Governing Changes in a Cloud, Cloud, World. EEI-AGA Accounting Leadership Conference. james.r.hanlon@us.pwc.com. New Orleans, Louisiana

Transcription

1 June Governing Changes in a Cloud, Cloud, World EEI-AGA Accounting Leadership Conference New Orleans, Louisiana Jim Hanlon james.r.hanlon@us.pwc.com Partner, Utilities and Power Generation Risk Assurance Eric Tan eric.tan@us.pwc.com Director, Cloud Assurance

2 Table of Contents

3 Cloud overview PwC

4 Different views of the Cloud CEO applications are available, through purchase, rental or even development, wherever and CFO as-you-go model where consumers only pay CIO technology from infrastructure through

5 What is cloud computing? 100 Convenient, on-demand network access to a Shared pool of configurable computing resources that can be Rapidly provisioned 3Delivery Models Software as a Service (SaaS) Platform as a Service (PaaS) Infrastructure as a Service (IaaS) 5Key Characteristics On-demand self-service Broad network access Resource pooling Rapid elasticity Measured use 4Deployment Models Legacy Cloud Private Public Hybrid Community

6 What Cloud is What Cloud Means for Business Optimizing Infrastructure Transforming Business Operations Monetizing Differentiated Experiences Energizing Channels and Communities X- as a Service Business Process as a Service Economy Efficiency Expertise Extended Reach Software as a Service Platform as a Service Being Agile Infrastructure as a Service

7 Connecting channels, communities and content 1 Trillion 1 Million 1 Zettabyte Connected Devices Applications 1B Terabytes of Content PwC 7 April 2012

8 What we are seeing in the market place PwC

9 Size of the market place The picture is clear. This is a fast growing market that is shifting the way companies address business and IT issues. 1 Global Cloud computing market size will grow from current $40.8 billion to $241 billion in 2020 (Source: Forrester) 2 Worldwide spending on Cloud computing to increase to nearly $150 billion by 2014 (Source: Gartner) 3 four out of ten respondents report their organisations use Cloud services 4 customers of IT outsourced services will rely on Cloud computing for more than a third of their IT resource base.

10 84% CEOs expect to change company strategies. (33% expect fundamental change) - more disciplined costs and more targeted markets

11 39% Want to innovate with their partners Source: PwC 14 th Annual Global CEO Survey, 2011 Cloud computing will be a key driver of

12 Cloud Computing Cloud computing to reduce costs and enable new business models

13 industries Automobiles + Cloud Industry Companies Energy/Utilities + Smart metering on-demand software on a per-user basis Financial Services + Assembling customized policies and products Entertainment & Media + Self-service and seamless delivery + Video rendering PG&E, Springsource emeter-verizon Mint.com, ADP. Aegon Religare Netflix, Dreamworks, Nvidia Government + Mashapps, citizen self-service CIA, City of Miami City of San Francisco Healthcare + Physicians back-office + Secure online storage and sharing of patient information Retail & Consumer + Internet arbitrage + Real-time recommendation engine McKesson, Medweb, Athenahealth ebay, Zappos.com, Amazon.com Technology + Partner community ADP, Force.com, Intuit Source: PwC Energy Publishing PwC Insurance 13

14 Concerns around cloud PwC

15 7 Sins of Cloud Computing Information Security Forum Ignorance Cloud already used, but without management knowledge or approval Ambiguity Contracts for Cloud services are made with little concern for security requirements Doubt Insufficient assurance about security arrangements at Cloud providers Legality/Trespass Failure to acknowledge or address legality of information flows and cross-border issues Disorderly security Information placed in the Cloud may not always be classified correctly, stored appropriately or destroyed completely Failure to prepare Failure to move to an enterprise security architecture which supports secure use of Cloud services Complacency Full availability is assumed but a variety of incidents can and do cause Cloud outage in practice Source: Information Security Forum

16 While there are clear benefits there continues to be concerns about security, availability... Feb 2011: 150,000 Gmail users told their s/chats erased June 2012: 6.5 Million Passwords were Stolen PwC 16 April 2012

17 Example Windows Azure Outage a worldwide Windows Azure outage. Customers were left without service for 12 to 23 hours. SV Tech CoE GTM 17

18 Indicator of Cloud Concerns PwC Survey on Cloud Risks 54% of Healthcare organizations that have experienced a privacy/security breach in the last two years. Source: U.S. Department of Health and Human Services Office for Civil Rights, accessed June 27, 2011, 31 Petabytes Private Cloud Source: PwC IT Outsourcing (ITO) and Cloud Computing Survey, 2011; Industry data and Autonomy Protect presentation, April 2012

19 Governance and the Cloud PwC

20 How Will the Confidence Gap be Closed? No globally recognized framework exists and may not for the foreseeable future Approaches to closing the trust gap typically include a series of highly inefficient activities often led by vendor management or procurement functions: Provider self-assessments, typically focus on security policies Responses to customer-prepared questionnaires Third-party SAS 70 (now SSAE 16) reports Other certifications PCI, ISO 27002, HIPAA, FISMA, etc. Current approaches do not completely address the relevant compliance underlying technology architecture

21 A Risk Based Approach to Cloud Governance ALIGNMENT Objectives should be viewed in the context of categories WHAT Considering the subject across the difference layers of framework PwC WHERE considers activities at levels of the organisation 21 April 2012

22 Where Does Cloud Fit Into My ERM Strategy? Risk Appetite and Strategy Key areas where our clients have asked for help Governance & Organization Policies and Procedures Tools and Technologies Monitoring and Reporting Risk Management Processes Governance over Cloud Adoption Cloud Provider Contract (Terms/Conditions) Identity and Access Management Cloud Release and Configuration Management Data Protection and Rights to Audit Portability and Interoperability and Data Integrity Metering and Bursting Revenue Project Risk and Third Party Management CSP PwC 22 April 2012

23 Cloud Assurance a holistic approach Cloud Assurance Assess and manage the technical, operational, financial, legal, regulatory, tax risks and opportunities associated with cloud adoption. Design and review the project framework to transition services to the cloud. Analyse the business case and costs to ensure business benefits are realistic and achievable. Design and review security and controls before, during and after the move the cloud. Design and review business continuity and disaster recovery procedures for cloud services. Provide third party assurance over cloud 23

24 Cases and Internal Audit Application PwC

25 Internal Audit Why Cloud is not just an IT issue Audit Executives have a significant role to play Engage the C-suite and business leaders to understand what data and applications may be moved to the Cloud. Investigate specific risks and controls for near-term Cloud adoption. As IT functions move to the Cloud, new risks will arise. Internal Audit (IA) should reevaluate its annual risk assessment, audit scope, and resources to support the Cloud strategy. A proactive lead on risk management Audit Executives should partner with business leaders to perform as their company executes its Cloud adoption plan. By identifying the controls and key performance indicators needed to manage risks and provider performance, Audit Executives can take an early lead in Cloud strategy planning and maximize the value of Cloud Computing for their organisations.

26 Internal Audit Why Cloud is not just an IT issue New Risks to Consider The Cloud model requires that IA understand the technology and processes underlying Cloud Computing, as well as the complex processes used to assess provider performance. IA should understand its contractual, operational, and regulatory requirements that might be affected. IA should proactively engage technology, security, and regulatory specialists to help assess the impact of Cloud adoption. Success through Governance Develop an assessment strategy that defines the and processes for assessing service level agreements. Monitor the implementation to identify interdependencies or new risks. Document and evaluate metrics to measure progress toward objectives.

27 Role of internal audit continues to evolve as activities with Cloud Computing increases 1. Acquisition of Cloud Service Provider 2. Migration to Cloud Service Provider 3. Private Cloud Development & Virtualization Due diligence Risk Assessment Pre and post integration planning/reviews Regulatory compliance readiness Service Organization Controls reporting readiness Risk assessment for pre & post implementations Data flow and mappings Compliance with existing IT polices and procedures Assessment of service requirements Contract reviews Planning and strategy review Architecture standards setting Audits of configuration settings Access to modify deployment settings PwC 27 April 2012

28 Case Study: Cloud Internal Audit Situation Approach Results What role can internal audit play in an cloud strategy? Client wanted to do a feasibility assessment to identify existing applications that could be hosted in the cloud to bring the business the best return on investment Feasibility of current application stack in the cloud space, risk impact of operations and economic feasibility Risk assessment analysis Identified potential opportunities in the cloud space, supporting existing and future - business needs 5 Developed observation and risk assessment for each cloud solution. PwC 28 April 2012

29 In Summary 1 Leverage existing standards, 2 Review impacted business 3 Assess risk and build a plan. It will 4 PwC Engage in strategy for moving to the cloud and understand change rationale for adoption a cloud and consider existing programs Assess capabilities of existing personnel to manage transition and to perform roles in new state Understanding the topic and change will help right size the effort required. 29 April 2012