1. CACUBO Risk Management and Cloud Security
Central Association of College & University Business Officers
Kansas City
Winter Workshop
April 8, 2014
Risk Management and Cloud Security
Rodney A. Walsh, CGEIT, CRISC//Director of IT Risk Services Paco Diaz//Senior Consultant II

2. Agenda Define the cloud ecosystem Business use of cloud services
Cloud service risks
Governance of the cloud – critical policies, procedures & controls
Third-party management considerations for the cloud

3. Define the Cloud ecosystem

4. Define the Cloud Ecosystem
Cloud Computing: Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model is composed of five essential characteristics, three service models, and four deployment models.
Source: NIST Special Publication The NIST Definition of Cloud Computing (

5. Define the Cloud Ecosystem
Cloud Computing: Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model is composed of five essential characteristics, three service models, and four deployment models.
Source: NIST Special Publication The NIST Definition of Cloud Computing (

6. Define the Cloud Ecosystem
Essential Characteristics
On demand self service
Broad network access
Resource pooling
Rapid elasticity
Measured service

7. Define the Cloud Ecosystem
Service Models
Software as a Service (SaaS)
Platform as a Service (PaaS)
Infrastructure as a Service (IaaS)

8. Infrastructure as a Service
Define the Cloud Ecosystem
SaaS
Software as a Service
PaaS
Platform as a Service
IaaS
Infrastructure as a Service
Apps for Business
Adobe Creative Cloud

9. Define the Cloud Ecosystem
Deployment Models
Private cloud
Community cloud
Public cloud
Hybrid cloud

10. Define the Cloud Ecosystem
Private Cloud
Provisioned for single organization
May exist on or off site
May be managed by organization or outsourced
Private cloud. The cloud infrastructure is provisioned for exclusive use by a single organization comprising multiple consumers (e.g., business units). It may be owned, managed, and operated by the organization, a third party, or some combination of them, and it may exist on or off premises.

11. Define the Cloud Ecosystem
Community Cloud
Provisioned for exclusive use by a specific community
May be managed by one or more of the community organizations
May be managed by community organization or outsourced
The cloud infrastructure is provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be owned, managed, and operated by one or more of the organizations in the community, a third party, or some combination of them, and it may exist on or off premises.

12. Define the Cloud Ecosystem
Public Cloud
Provisioned for general public
Exists on the premise of the cloud provider
May be owned, managed & operated by a business, academic or government organization or a combination
The cloud infrastructure is provisioned for open use by the general public. It may be owned, managed, and operated by a business, academic, or government organization, or some combination of them. It exists on the premises of the cloud provider.

13. Define the Cloud Ecosystem
Hybrid Cloud
Combination of two or more distinct cloud infrastructures
Combines characteristics of private, public & community clouds
The cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load balancing between clouds).

14. Just Imagine
It will take over 132 billion 64GB iPads to hold all of the world’s electronic data by 2015?
2011 Digital Universe Study: Extracting Value from Chaos
Placing that many 64GB iPads end-to-end, it would go around the world over 790 times.
You could create two stacks of that many 64GB iPads that would reach the moon and a 3rd stack that would be 129,606 miles high.
That many 64GB iPads would cost $92.76 trillion dollars.
The cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load balancing between clouds).

15. Business use of cloud services

16. Business Use of Cloud Services
“By 2016, the average personal cloud will synchronize and orchestrate at least six different device types.
Gartner Predicts 2013: Cloud Computing Becomes an Integral Part of IT.
Issue #3– Developing a campus-wide cloud strategy.
EDUCAUSE “Top 10 IT Issues”, 2013

17. Business Use of Cloud Services
Financial Savings
Equipment
Personnel
Infrastructure
Space & utilities
Reduced obsolescence
Reduced capital expenditures
Reduced implementation costs

18. Business Use of Cloud Services
Increased Flexibility
Rapid deployment
Ability to add or reduce capacity
On-demand provisioning
Disaster recovery
Business expansion (across town or across the globe)

19. Business Use of Cloud Services
Streamlined business development
Focus on innovation & research
Reduced effort on management, maintenance & support
Simplified entry into or exiting from business initiatives
Increased access to technical expertise

20. Business Use of Cloud Services
“Slow transition to the Clouds continues.”
Kenneth C. Green- Campus Computing Project,
EDUCAUSE Annual Conference 10/17/2013.

21. Business Use of Cloud Services
Slow transition to the Clouds continues.
Kenneth C. Green- Campus Computing Project,
EDUCAUSE Annual Conference 10/17/2013.
Why so slow?
Absence of provider offerings.
Can’t visualize moving to the Cloud.
Want to retain command, control & computing.
Let others make the journey first.

22. Cloud service risks

23. Cloud Service Risks
Security – the system is protected against unauthorized access (physical and logical)

24. Cloud Service Risks Security
Physical access to infrastructure, systems & data
Physical location of systems, data
Logical access to the network, OS, applications & databases
Network & data segregation
Security – the system is protected against unauthorized access (physical and logical)

25. Cloud Service Risks Availability Cloud provider service interruptions
Data location/availability for restoration
Network/connectivity interruptions
Failure of the provider to adhere to SLAs
Service provider disaster recovery
Availability – the system is available for operation and use as committed or agreed

26. Cloud Service Risks Processing Integrity
Adherence to change management procedures
Incident management
Failure of the provider to adhere to SLAs
Timeliness
Accuracy
Authorization
Completeness
Processing integrity – system processing is complete, accurate, timely, and authorized

27. Cloud Service Risks Confidentiality Privacy
Comingling of data & other assets
Unauthorized access to sensitive or trade secret information
Privacy
International laws affecting service provider location
Regulatory compliance/legal liability
Breach & incident management
Confidentiality – Information designated as confidential is protected as committed or agreed

28. Governance of the cloud
Critical Policies, Procedures & Controls

29. Governance of the Cloud
Risk Management
Tools

30. Governance of the Cloud
Risk Management
Tools
Information Security
Data life cycle
Data classification
Formal policies & procedures

31. Governance of the Cloud
Risk Management
Tools
Metrics
Objectives
Define metrics
Periodic assessment & Review

32. Governance of the Cloud
Risk Management
Tools
SLAs
Access to data
Appropriate Controls
Management, counsel, IT & business owners involved

33. Governance of the Cloud
Risk Management
Tools
Data Flow Analysis
Understand life cycle
Develop data-flow schematics
Policies to review/update data flow documentation

34. Governance of the Cloud
Risk Management
Tools
Managing Computing Risk
App & Tech Inventory
In conjunction with data flow analysis
Address each layer of cloud “stack” risk.

35. Governance of the Cloud
Risk Management
Tools
Audit & Compliance
Regulatory implications
Use risk assessment tools and control frameworks
Assess control maturity
Vendor management

36. Governance of the Cloud
Risk Management
Tools
Control Frameworks (NIST, COBIT, CSA)
CIS Security Metrics v1.0.0
Cloud Security Alliance
NIST SP
NIST SP

37. Governance of the Cloud
Procedures/Tools Links
NIST Guidance
Cloud Security Alliance (CSA)
Information System Audit and Control Association (ISACA)
Computing-Management-Audit-Assurance-Program.aspx
The Center for Internet Security (CIS)

38. Third-party management considerations for the cloud

39. Third-Party Management
Use of the cloud
Transfers risk
Reduces control
Requires new control considerations
Service-level management
Third-party management

40. Third-Party Management
What Can You Do?
Define service levels for financial report systems
Create a framework to manage service level agreements KPIs
A designated individual responsible monitoring & reporting service level performance
Organization vendor management policy for the selection of outsources services
Determines that, before selection, potential third parties are qualified on 1) capability to deliver the service and 2) a review of their financial viability

41. Third-Party Management
What Can You Do?
Third-party service contracts address risks, security controls & procedures for information systems &
Procedures ensure that a formal contract is defined & agreed upon for all third-party services before work is initiated, including definition of internal control requirements & acceptance of the organization’s policies & procedures
A regular review of security, availability & processing integrity is performed for service-level agreements & related contracts with third-party service providers

42. Service Organization Control Reports
SOC 1
SOC 2
SOC 3
Purpose
Report on controls relevant to user entities ICFR 1
Report on controls related to compliance & operations
Use of Report
Restricted 2
Restricted 3
General
Report Detail
Includes Testing Detail
No Testing Detail
SOC 1
SOC 2
SOC 3
Purpose
Report on controls relevant to user entities ICFR 1
Report on controls related to compliance & operations
Use of Report
Restricted 2
Restricted 3
General
Report Detail
Includes Testing Detail
No Testing Detail
AICPA Interpretive Guidance
SSAE 16
& AICPA Guide
AT 101,
Trust Services Principles, & AICPA Guide
AT 101 &
Trust Services Principles
SOC 1
SOC 2
SOC 3
Purpose
Report on controls relevant to user entities ICFR 1
Report on controls related to compliance & operations
Use of Report
Restricted 2
Restricted 3
General
SOC 1
SOC 2
SOC 3
Purpose
Report on controls relevant to user entities ICFR 1
Report on controls related to compliance & operations
SOC 1
SOC 2
SOC 3
1Internal Control Over Financial Reporting
2Service Organization Management, Users, Users Auditor
3Service Organization Management, Users, Knowledgeable Parties

43. Thank You Risk Management and Cloud Security
Rodney A. Walsh, CGEIT, CRISC
Director of IT Risk Services
Paco Diaz, CISA
Senior Consultant II