1. #watitis2015 watitis.uwaterloo.ca @watitisconf CAN I DO THAT IN THE CLOUD? Jason Testart

2. #watitis2015 CAN YOU DO THAT IN THE CLOUD?

3. #watitis2015 Yes.

4. #watitis2015 This is really about RISK

5. #watitis2015 WHAT IS RISK? “Risk” means the chance of occurrence of an event or trend that will have a negative impact on operations or fulfillment of objectives at the institutional, academic unit and/or academic support unit levels.

6. #watitis2015 RISK (VERB) ACCORDING TO GOOGLE expose (someone or something valued) to danger, harm, or loss.

7. #watitis2015 RISKS TO INFORMATION Confidentiality Unintentional disclosure Integrity Unintentional modification Availability Unintentional loss of access Let’s not forget Compliance Don’t forget it’s about HARM.

8. #watitis2015 RISK FACTORS RISK LIKELIHOODIMPACT

9. #watitis2015 RISK FACTORS RISK LIKELIHOOD Threat Vulnerability Exposure IMPACT Scope Value Cost of Recovery Technical Factors Business Factors

10. #watitis2015 IMPACT FACTORS (WHAT’S THE DEGREE OF HARM?) Scope Number of records Numbers of areas of the University Value E-mail addresses? Grades? Health information? Cost of Recovery People time? Restore from backups? Costs from outage?

11. #watitis2015 LIKELIHOOD FACTORS (TECHNICAL CONSIDERATIONS) Threats Vulnerabilities (Exposures) Let’s consider some contexts…

12. #watitis2015 LIKELIHOOD FACTORS (PAPER RECORDS) Threats Mostly physical Mother Nature Vulnerabilities Flammable Process issues Exposures Handling issues

13. #watitis2015 LIKELIHOOD FACTORS (DESKTOP COMPUTER) Threats Bad “actors” Time Mother Nature Vulnerabilities Low quality hardware Software Exposures On-line Low physical security measures, generally

14. #watitis2015 WHO ARE BAD “ACTORS”? Hactivists Anonymous Cybercriminals West African fraudsters Eastern European organized crime Foreign States

15. #watitis2015 LIKELIHOOD FACTORS (ENTERPRISE DATA) Threats Bad “actors” Human error (many hands) Inappropriate use (vs intent of collection) Mother Nature Vulnerabilities Change management process (lack of?) Software Hardware Exposures On-line

16. #watitis2015 HOW DOES CLOUD CHANGE THINGS? Threats Generally the same People who aren’t on your payroll Vulnerabilities UNKNOWN Exposures UNKNOWN

17. #watitis2015 KNOWN UNKNOWNS, AND UNKNOWN UNKNOWNS!

18. #watitis2015 FIRST, WHAT IS “THE CLOUD”? Service offerings IaaS PaaS SaaS SaaS is what we see most often Many SaaS offerings depend on IaaS or PaaS offerings

19. #watitis2015 FOCUS ON THE DATA, NOT THE TECHNOLOGY Lifecycle Collection Use (including integration) Destruction Quality Authoritative Data? Don’t forget about C – I – A

20. #watitis2015 HOW DO WE MANAGE CLOUD RISK? Due diligence before contract is signed. Consider R = L x I Think about C – I – A Impact considerations How important is the data/service to you, your clients, and the institution? Likelihood considerations Ask questions What questions to ask?

21. #watitis2015 YOU ARE NOT ALONE PSIA is a first attempt as a tool to manage risk Privacy Officer helps with privacy elements (mostly impact factors) Information Security Services helps with security elements (mostly likelihood factors) Even with lack of PSIA, can still do due diligence

22. #watitis2015

23. EXPERIENCES SO FAR You can have data in the USA Size and maturity of provider Contractual relationships SaaS stacked on IaaS PCI DSS and E-Commerce NDAs for information SAML support: A good move!

24. #watitis2015 METHODOLOGY Calculate Impact Calculate Likelihood Determine Risk! Simple Methodology Binary Risk AnalysisBinary Risk Analysis (see example) OWASP Risk Rating Methodology

25. #watitis2015 EXAMPLE RISK TABLE

26. #watitis2015 EVOLVING OUR RISK MANAGEMENT APPROACH Other risks Information management risks Appropriate use? Can we get our data if we terminate agreement? Change management? BCP/DR? Policy 8 shortcomings Classifications are for Confidentiality What about Integrity? Availability? Need a link to risk management Need a formal definition of who makes risk management decisions (consistent with Policy 11)

27. #watitis2015 watitis.uwaterloo.ca @watitisconf THANK YOU!