right more than 40% of real use case scenarios are not captured via emulators right so that's where we believe in uh real device testing and we recommend testing on real devices hope that answers your question all right so I can see one more question coming in uh again related to uh security on the VPN tunnel side.
Shueb
So the question is what about VPN tunnels to public close?
Shueb
All right.
Shueb
So when we when you look at VPN right so VPN basically they secure the data in uh transit right but uh complant concerns are rarely about interception uh they are about shared infrastructure multi-tenency and also visibility encryption solves uh the transport risk but it doesn't solves the uh the governance uh that's that's where the uh the the problem lies in right so there are few uh you know VP VPNs in in public cloud as well.
Shueb
I mean u uh we can set up a temporary uh tunnels uh that can be set up based on the use uh use case.
Shueb
Uh that's something whenever there is a need to connect to an internal systems uh when you want to secure an uh separate tunnel then that that's something which can be secured right and uh which can be used but yeah it is more preferred in case of a public uh private environments uh where you know there is a high possibility of uh setting it up the VPN tunnels with IPSec controlling on both the firewalls and making all the necessary changes right so where it adds an additional layer of uh security.
Shueb
All right.
Shueb
Hope that answers your question.
Shueb
Okay.
Shueb
Um I can see few more questions coming in.
Shueb
Uh let me just try to take it up.
Shueb
So how do regulators view private cloud versus on-prem?
Shueb
Very good question.
Shueb
Right.
Shueb
So regulators basically uh they care about control not the location here.
Shueb
Right.
Shueb
So if you demonstrate uh containment uh the traceability or even access governance private cloud is often acceptable compliance is uh outcomedriven but not building driven.
Shueb
All right.
Shueb
So that that's how it differentiates when when we talk about the regulators view on private versus uh an on-print setup.
Shueb
Okay.
Shueb
Okay, followed by there is another follow-up question.
Shueb
So is is the cloud inherently non-compliant?
Shueb
Uh answer is no.
Shueb
Uh see again regulated industries already run core systems in cloud.
Shueb
Right?
Shueb
The the issue is isn't about the cloud itself.
Shueb
It's the shared infrastructure and actually and also the loss of control.
Shueb
So cloud is fine but u you know it's an uncontrolled cloud isn't it?
Shueb
Right.
Shueb
So yeah it's the issue is not with the cloud itself.
Shueb
It's actually the state infrastructure.
Shueb
All right.
Shueb
Uh any other questions?
Shueb
Okay.
Shueb
Yeah, I can see a few more coming in.
Shueb
So, why not just build your own lab?
Shueb
Yeah, very good question.
Shueb
See, you can still build your own uh you can that's something which you can do it.
Shueb
But then uh what about the devices?
Shueb
Uh when when when there is a refresh, how do you do it?
Shueb
Right?
Shueb
So there is a lot of uh hassle in terms of maintenance the infrastructure uh and then there's a lot of uh fragmentations within the oss uh the scaling and also the scheduling and audiital audits becomes a high troll right so internal labs works but at very smaller scale you cannot really scale it for more number of uh devices that's where we have a lab in a box as one of the solutions right so wherein you can uh actually start small uh lab box basically comes with a small setup uh with the hardware and the required software where you can host a few devices uh and make it as a centralized uh solution right so users will be able to access and then gradually once you see that confidence coming in from the compliance and the security team you you actually can uh gradually scale up to a private cloud so that's something which I spoke about in my earlier slides as well uh but yes uh small labs can be uh done but it is only for the very for a small scale.
Shueb
All right.
Shueb
So another interesting question on the emulators.
Shueb
Uh what is the first step to move from the emulators safely?
Shueb
Right.
Shueb
Right.
Shueb
So a very good question again.
Shueb
So you can you can actually start by mapping your real uh compliance constraints here.
Shueb
uh so we need to identify whether if it's a data residency or a multi-tenency or even if it's a visibility right so once you actually understand the real constraint you can actually choose the right deployment right uh of course architecture is first and then tool is something which is second right so you need to identify the uh what is actually your real constraint could be from data side or could be from multi-tenency or even from visibility side and then yeah once you identified it becomes easy for you to move from emulators and then start your uh process of uh testing on the real device.
Shueb
All right.
Shueb
So I think um um that was u really good in terms of uh having some questions here.
Shueb
right more related to the security and the compliances and as well as on the emulators.
Shueb
So that was interesting.
Shueb
So I look forward for all your u support right in terms of uh you know understanding and um and understanding more from the regulatory and the compliance side.
Shueb
If you if you need any further clarifications, please feel free to reach us out uh and uh we'll be more than happy to answer to your queries.
Shueb
anything related to regular regulatory compliance or even uh from the product standpoint if you'd like to understand more on the product side we'll be more than happy to answer as well so with that I conclude and uh hand it over to you Jeroline
Jeroline
right thanks Shueb and uh I think this brings us to the end of today's session u and thank you so much Shueb for sharing such valuable insights um and uh to all the audience for being an engaged an interactive audience asking a lot of questions.
Jeroline
Uh but uh if we couldn't get to your question, don't worry.
Jeroline
You can always reach out to us at info@pcloudy.com or connect with us on LinkedIn.
Jeroline
And also a quick reminder, this session has been recorded and we'll be sharing this link with you soon.
Jeroline
So feel free to revisit the discussion anytime or share it with your colleagues.
Jeroline
Um and stay tuned for more uh webinars from Pcloudy.
Jeroline
Please uh ensure that you follow us on LinkedIn for more updates on AIdriven testing, automation and industry best practices.
Jeroline
So until next time, happy testing and have a great day.
Jeroline
Thank you.
