Cloud Computing Jenn CruverKibi, CPA July 27, 2016

Transcription

1 Pursuing the Profession While Promoting the Public Good Cloud Computing Jenn CruverKibi, CPA July 27, Annual Non-Profit Seminar What we will cover 1

2 What we will cover: What is cloud computing? Risks associated with cloud computing Items to consider when moving to the cloud 3 What is cloud computing? 2

3 Simple Definitions Simple definitions: Per google the practice of using a network of remote servers hosted on the Internet to store, manage, and process data, rather than a local server or a personal computer. Per Wikipedia is a kind of Internet-based computing that provides shared processing resources and data to computers and other devices on demand. It is a model for enabling ubiquitous, on-demand access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications and services) 5 National Institute of Standards and Technology Definition Five essential characteristics : On-demand self-service Broad network access Resource pooling Rapid elasticity Measured service 6 3

4 Brief History What does cloud mean? Depictions from early network schematics Early metaphor for the internet 1990 s: telecommunications companies used the cloud symbol to denote demarcation point 2000 s: 2006 Amazon s Elastic Compute Cloud 2008 NASA s OpenNebula 7 Types of Clouds Public External/3 rd party Private Internal Hybrid Mixture of private and public cloud features 8 4

5 Service Types Infrastructure-as-a-Service (IaaS) Platform-as-a-Service (Paas) Software-as-a-Service (SaaS) Desktop-as-a-Service (Daas) Business Process-as-a-Service (BPaaS) 9 Infrastructure-as-a-Service (IaaS) Provides virtualized computing resources over the internet 3 rd party hosts infrastructure: Data center Processor Memory Storage Cloud user has control over operating system and deployed applications Examples: Amazon Web Services, Windows Azure 10 5

6 Platform-as-a-Service (PaaS) Full or partial operating system that delivers applications over the internet Platform provided: Operating system Web servers Database servers Operational services Cloud user has control over deployed applications Examples: Amazon Elastic Beanstalk and Google App Engine 11 Software-as-a-Service (SaaS) Software applications delivered via internet Provider manages the infrastructure and platform that run the applications Cloud users do not manage the cloud infrastructure and platform where the application runs Examples: Oracle, SAP, Intuit, Microsoft 12 6

7 Desktop-as-a-Service (Daas) and Business Process-as-a-Service (BPaaS) DaaS: Provides desktop virtualization Online access to individual workstation (including operating system and storage hardware) Example: GoToMyPC BPaaS Provides specific business processes to multiple internal or external customers Examples: Wipro or Telegenisys 13 Benefits of Moving to The Cloud Cost Paying experts to guard information Paying experts to maintain the network Flexibility and Adaptability Pay for only what you need, when you need it Ability to do work anywhere, anytime Manageability Get applications up and running faster IT adjusts to meet needs and demands of business Centralization of information 14 7

8 Risks Associated with Cloud Computing The Treacherous 12 Cloud Computing Top Threats in 2016 Issued by Cloud Security Alliance, February 2016 Data breaches Compromised credentials and broken authentication Hacked interfaces and APIs Exploited system vulnerabilities Account hijacking 16 8

9 The Treacherous 12 Cloud Computing Top Threats in 2016 Cont d Malicious insiders Advanced persistent threats Permanent data loss Insufficient due diligence Cloud service abuses Denial of service (DoS) attacks Shared technology vulnerabilities 17 Audit Risk Areas Data security and controls Regulatory Co-mingling and access to data Data location Reliability Sustainability 18 9

10 Audit Risk Area: Data Security and Controls Risks: Inadequate provider security controls Vulnerability assessments or penetration tests not performed Physical location not properly secured Cloud data not updated or patched when necessary Audit Procedures: Determine provider securities and controls: SSAE 16 report are control concerns addressed? Review contract inclusion of right to audit clause? Security assessment performed? Is cloud provider s security posture based on security standard? 19 Audit Risk Area: Regulatory Risks: Compliance with: Industry/legal standards? Privacy laws? Is data stored outside of U.S.? Audit Procedures: Assess vendor s compliance approach via SSAE 16 Review contract regarding regulatory adherence If data stored in multiple locations, inquire how regulatory compliance is maintained 20 10

11 Audit Risk Area: Co-mingling and Access to Data Risks: Data not properly segregated, allowing inappropriate access Inadequate software deployed by provider to ensure segregation Audit Procedures: Inquire as to provider s method to secure data Review SSAE 16 report or exercise right-to-audit clause 21 Audit Risk Area: Data Location Risks: Physical and virtual data location is unknown Provider moves data to another location without telling organization If organization switches providers, data is not transferred Audit Procedures: Inquire provider of specific physical and virtual data location Review contract for termination of services/transferring of data 22 11

12 Audit Risk Area: Reliability Risks: Consistent, quality services are not available Potential failures or down time Vendor viability Audit Procedures: Determine how vendor assesses changes in demand and long-term growth Compare contract to actual performance Assess vendor viability (review financials) 23 Audit Risk Area: Sustainability Risks: Provider has inadequate disaster recovery Provider has inadequate business continuity plan Audit Procedures: Review disaster recovery plan of organization; assess if adequate to protect and recover data Review business continuity plan; assess how organization addresses downtime and interruptions in event of disaster 24 12

13 Items to Consider When Moving to the Cloud Questions You Should Ask the Provider Where will our data be located? What are potential issues with installation or data migration? Do you own the equipment for cloud services or do you resell cloud services? Who owns the data? Is hardware shared between clients? What are data center specifications? 26 13

14 Questions You Should Ask the Provider Cont d Does provider have insurance protection against case of outage or data loss? How much internet bandwidth is needed? Will data automatically backup via multiple data centers? What is average recovery time if hosting systems are destroyed? 27 Questions You Should Ask the Provider Cont d Are there documented data security policies? What is the average downtime for subscribed services? How would vendor handle data breach? Is the helpdesk outsourced? What is vendor s reputation? What are the pricing and contract terms? 28 14

15 Consider Adding Language in Provider s Service Agreement Clause clearly stating data ownership Confidentiality clause Clear identification of primary and data backup locations Insurance clause Guarantees of uptime Change in business clause 29 Final Thoughts Get IT professionals involved Want to ensure data is secured and protected Can t outsource the organization s responsibility or problems Management is ultimately responsible for organization s policies and procedures Starting to see a shift in cloud vendors using a shared responsibility model 30 15

16 Sources AICPA Not-For-Profit Industry Conference, What CFOs Need to Know About Cloud Computing, Mark Oster (June 2016) Journal of Accountancy, What to Know Before You Commit to the Cloud, Lea Hart (July 2016) Cloud Security Alliance, The Treacherous 12 Cloud Computing Top Threats in 2016 (February 2016) Accounting Today News, 12 Questions You Should Ask Your Cloud Provider, Daniel Hood (June 2016) Wikipedia, Cloud Computing 31 Questions? Contact Me! Jennifer CruverKibi, CPA Senior Manager (717) North Front Street, Suite 101 Harrisburg, PA