Risk Management and Cloud Security

1. CACUBO Central Association of College & University Business Officers Kansas City Winter Workshop April 8, 2014 Risk Management and Cloud Security Rodney A. Walsh, CGEIT, CRISC//Director of IT Risk Services Paco Diaz//Senior Consultant II

2. Agenda Define the cloud ecosystem Business use of cloud services Cloud service risks Governance of the cloud – critical policies, procedures & controls Third-party management considerations for the cloud

3. Define the Cloud ecosystem

4. Define the Cloud Ecosystem Cloud Computing: Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model is composed of five essential characteristics, three service models, and four deployment models. Source: NIST Special Publication 800-145 - The NIST Definition of Cloud Computing (http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf)

5. Define the Cloud Ecosystem Cloud Computing: Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.This cloud model is composed of five essential characteristics, three service models, and four deployment models. Source: NIST Special Publication 800-145 - The NIST Definition of Cloud Computing (http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf)

6. Define the Cloud Ecosystem Essential Characteristics • On demand self service • Broad network access • Resource pooling • Rapid elasticity • Measured service

7. Define the Cloud Ecosystem Service Models • Software as a Service (SaaS) • Platform as a Service (PaaS) • Infrastructure as a Service (IaaS)

8. Define the Cloud Ecosystem Apps for Business Adobe Creative Cloud

9. Define the Cloud Ecosystem Deployment Models • Private cloud • Community cloud • Public cloud • Hybrid cloud

10. Define the Cloud Ecosystem Private Cloud • Provisioned for single organization • May exist on or off site • May be managed by organization or outsourced

11. Define the Cloud Ecosystem Community Cloud • Provisioned for exclusive use by a specific community • May be managed by one or more of the community organizations • May be managed by community organization or outsourced

12. Define the Cloud Ecosystem Public Cloud • Provisioned for general public • Exists on the premise of the cloud provider • May be owned, managed & operated by a business, academic or government organization or a combination

13. Define the Cloud Ecosystem Hybrid Cloud • Combination of two or more distinct cloud infrastructures • Combines characteristics of private, public & community clouds

14. Just Imagine It will take over 132 billion 64GB iPads to hold all of the world’s electronic data by 2015? 2011 Digital Universe Study: Extracting Value from Chaos Placing that many 64GB iPads end-to-end, it would go around the world over 790 times. You could create two stacks of that many 64GB iPads that would reach the moon and a 3rd stack that would be 129,606 miles high. That many 64GB iPads would cost $92.76 trillion dollars.

15. Business use of cloud services

16. Business Use of Cloud Services “By 2016, the average personal cloud will synchronize and orchestrate at least six different device types. Gartner Predicts 2013: Cloud Computing Becomes an Integral Part of IT. Issue #3– Developing a campus-wide cloud strategy. EDUCAUSE “Top 10 IT Issues”, 2013

17. Business Use of Cloud Services Financial Savings • Equipment • Personnel • Infrastructure • Space & utilities • Reduced obsolescence • Reduced capital expenditures • Reduced implementation costs

18. Business Use of Cloud Services Increased Flexibility • Rapid deployment • Ability to add or reduce capacity • On-demand provisioning • Disaster recovery • Business expansion (across town or across the globe)

19. Business Use of Cloud Services Streamlined business development • Focus on innovation & research • Reduced effort on management, maintenance & support • Simplified entry into or exiting from business initiatives • Increased access to technical expertise

20. Business Use of Cloud Services “Slow transition to the Clouds continues.” Kenneth C. Green- Campus Computing Project, EDUCAUSE Annual Conference 10/17/2013.

21. Business Use of Cloud Services Slow transition to the Clouds continues. Kenneth C. Green- Campus Computing Project, EDUCAUSE Annual Conference 10/17/2013. Why so slow? • Absence of provider offerings. • Can’t visualize moving to the Cloud. • Want to retain command, control & computing. • Let others make the journey first.

22. Cloud service risks

23. Cloud Service Risks

24. Cloud Service Risks Security • Physical access to infrastructure, systems & data • Physical location of systems, data • Logical access to the network, OS, applications & databases • Network & data segregation

25. Cloud Service Risks Availability • Cloud provider service interruptions • Data location/availability for restoration • Network/connectivity interruptions • Failure of the provider to adhere to SLAs • Service provider disaster recovery

26. Cloud Service Risks Processing Integrity • Adherence to change management procedures • Incident management • Failure of the provider to adhere to SLAs • Timeliness • Accuracy • Authorization • Completeness

27. Cloud Service Risks Confidentiality • Comingling of data & other assets • Unauthorized access to sensitive or trade secret information Privacy • International laws affecting service provider location • Regulatory compliance/legal liability • Breach & incident management

28. Critical Policies, Procedures & Controls Governance of the cloud

29. Governance of the Cloud • Governance • Risk Management • Tools

30. Governance of the Cloud • Governance • Risk Management • Tools • Information Security • Data life cycle • Data classification • Formal policies & procedures

31. Governance of the Cloud • Governance • Risk Management • Tools • Metrics • Objectives • Define metrics • Periodic assessment & Review

32. Governance of the Cloud • Governance • Risk Management • Tools • SLAs • Access to data • Appropriate Controls • Management, counsel, IT & business owners involved

33. Governance of the Cloud • Governance • Risk Management • Tools • Data Flow Analysis • Understand life cycle • Develop data-flow schematics • Policies to review/update data flow documentation

34. Governance of the Cloud • Governance • Risk Management • Tools • Managing Computing Risk • App & Tech Inventory • In conjunction with data flow analysis • Address each layer of cloud “stack” risk.

35. Governance of the Cloud • Governance • Risk Management • Tools • Audit & Compliance • Regulatory implications • Use risk assessment tools and control frameworks • Assess control maturity • Vendor management

36. Governance of the Cloud • Governance • Risk Management • Tools • Control Frameworks (NIST, COBIT, CSA) • CIS Security Metrics v1.0.0 • Cloud Security Alliance • NIST SP 800-146 • NIST SP 500-293

37. Governance of the Cloud Procedures/Tools Links NIST Guidance • http://csrc.nist.gov/publications/nistpubs/800-146/sp800-146.pdf • http://www.nist.gov/itl/cloud/upload/SP_500_293_volumeII.pdf Cloud Security Alliance (CSA) • https://cloudsecurityalliance.org/guidance/csaguide.v3.0.pdf • https://cloudsecurityalliance.org/download/cloud-controls-matrix-v3/ Information System Audit and Control Association (ISACA) • http://www.isaca.org/Knowledge-Center/Research/ResearchDeliverables/Pages/Cloud-Computing-Management-Audit-Assurance-Program.aspx The Center for Internet Security (CIS) • https://benchmarks.cisecurity.org/tools2/metrics/CIS_Security_Metrics_v1.1.0.pdf

38. Third-party management considerations for the cloud

39. Third-Party Management Use of the cloud • Transfers risk • Reduces control Requires new control considerations • Service-level management • Third-party management

40. Third-Party Management What Can You Do? • Define service levels for financial report systems • Create a framework to manage service level agreements KPIs • A designated individual responsible monitoring & reporting service level performance • Organization vendor management policy for the selection of outsources services • Determines that, before selection, potential third parties are qualified on 1) capability to deliver the service and 2) a review of their financial viability

41. Third-Party Management What Can You Do? • Third-party service contracts address risks, security controls & procedures for information systems & • Procedures ensure that a formal contract is defined & agreed upon for all third-party services before work is initiated, including definition of internal control requirements & acceptance of the organization’s policies & procedures • A regular review of security, availability & processing integrity is performed for service-level agreements & related contracts with third-party service providers

42. Service Organization Control Reports 1Internal Control Over Financial Reporting 2Service Organization Management, Users, Users Auditor 3Service Organization Management, Users, Knowledgeable Parties

43. Risk Management and Cloud Security Thank You Rodney A. Walsh, CGEIT, CRISC Director of IT Risk Services Paco Diaz, CISA Senior Consultant II