Information Security and Cloud Computing

In my previous post "ITIL, ISO 20000, ISO 27001 what else is there?" I have mentioned 36 different frameworks connected to IT Service Management that can be used in everyday working.

Interestingly none of them explicitly mentions security using cloud services. Not even ITIL , ISO 20000:2011 or ISO 27001:2005. ISO 27001:2013, expected to come out at the end of this year, will try to bring change to this, it will separate two domains and create a new one on Provider Relations to cover cloud area. The framework is called COSO’s Enterprise Risk Management – Integrated Framework. COSO stands for Committee of Sponsoring Organizations of the Treadway Commission and it is American private sector joined initiative dedicated to development of comprehensive frameworks and guidance on enterprise risk management, internal control, and fraud deterrence designed to improve organizational performance and governance and to reduce the extent of fraud in organizations.

What is this framework about? The framework put forth in COSO’s Enterprise Risk Management – Integrated Framework has established a common language and foundation that can be used to construct an effective cloud governance program tailored specifically for a given cloud solution.

In the picture below, the framework is represented as a pathway in which each ERM component (starting with internal environment) is applied in order to understand the specific advantages and disadvantages that a given solution candidate would bring to the organization. When the process is completed for each cloud solution candidate, the ideal cloud solution will emerge along with its related requisites for establishing cloud governance. In cases where a cloud solution has already been implemented, the COSO ERM framework can be used to establish, refine, or perform a quality assurance check of the cloud governance program by ensuring that all major aspects of the program (e.g., objectives, risk assessment, and risk response) have been addressed with respect to management’s requirements.

COSO ERM Framework to Cloud Computing Options

The ERM framework components:

1. Internal Environment – The internal environment component serves as the foundation for and defines the organization’s risk appetite in terms of how risks and controls are viewed. For instance, if management has a policy of not outsourcing any of its operations (i.e., there is a culture of risk avoidance), this policy will limit the viable options for cloud deployment and service delivery models so that private cloud solutions might be the only acceptable alternative.
2. Objective Setting – Management needs to evaluate how cloud computing aligns with the organization’s objectives. Depending on the circumstances, cloud computing might present an opportunity for the organization to enhance its ability to achieve existing objectives, or it might present an opportunity to gain a competitive advantage, which would require new objectives to be defined.
3. Event Identification – Management is responsible for identifying the events (either opportunities or risks) that can affect the achievement of objectives. The complexity of event identification and risk assessment processes increases when an organization engages cloud service providers.
4. Risk Assessment – Management should evaluate the risk events associated with its cloud strategy to determine the potential impact of the risks associated with each cloud computing option. Ideally, risk assessments should be completed before an organization moves to a cloud solution. 
5. Risk Response – Once risks have been identified and assessed in the context of organizational objectives relative to cloud computing, management needs to determine its risk response. There are four types of risk responses: avoidance, reduction, sharing and acceptance. 
6. Control Activities – The traditional types of controls –preventive, detective, manual, automated, and entity-level – apply to cloud computing as well. The difference introduced by cloud computing is that some control responsibilities might remain with the organization while certain control responsibilities will be transferred to the CSP. If the quality of an organization’s existing control activities is moderate or poor, going to a cloud solution could exacerbate internal control weaknesses. For example, if an organization with poor password controls or data security practices migrates its computing environment to a public or hybrid cloud solution, the possibility of an external security breach is likely to increase significantly due to the fact that access to the organization’s technology base is now through the public Internet.  
7. Information and Communication – To effectively operate its business and manage the related risks, management relies on timely and accurate information and communications from various sources regarding external and internal events. With cloud computing, information received from a CSP might not be as timely or of the same quality as information from an internal IT function. As a result, fulfilling management’s information and communications requirements might require additional or different information processes and sources.  
8. Monitoring – “Risk responses that were once effective may become irrelevant; control activities may become less effective, or no longer be performed; or entity objectives may change.” That statement from 2004 in the COSO’s Enterprise Risk Management – Integrated Framework remains applicable in the age of cloud computing. Management must continue to monitor the effectiveness of its ERM program to verify that the program adequately addresses the relevant risks and facilitates achieving the organization’s objectives. 

What are some of the risks applicable to the cloud environment?

• Disruptive force - Facilitating innovation (with increased speed) and the cost-savings aspects of cloud computing can themselves be viewed as risk events for some organizations
• Residing in the same risk ecosystem as the CSP and other tenants of the cloud
• Lack of transparency
• Reliability and performance issues
• Vendor lock-in and lack of application portability or interoperability
• Security and compliance concerns
• High-value cyber-attack targets
• Risk of data leakage
• IT organizational changes
• Cloud service provider viability

Before proceeding to the cloud environment  be able to give answers to the following question connected to the data and the cloud provider

• Which services and related data can be moved safely into the cloud, and when?
• How will sensitive data be protected in storage, in transit, and in use?
• How can access to cloud-based data and services through new hard-to-control devices such as smartphones and iPads be managed in line with security requirements?
• What security levers built into cloud architecture components can be pulled to mitigate new risks?
• How can companies be sure that cloud service providers are compliant with their security requirements?
• Are industry-recognized security standards applicable?
• Will the incremental cost of cloud security potentially offset the commercial benefits?

If you want to read more about the COSO’s Enterprise Risk Management you can download the following paper: COSO ERM Framework