1. Corporate Concerns on Cloud Services Environment กษิภัท ธนิตธนาคุณ คอลัมนิสต์ “IT Auditing” นิตยสาร ELEADER กรรมการผู้จัดการ บริษัท เคที ไอที โซลูชั่น จำกัด CISA, ITIL (V.2,V.3), IRCA – ISMS Auditor (ISO/IEC 27001:2013) and ISFS (ISO/IEC 27002:2005) June 29,2016

2. STOP ? GO

3. Essential Characteristics The essential characteristics of  On-demand self-service  Broad network access  Resource pooling  Rapid elasticity  Measured service Cloudcomputing Cloud computing

4. Cloud Service Models Infrastructure as a Service (IaaS) Platforms as a Service (PaaS) Software as a Service (SaaS)

5. Cloud Deployment Models Public cloud Community cloud Private cloud Hybrid cloud

6. Concern Topics Business – COST/ROI (Return on Investment) Technology IT Security (CIA) Confidentiality Integrity Availability Compliance Process People Terminate Service

7. COST/ROI (Return on Investment) COST ROI

8. Data Application Host (OS) Network Physical/Hardware What is the most valuable asset?

9. Technology (IT Security) Unavailability Loss/Theft/Hacker Disclosure RISK

10. Technology (IT Security Concern)

11. S S - Strategy – IT Security Policy – IT Security Procedures User Access Management Backup and Recovery Incident and Problem System Development and Maintenance IT Outsourcing etc.

12. ขออภัย ระบบคอมพิวเตอร์ขัดข้อง

13. Technology (IT Security Concern) M M – Manage Change Requirement Impact Analysis TestLaunch

14. Technology (IT Security Concern) A A – Access Controls  User Access Management (User & Admin)  Security Parameters (e.g., Password setting)  Network Access  Remote Access  Physical Access and Environmental Controls  Log Monitoring  SOD (Segregation of duties)

15. Technology (IT Security Concern) R R – Recovery BCP (Business Continuity Plan) DRP (Disaster Recovery Plan)

16. Technology (IT Security Concern) T T – oThers Backup and Recovery Incident and Problem Management Monitoring

17. Compliance Concern LAWS (e.g., Computer Crime, Privacy etc.) Regulations (e.g., BOT, SET, OIC, PCI/DSS etc.) Standards (e.g., ISO/IEC 27001 etc.)

18. Process Concern Vendor Selection (e.g., Qualification, Site Reference, Number of client, Price etc.) Vendor Management Evaluation Visit or Audit Contract Excellent Good Satisfactory Poor 

19. People Concern Resource Utilization The concern of Employee

20. Terminate Service Concern Data Disposal or Return of Assets

21. Question? info.ktits@gmail.com ktits_itaudit kasipat thai

22. Thank You