Managing risk in the cloud
October 10, 2011
Cloud computing allows the procurement of IT services from both internal and external suppliers to be optimised because the services are delivered remotely in a standard way. The cloud is not a single model, but covers a wide spectrum from applications shared between multiple tenants to virtual servers used by one customer.
The key benefit is one of scale; a cloud provider can potentially offer a better service at a lower cost because it has a large enough operation to afford the skilled people and state-of-the-art technology necessary for a secure service. In general, a large cloud provider is likely to provide a better and more secure IT service at a lower cost than a small to medium sized organisation could provide itself…
While the public cloud offers applications shared by multiple customers, the community cloud is confined to a selected group (for example, government or healthcare) and membership is strictly controlled. This reduces the risks from the activities of co-tenants while retaining many of the benefits of scale. The private cloud provides applications and infrastructure dedicated to a particular organisation, allowing it to outsource the management of its IT infrastructure while retaining tighter control over the location and management of the resources. The price for this is that the costs are likely to be higher than for a public cloud because there is less potential for economy of scale, and resilience may be lower because of the limit on resources available.
The information security risk associated with cloud computing depends on the service and delivery models, and the specific risks depend on the individual requirements of the organisation. Common security concerns across this spectrum are ensuring the confidentiality, integrity and availability of the services and data.
The approach to managing risk from the perspective of the cloud customer is one of due diligence – ensuring that the requirements are clearly understood, the risks assessed, the right questions asked and appropriate controls included in the service level agreements.
The principal information security issues are summarised below. Because of the wide spectrum covered by the cloud, their priority will depend on the model adopted and the individual circumstances:
• Compliance – Identify the business requirements for compliance with laws and regulations and ensure that the cloud provider is able to answer how they will meet these needs.
• Service location – Identify the legal constraints on the geographic location of the cloud provider, the service and the data, and ensure that they are addressed in the service contracts.
• Data security – Identify and classify the data being moved to the cloud and specify the security requirements in terms of confidentiality, integrity and availability. Ensure that data ownership and return is clear in contracts.
• Availability – Identify the service availability requirements and assure that the provider is capable of meeting these. Don’t forget the intermediate infrastructure and equipment under your control.
• Identity and access management – Specify the needs for identity management and access control and assure that it will be delivered securely.
• Insider abuse of privilege – Confirm that the cloud service provider has processes and technology to properly control privileged access and prevent data leakage.
• Internet threats – Determine the level of protection needed against internet-based threats and ensure that the steps to be taken both by the cloud provider and internally are adequate.
• Monitoring – Ensure that the business and legal requirements are met while separating the monitoring data relating to different clients.
Taking a good governance approach, such as COBIT1, is the key to safely embracing the cloud and its benefits. COBIT provides guidance to:
• Identify the requirements for the cloud based solution.
• Determine the governance needs based on the requirements. Some applications will be more critical than others.
• Develop scenarios to understand the security threats and weaknesses. Use these to determine the risk response in terms of requirements for controls and questions to be answered. Risk IT, based on COBIT2, provides an ideal framework for this.
• Understand what the accreditations and audit reports offered by the cloud provider mean and what they cover.
Cloud computing can reduce costs by providing alternative models for the procurement and delivery of IT services, and many organisations have already adopted an outsourcing approach to non-core internal functions such as IT. However, it is important to consider the risks involved in a move to the cloud, and good governance provides a way forward.