R ISK M ANAGEMENT AND C LOUD S ECURITY Rodney A. Walsh, CGEIT, CRISC//Director of IT Risk Services Paco Diaz//Senior Consultant II CACUBO Central Association of College & University Business Officers Kansas City Winter Workshop April 8, 2014

Risk Management & Cloud Security February 19, Define the cloud ecosystem Business use of cloud services Cloud service risks Governance of the cloud – critical policies, procedures & controls Third-party management considerations for the cloud Agenda

Risk Management & Cloud Security February 19, DEFINE THE CLOUD ECOSYSTEM

Risk Management & Cloud Security February 19, Define the Cloud Ecosystem Cloud Computing: Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model is composed of five essential characteristics, three service models, and four deployment models. Source: NIST Special Publication The NIST Definition of Cloud Computing ( )

Risk Management & Cloud Security February 19, Define the Cloud Ecosystem Cloud Computing: Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model is composed of five essential characteristics, three service models, and four deployment models. Source: NIST Special Publication The NIST Definition of Cloud Computing ( )

Risk Management & Cloud Security February 19, Define the Cloud Ecosystem Essential Characteristics  On demand self service  Broad network access  Resource pooling  Rapid elasticity  Measured service

Risk Management & Cloud Security February 19, Define the Cloud Ecosystem Service Models  Software as a Service (SaaS)  Platform as a Service (PaaS)  Infrastructure as a Service (IaaS)

Risk Management & Cloud Security February 19, SaaS Software as a Service PaaS Platform as a Service IaaS Infrastructure as a Service Define the Cloud Ecosystem Apps for Business Adobe Creative Cloud

Risk Management & Cloud Security February 19, Define the Cloud Ecosystem Deployment Models  Private cloud  Community cloud  Public cloud  Hybrid cloud

Risk Management & Cloud Security February 19, Define the Cloud Ecosystem Private Cloud  Provisioned for single organization  May exist on or off site  May be managed by organization or outsourced

Risk Management & Cloud Security February 19, Define the Cloud Ecosystem Community Cloud  Provisioned for exclusive use by a specific community  May be managed by one or more of the community organizations  May be managed by community organization or outsourced

Risk Management & Cloud Security February 19, Define the Cloud Ecosystem Public Cloud  Provisioned for general public  Exists on the premise of the cloud provider  May be owned, managed & operated by a business, academic or government organization or a combination

Risk Management & Cloud Security February 19, Define the Cloud Ecosystem Hybrid Cloud  Combination of two or more distinct cloud infrastructures  Combines characteristics of private, public & community clouds

Risk Management & Cloud Security February 19, Just Imagine 2011 Digital Universe Study: Extracting Value from Chaos It will take over 132 billion 64GB iPads to hold all of the world’s electronic data by 2015? Placing that many 64GB iPads end-to-end, it would go around the world over 790 times. You could create two stacks of that many 64GB iPads that would reach the moon and a 3 rd stack that would be 129,606 miles high. That many 64GB iPads would cost $92.76 trillion dollars.

Risk Management & Cloud Security February 19, BUSINESS USE OF CLOUD SERVICES

Risk Management & Cloud Security February 19, Business Use of Cloud Services “By 2016, the average personal cloud will synchronize and orchestrate at least six different device types. Gartner Predicts 2013: Cloud Computing Becomes an Integral Part of IT. Issue #3– Developing a campus-wide cloud strategy. EDUCAUSE “Top 10 IT Issues”, 2013

Risk Management & Cloud Security February 19, Financial Savings  Equipment  Personnel  Infrastructure  Space & utilities  Reduced obsolescence  Reduced capital expenditures  Reduced implementation costs Business Use of Cloud Services

Risk Management & Cloud Security February 19, Increased Flexibility  Rapid deployment  Ability to add or reduce capacity  On-demand provisioning  Disaster recovery  Business expansion (across town or across the globe) Business Use of Cloud Services

Risk Management & Cloud Security February 19, Streamlined business development  Focus on innovation & research  Reduced effort on management, maintenance & support  Simplified entry into or exiting from business initiatives  Increased access to technical expertise Business Use of Cloud Services

Risk Management & Cloud Security February 19, “Slow transition to the Clouds continues.” Kenneth C. Green- Campus Computing Project, EDUCAUSE Annual Conference 10/17/2013. Business Use of Cloud Services

Risk Management & Cloud Security February 19, Slow transition to the Clouds continues. Kenneth C. Green- Campus Computing Project, EDUCAUSE Annual Conference 10/17/2013. Why so slow?  Absence of provider offerings.  Can’t visualize moving to the Cloud.  Want to retain command, control & computing.  Let others make the journey first. Business Use of Cloud Services

Risk Management & Cloud Security February 19, CLOUD SERVICE RISKS

Risk Management & Cloud Security February 19, Cloud Service Risks

Risk Management & Cloud Security February 19, Cloud Service Risks Security  Physical access to infrastructure, systems & data  Physical location of systems, data  Logical access to the network, OS, applications & databases  Network & data segregation

Risk Management & Cloud Security February 19, Availability  Cloud provider service interruptions  Data location/availability for restoration  Network/connectivity interruptions  Failure of the provider to adhere to SLAs  Service provider disaster recovery Cloud Service Risks

Risk Management & Cloud Security February 19, Processing Integrity  Adherence to change management procedures  Incident management  Failure of the provider to adhere to SLAs Timeliness Accuracy Authorization Completeness Cloud Service Risks

Risk Management & Cloud Security February 19, Confidentiality  Comingling of data & other assets  Unauthorized access to sensitive or trade secret information Privacy  International laws affecting service provider location  Regulatory compliance/legal liability  Breach & incident management Cloud Service Risks

Risk Management & Cloud Security February 19, GOVERNANCE OF THE CLOUD Critical Policies, Procedures & Controls

Risk Management & Cloud Security February 19, Governance of the Cloud  Governance  Risk Management  Tools

Risk Management & Cloud Security February 19, Governance of the Cloud  Governance  Risk Management  Tools Information Security Data life cycle Data classification Formal policies & procedures

Risk Management & Cloud Security February 19, Governance of the Cloud  Governance  Risk Management  Tools Metrics Objectives Define metrics Periodic assessment & Review

Risk Management & Cloud Security February 19, Governance of the Cloud  Governance  Risk Management  Tools SLAs Access to data Appropriate Controls Management, counsel, IT & business owners involved

Risk Management & Cloud Security February 19, Governance of the Cloud  Governance  Risk Management  Tools Data Flow Analysis Understand life cycle Develop data-flow schematics Policies to review/update data flow documentation

Risk Management & Cloud Security February 19, Governance of the Cloud  Governance  Risk Management  Tools Managing Computing Risk App & Tech Inventory In conjunction with data flow analysis Address each layer of cloud “stack” risk.

Risk Management & Cloud Security February 19, Governance of the Cloud  Governance  Risk Management  Tools Audit & Compliance Regulatory implications Use risk assessment tools and control frameworks Assess control maturity Vendor management

Risk Management & Cloud Security February 19, Governance of the Cloud  Governance  Risk Management  Tools Control Frameworks (NIST, COBIT, CSA) CIS Security Metrics v1.0.0 Cloud Security Alliance NIST SP NIST SP

Risk Management & Cloud Security February 19, Procedures/Tools Links NIST Guidance Cloud Security Alliance (CSA) Information System Audit and Control Association (ISACA) Computing-Management-Audit-Assurance-Program.aspx Computing-Management-Audit-Assurance-Program.aspx The Center for Internet Security (CIS) Governance of the Cloud

Risk Management & Cloud Security February 19, THIRD-PARTY MANAGEMENT CONSIDERATIONS FOR THE CLOUD

Risk Management & Cloud Security February 19, Third-Party Management Use of the cloud  Transfers risk  Reduces control Requires new control considerations  Service-level management  Third-party management

Risk Management & Cloud Security February 19, Third-Party Management What Can You Do? Define service levels for financial report systems Create a framework to manage service level agreements KPIs A designated individual responsible monitoring & reporting service level performance Organization vendor management policy for the selection of outsources services Determines that, before selection, potential third parties are qualified on 1) capability to deliver the service and 2) a review of their financial viability

Risk Management & Cloud Security February 19, Third-Party Management What Can You Do? Third-party service contracts address risks, security controls & procedures for information systems & Procedures ensure that a formal contract is defined & agreed upon for all third-party services before work is initiated, including definition of internal control requirements & acceptance of the organization’s policies & procedures A regular review of security, availability & processing integrity is performed for service-level agreements & related contracts with third-party service providers

Risk Management & Cloud Security February 19, Service Organization Control Reports SOC 1SOC 2SOC 3 1 Internal Control Over Financial Reporting 2 Service Organization Management, Users, Users Auditor 3 Service Organization Management, Users, Knowledgeable Parties SOC 1SOC 2SOC 3 PurposeReport on controls relevant to user entities ICFR 1 Report on controls related to compliance & operations SOC 1SOC 2SOC 3 PurposeReport on controls relevant to user entities ICFR 1 Report on controls related to compliance & operations Use of ReportRestricted 2 Restricted 3 General SOC 1SOC 2SOC 3 PurposeReport on controls relevant to user entities ICFR 1 Report on controls related to compliance & operations Use of ReportRestricted 2 Restricted 3 General Report DetailIncludes Testing Detail No Testing Detail SOC 1SOC 2SOC 3 PurposeReport on controls relevant to user entities ICFR 1 Report on controls related to compliance & operations Use of ReportRestricted 2 Restricted 3 General Report DetailIncludes Testing Detail No Testing Detail AICPA Interpretive Guidance SSAE 16 & AICPA Guide AT 101, Trust Services Principles, & AICPA Guide AT 101 & Trust Services Principles

Risk Management & Cloud Security February 19, R ISK M ANAGEMENT AND C LOUD S ECURITY Rodney A. Walsh, CGEIT, CRISC Director of IT Risk Services Paco Diaz, CISA Senior Consultant II Thank You