Cloud Computing Oyinkan Adedun Adeleye Caitlyn Carney Tyler Nguyen

Cloud Computing Oyinkan Adedun Adeleye Caitlyn Carney Tyler Nguyen

Definition What is the Cloud? On-demand service model for IT provision, often based on virtualization and distributed computing technologies. Applications and data stored and maintained on shared machines in a web-based environment Can include web-based applications, web-hosted services, centralized data centers and server farms, and platforms for running and developing applications. Key Terms: Cloud Service Provider (CSP) Multi-tenancy

Overview Cloud Deployment Models: Private Community Public Hybrid Cloud Service Delivery Models: Software as a service (SaaS) Platform as a service (PaaS) Infrastructure as service (IaaS)

Benefits of Cloud Computing Decreased capital costs Decreased IT operating costs No hardware or software installation or maintenance Scalability & Flexibility Speed of Deployment Specialized/Highly abstracted resources Environmental Considerations

Risk Relationship with Cloud Models

Cloud Computing Risks Lack of Total Control Reliability/System availability Netflix experienced a total outage for two days Christmas eve and Christmas Day Cloud Provide, Amazon had a service outage Lack of Transparency

Cloud Computing Risks Non-Compliance (Regulatory, Disclosure) Getting stuck with a provider; Proprietary code Data Security Cloud service provider viability Most providers are young companies Longevity and profitability is questionable

Cloud Computing Controls Risk Controls Loss of IT Governance Management oversight and operations monitoring controls Lack of Transparency Assessments of CSP control environment: Control related inquiries in RFP Right to audit clause in SLA Interviews with CSP to determine how certain risk events would be addressed Require internal audit evaluation or independent audit reports (i.e. SOC 2) Unauthorized Cloud Activity Cloud Policies & Controls: Cloud usage policy List of approved cloud vendors CSP relationship management

Cloud Computing Controls Risk Controls Security, Noncompliance, Data Leakage Data Classification Policies: Defining purpose and ownership of different types of organizational data Mapping legal, regulatory, IP, and security requirements to various types of data Determining sensitivity (public, restricted, highly sensitive) Determining requirements for data transmission (i.e encryption methods) Non compliance with regulations: Monitoring of external environment Non compliance with disclosure requirements: New disclosures in financial reporting

Cloud Computing Controls Risk Controls Reliability & Performance, System Availability High Value CyberAttack Target Vendor lock-in and lack of application portability or inoperability Incident management controls Disaster Recovery/BCP controls Processes to monitor system availability Automated tools to provide resources on demand for cloud solution from another service provider Review SLAs to ensure CSP will provide adequate response in event of system failure Incident management controls Host only nonessential and non-sensitive data on third party CSP solutions Deploy encryption over data hosted on cloud solutions Have a defined fail-over strategy Prepare an exit strategy/contingency plan for overall cloud strategy

Conclusion Cloud computing is a widely used and growing technology. Gartner predicts it will be a 140 billion industry by 2014. Many cloud-based solutions are available in today’s market, each with unique risks. It is essential that organizations effectively manage the key risks associated with their specific cloud infrastructure in order to fully take advantage of opportunities presented by the cloud.

Cloud Services Market by Segment

Sources http ://www.coso.org/documents/Cloud%20Computing%20Tho ught%20Paper.pdf https ://resilience.enisa.europa.eu/cloud-security-and-resilienc e/publications/cloud-computing-benefits-risks-and-recom mendations-for-information-security https:// www.f5.com/pdf/white-papers/controlling-the-cloud-wp.p df http://www.cliftonlarsonallen.com/Risk-Management/TheBenefits-and-Risks-of-Cloud-Computing.aspx http://aimdegree.com/research/ebriefings/eb-betcher.php http://www.forbes.com/sites/louiscolumbus/2013/02/19/g artner-predicts-infrastructure-services-will-accelerate-clo ud-computing-growth