CACUBO Risk Management and Cloud Security Central Association of College & University Business Officers Kansas City Winter Workshop April 8, 2014 Risk Management and Cloud Security Rodney A. Walsh, CGEIT, CRISC//Director of IT Risk Services Paco Diaz//Senior Consultant II

Agenda Define the cloud ecosystem Business use of cloud services Cloud service risks Governance of the cloud – critical policies, procedures & controls Third-party management considerations for the cloud

Define the Cloud ecosystem

Define the Cloud Ecosystem Cloud Computing: Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model is composed of five essential characteristics, three service models, and four deployment models. Source: NIST Special Publication 800-145 - The NIST Definition of Cloud Computing (http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf)

Define the Cloud Ecosystem Cloud Computing: Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model is composed of five essential characteristics, three service models, and four deployment models. Source: NIST Special Publication 800-145 - The NIST Definition of Cloud Computing (http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf)

Define the Cloud Ecosystem Essential Characteristics On demand self service Broad network access Resource pooling Rapid elasticity Measured service

Define the Cloud Ecosystem Service Models Software as a Service (SaaS) Platform as a Service (PaaS) Infrastructure as a Service (IaaS)

Infrastructure as a Service Define the Cloud Ecosystem SaaS Software as a Service PaaS Platform as a Service IaaS Infrastructure as a Service Apps for Business Adobe Creative Cloud

Define the Cloud Ecosystem Deployment Models Private cloud Community cloud Public cloud Hybrid cloud

Define the Cloud Ecosystem Private Cloud Provisioned for single organization May exist on or off site May be managed by organization or outsourced Private cloud. The cloud infrastructure is provisioned for exclusive use by a single organization comprising multiple consumers (e.g., business units). It may be owned, managed, and operated by the organization, a third party, or some combination of them, and it may exist on or off premises.

Define the Cloud Ecosystem Community Cloud Provisioned for exclusive use by a specific community May be managed by one or more of the community organizations May be managed by community organization or outsourced The cloud infrastructure is provisioned for exclusive use by a specific community of consumers from organizations that have shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be owned, managed, and operated by one or more of the organizations in the community, a third party, or some combination of them, and it may exist on or off premises.

Define the Cloud Ecosystem Public Cloud Provisioned for general public Exists on the premise of the cloud provider May be owned, managed & operated by a business, academic or government organization or a combination The cloud infrastructure is provisioned for open use by the general public. It may be owned, managed, and operated by a business, academic, or government organization, or some combination of them. It exists on the premises of the cloud provider.

Define the Cloud Ecosystem Hybrid Cloud Combination of two or more distinct cloud infrastructures Combines characteristics of private, public & community clouds The cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load balancing between clouds).

Just Imagine It will take over 132 billion 64GB iPads to hold all of the world’s electronic data by 2015? 2011 Digital Universe Study: Extracting Value from Chaos Placing that many 64GB iPads end-to-end, it would go around the world over 790 times. You could create two stacks of that many 64GB iPads that would reach the moon and a 3rd stack that would be 129,606 miles high. That many 64GB iPads would cost $92.76 trillion dollars. The cloud infrastructure is a composition of two or more distinct cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load balancing between clouds).

Business use of cloud services

Business Use of Cloud Services “By 2016, the average personal cloud will synchronize and orchestrate at least six different device types. Gartner Predicts 2013: Cloud Computing Becomes an Integral Part of IT. Issue #3– Developing a campus-wide cloud strategy. EDUCAUSE “Top 10 IT Issues”, 2013

Business Use of Cloud Services Financial Savings Equipment Personnel Infrastructure Space & utilities Reduced obsolescence Reduced capital expenditures Reduced implementation costs

Business Use of Cloud Services Increased Flexibility Rapid deployment Ability to add or reduce capacity On-demand provisioning Disaster recovery Business expansion (across town or across the globe)

Business Use of Cloud Services Streamlined business development Focus on innovation & research Reduced effort on management, maintenance & support Simplified entry into or exiting from business initiatives Increased access to technical expertise

Business Use of Cloud Services “Slow transition to the Clouds continues.” Kenneth C. Green- Campus Computing Project, EDUCAUSE Annual Conference 10/17/2013.

Business Use of Cloud Services Slow transition to the Clouds continues. Kenneth C. Green- Campus Computing Project, EDUCAUSE Annual Conference 10/17/2013. Why so slow? Absence of provider offerings. Can’t visualize moving to the Cloud. Want to retain command, control & computing. Let others make the journey first.

Cloud service risks

Cloud Service Risks Security – the system is protected against unauthorized access (physical and logical)

Cloud Service Risks Security Physical access to infrastructure, systems & data Physical location of systems, data Logical access to the network, OS, applications & databases Network & data segregation Security – the system is protected against unauthorized access (physical and logical)

Cloud Service Risks Availability Cloud provider service interruptions Data location/availability for restoration Network/connectivity interruptions Failure of the provider to adhere to SLAs Service provider disaster recovery Availability – the system is available for operation and use as committed or agreed

Cloud Service Risks Processing Integrity Adherence to change management procedures Incident management Failure of the provider to adhere to SLAs Timeliness Accuracy Authorization Completeness Processing integrity – system processing is complete, accurate, timely, and authorized

Cloud Service Risks Confidentiality Privacy Comingling of data & other assets Unauthorized access to sensitive or trade secret information Privacy International laws affecting service provider location Regulatory compliance/legal liability Breach & incident management Confidentiality – Information designated as confidential is protected as committed or agreed

Governance of the cloud Critical Policies, Procedures & Controls

Governance of the Cloud Risk Management Tools

Governance of the Cloud Risk Management Tools Information Security Data life cycle Data classification Formal policies & procedures

Governance of the Cloud Risk Management Tools Metrics Objectives Define metrics Periodic assessment & Review

Governance of the Cloud Risk Management Tools SLAs Access to data Appropriate Controls Management, counsel, IT & business owners involved

Governance of the Cloud Risk Management Tools Data Flow Analysis Understand life cycle Develop data-flow schematics Policies to review/update data flow documentation

Governance of the Cloud Risk Management Tools Managing Computing Risk App & Tech Inventory In conjunction with data flow analysis Address each layer of cloud “stack” risk.

Governance of the Cloud Risk Management Tools Audit & Compliance Regulatory implications Use risk assessment tools and control frameworks Assess control maturity Vendor management

Governance of the Cloud Risk Management Tools Control Frameworks (NIST, COBIT, CSA) CIS Security Metrics v1.0.0 Cloud Security Alliance NIST SP 800-146 NIST SP 500-293

Governance of the Cloud Procedures/Tools Links NIST Guidance http://csrc.nist.gov/publications/nistpubs/800-146/sp800-146.pdf http://www.nist.gov/itl/cloud/upload/SP_500_293_volumeII.pdf Cloud Security Alliance (CSA) https://cloudsecurityalliance.org/guidance/csaguide.v3.0.pdf https://cloudsecurityalliance.org/download/cloud-controls-matrix-v3/ Information System Audit and Control Association (ISACA) http://www.isaca.org/Knowledge-Center/Research/ResearchDeliverables/Pages/Cloud- Computing-Management-Audit-Assurance-Program.aspx The Center for Internet Security (CIS) https://benchmarks.cisecurity.org/tools2/metrics/CIS_Security_Metrics_v1.1.0.pdf

Third-party management considerations for the cloud

Third-Party Management Use of the cloud Transfers risk Reduces control Requires new control considerations Service-level management Third-party management

Third-Party Management What Can You Do? Define service levels for financial report systems Create a framework to manage service level agreements KPIs A designated individual responsible monitoring & reporting service level performance Organization vendor management policy for the selection of outsources services Determines that, before selection, potential third parties are qualified on 1) capability to deliver the service and 2) a review of their financial viability

Third-Party Management What Can You Do? Third-party service contracts address risks, security controls & procedures for information systems & Procedures ensure that a formal contract is defined & agreed upon for all third-party services before work is initiated, including definition of internal control requirements & acceptance of the organization’s policies & procedures A regular review of security, availability & processing integrity is performed for service-level agreements & related contracts with third-party service providers

Service Organization Control Reports SOC 1 SOC 2 SOC 3 Purpose Report on controls relevant to user entities ICFR 1 Report on controls related to compliance & operations Use of Report Restricted 2 Restricted 3 General Report Detail Includes Testing Detail No Testing Detail SOC 1 SOC 2 SOC 3 Purpose Report on controls relevant to user entities ICFR 1 Report on controls related to compliance & operations Use of Report Restricted 2 Restricted 3 General Report Detail Includes Testing Detail No Testing Detail AICPA Interpretive Guidance SSAE 16 & AICPA Guide AT 101, Trust Services Principles, & AICPA Guide AT 101 & Trust Services Principles SOC 1 SOC 2 SOC 3 Purpose Report on controls relevant to user entities ICFR 1 Report on controls related to compliance & operations Use of Report Restricted 2 Restricted 3 General SOC 1 SOC 2 SOC 3 Purpose Report on controls relevant to user entities ICFR 1 Report on controls related to compliance & operations SOC 1 SOC 2 SOC 3 1Internal Control Over Financial Reporting 2Service Organization Management, Users, Users Auditor 3Service Organization Management, Users, Knowledgeable Parties

Thank You Risk Management and Cloud Security Rodney A. Walsh, CGEIT, CRISC Director of IT Risk Services Paco Diaz, CISA Senior Consultant II