How To Decide If You Should Move To The Cloud

Transcription

1 Can security conscious businesses really adopt the Cloud safely? January Phone: Fax: info@

2 Contents Executive overview The varied Cloud security landscape How risk assessment aligned to objectives can benefit the business Key areas to consider from a risk perspective Conclusion About The Bunker Phone: Fax: info@

3 Executive overview Cloud computing is heralded as the latest and greatest opportunity in IT service delivery, facilitating on-demand access to shared pools of computing resources from networks and storage to servers and applications. On top of efficiencies and cost reductions, it promises rapid delivery of services for business agility. The key to a successful and secure migration to the Cloud is to adopt a risk-based approach. Traditionally, reduced costs has been the key driver to adopting Cloud and many companies have already moved some or all of their data to the Cloud, enjoying the financial rewards, flexibility, scalability, competitive advantage and agility offered by a Cloud service. However, as sophisticated cyber threats increase and the adoption of BYOD grows, business dynamics are changing and so the decision criteria regarding a move to the Cloud needs to adjust to reflect these changes - now! The frequently publicised hacking attacks only reinforce the need for organisations to take Cloud security seriously, no matter what industry they are in, or how sensitive they perceive their data to be. It s no longer as simple as deciding what data to move and when. Executives must also weigh up the relative benefits and costs of moving to the Cloud against specific risks such as data location, security threats, availability, confidentiality, integrity and application risks. Security over cost Today, more and more companies contemplating the Cloud are shifting their focus from the cost savings offered by a Cloud service to be more conscious about security, taking time to thoroughly assess and understand the security challenges, risks and subsequent business impact created by Cloud computing. This white paper highlights why a security conscious approach is rapidly becoming more and more important. It gives perspective on how to assess the risks associated with Cloud and what processes to use in order to mitigate concerns when adopting and operating in a Cloud computing environment. It will also show that security conscious businesses can really adopt the Cloud safely, but only with a security conscious Cloud service provider and working with experts that have an in depth understanding and appreciation of all aspects of digital security. 3 Phone: Fax: info@

4 The varied Cloud security landscape In general, Cloud solutions can be deployed through one of four standard Cloud service models: private; public; community and hybrid. Standard Cloud Models: Private Cloud: Infrastructure is managed and operated solely for an organisation, either on premises or externally (including dedicated or shared infrastructure) Public Cloud: Infrastructure is owned by a Cloud provider and accessible to the general public or a large industry group Community Cloud: Infrastructure is shared by several like-minded organisations Hybrid Cloud: Infrastructure is owned by both Cloud providers and organisations and is a combination of private, public and community Cloud services, from different service providers The table below illustrates the Cloud computing deployment models: These deployment models are delivered via three different service models: IaaS: Infrastructure as a Service SaaS: Software as a Service PaaS: Platform as a Service With IaaS being the foundation of all Cloud services. 4 Phone: Fax: info@

5 Traditionally, costs and many other compelling commercial benefits are key drivers to moving the Cloud. So, with these known benefits, why aren t companies just shifting everything to Cloud? Because of risk. The commercial benefits of Cloud computing: Cost effective Flexible Scalable Consume as a utility pay only for what you use Safer Faster Improved business agility Increased competitiveness We are all aware that many companies adopt the Cloud because it s cheaper. But will there still be costs savings after a security breach? We only need to look at the high profile hacking attacks on well-known brands that appear in the world press daily, such as the recent Adobe hack that affected 38 million customers. Take a moment to consider the number of data records lost, identities stolen, software code copied as well as the financial and reputational damage, you only then begin to understand the scale of this impact. Subsequently, security is steadily climbing to the number one spot over cost for companies considering the Cloud and despite IT budgets tightening, this is an area where many executives are increasingly willing to invest. Yet with so many different Cloud deployment options can there be a single list of security measures that covers all circumstances? Probably not. The key to a successful and secure migration to the Cloud is to adopt a risk-based approach aligned to business objectives: evaluating all the risks and costs of all the different Cloud deployment options to make informed security decisions and embrace all the benefits of Cloud computing. 5 Phone: Fax: info@

6 How risk assessment aligned to objectives can benefit the business For the security conscious organisation considering the Cloud, cost efficiencies are not top of the agenda. Concerns around control, data privacy and compliance are paramount. Effectively, security remains the largest inhibitor to Cloud adoption it s still consistently the number one cited challenge to Cloud computing. The varied appetite for risk Different industries and organisations will have varying propensities to put some or all of their data, applications or services in the Cloud, depending on the business type, business objectives and the IT services delivered both internally and externally. Some industries are more security conscious, some are more data sensitive and naturally risk appetites will differ from business to business. In fact, many CFOs and CIOs have indicated varying levels of concerns to having their information in the Cloud, or off-premises, rather than on-premises. Regulatory and industry considerations, such as those found in healthcare and financial services, become prevalent in the data location decision-making. One size does not fit all An organisation needs a more robust CRM tool. The current on-premises system is over 10 years old and most time is spent just keeping it running. The current IT staff do not have sufficient time to add new features and the current hardware environment has no additional capacity. This is when Cloud computing can support the business objective of improving the CRM environment. Rather than purchasing new hardware, writing new code and perhaps hiring additional IT staff, the organisation can use a Cloud-based CRM environment. There is no extra cost for hardware or staff; the service is simply purchased. However, there are several issues to consider: A Cloud solution can provide new capabilities and agility for the organisation at a lower price point than could be accomplished internally, but the TCO should include consideration for risk monitoring and compliance costs. Increases in capacity and flexibility usually come at a cost requiring new trade-offs between cost/flexibility/ capacity and relative risk. If there is too much risk (e.g. potential for exposure of confidential data), the organisation will not want to adopt the technology. Alternatively, if the benefits exceed the potential risks, the organisation will want to use the new technology. Two virtually identical firms, when faced with the same choice, may choose different outcomes because one firm has a more conservative risk profile while the other has a more aggressive risk profile. Both firms have made valid decisions based upon their respective risk tolerances. 6 Phone: Fax: info@

7 For other considerations, such as the fear of unauthorised access, including sensitive client data, credit card details or legal documents, superior levels of security, whilst managing access and retaining control, become top issues, prior to deciding what data, if any, to move to the Cloud. Before considering a move to the Cloud, businesses need to evaluate whether adopting the Cloud is right for them and not just do it because everyone else is. The key is to analyse and assess the risk against your capabilities, business objectives, technologies - and even emotions - for all the different Cloud deployment options, so you can make informed security decisions that fit your business requirements and go on to embrace all the benefits of Cloud computing. Risk assessment methodology The following is a simple framework to help evaluate initial Cloud risks and make informed security decisions. 1. Identify the asset to move to the Cloud Be it data, processes or applications. 2. Identify the asset value Determine how important the data or function is to the organisation, its impact on operations costs and sales, as well as its replacement cost. 3. Evaluate the assets CIA vulnerabilities Assess the Confidentiality, Integrity and Availability requirements for the asset; and how the risk changes if all or part of the asset is handled in the Cloud. Questions to ask to assess CIA vulnerabilities: 1. How would we be harmed if the asset became widely public and widely distributed? 2. How would we be harmed if an employee of our Cloud provider accessed the asset? 3. How would we be harmed if the process or function were manipulated by an outsider? 4. How would we be harmed if the process or function failed to provide expected results? 5. How would we be harmed if the information/data were unexpectedly changed? 6. How would we be harmed if the asset were unavailable for a period of time? 4. Map the asset to potential Cloud deployment models Identify the deployment models you are comfortable with. Determine if you can accept the risks implicit to the various deployment models: private, public, community, or hybrid; and hosting scenarios: internal, external, or combined. 7 Phone: Fax: info@

8 5. Evaluate potential Cloud service models and providers Focus on the degree of control you require, the actual location of data, compliance, the ability to handle regulated data and investigate who will be your neighbours. 6. Map out the potential data flow For each potential deployment model, map out the data flow between your organisation, the Cloud service, and any customers or nodes. You should now understand the importance of what you are considering moving to the Cloud, your risk tolerance (at least at a high level), and which combinations of deployment and service models are acceptable. You should also have a good idea of potential exposure points for sensitive information and operations. This framework can be applied across all layers, including infrastructure, data, network and applications to identify all the risks and their impacts. You will then be able to mitigate, accept, transfer or reduce these risks. This approach can cost-effectively deliver the multi-layer digital security that every security conscious business requires from a Cloud computing service. Remember, not all Cloud deployments need every possible security and risk control. But spending a little time up front evaluating your business objectives, risk tolerance and potential exposures will provide the context you need to choose the best options for your organisation. 8 Phone: Fax: info@

9 Key areas to consider from a risk perspective There are varying levels of vendor capabilities that make for varying levels of security. When evaluating Cloud service providers, security conscious companies should look for the ability to meet security mandates such as PCI DSS Compliance and ISO 27001, as well as integration capabilities. They should also ensure vendors adopt industry-standard frameworks, meet organisational security standards and allow independent audits. An interesting question to consider when assessing a potential Cloud service provider is whether they value security as much as you do? A security conscious business should only adopt the Cloud safely with a security conscious Cloud service provider. The Cloud Computing Service Provider Capability map illustrates all the Cloud computing capabilities that can help CIOs and CFOs select the right service provider which meets their business requirements: Deloitte Development LLC Cloud Computing Service Provider Cloudprint Capability Map 9 Phone: Fax: info@

10 Much like entering any service provider contract, companies should also consider the Cloud service provider s incentives and governance in place. Three important contract areas for companies to consider when evaluating Cloud service providers are: 1. Evaluation Period: Does the Cloud service provider offer an evaluation period to try out and test the service? What evidence can the Cloud service vendor provide to validate services? 2. Monitoring Usage/Dynamic Provisioning: What mechanisms does the Cloud purchaser have to govern usage and potentially change the number of billable users or seats based on usage? How will expense management work and who will be accountable for the use of technology resources? 3. Contingencies: In a potential system failure, what back-up plans exist and who manages the back-up plans? If the Cloud service vendor ceases operations, what will be the process for accessing information hosted by the Cloud service provider? A relationship based on trust The most precarious aspect of Cloud computing for most companies is that information and infrastructure components are no longer under the direct control of their IT department. Businesses need an appropriate level of control and visibility to ensure that sensitive data is being properly managed, that the right access is being granted to the right people, and that organisational and industry security standards are being upheld - just as they have in their internal environments, but with the dynamic control and change management necessary for a Cloud environment. This combination of control and visibility equals integrity and trust and a safe, secure and successful Cloud service. These security conscious businesses will also look to work within a community of likeminded businesses who all value security (not just the Cloud service provider) to ensure the highest levels of security standards are met. So it s important to know who your neighbours are! 10 Phone: Fax: info@

11 4 areas security conscious organisations should consider to be Ultra Secure in the Cloud 11 Phone: Fax:

12 Conclusion In today s evolving information economy, Cloud computing offers immense opportunity. With cyber threats on the increase, and the major impact they can have on a business, many companies are moving their attention from the compelling scale and cost efficiencies of Cloud to place much more focus on security measures. No matter what industry, be it heavily regulated or have highly sensitive data, more and more companies are becoming security conscious. The key to a successful and secure migration to the Cloud is to adopt a risk-based approach. For the security conscious business, security continues to be the key inhibitor to Cloud adoption. This paper has demonstrated that undertaking a risk assessment aligned to business objectives is the key driver to successfully adopting the Cloud. By following a step by step methodology to identify the risks and associated costs of all the different Cloud deployment options, you will be able to make informed security decisions and harness the power of Cloud computing. This approach applied across every layer, including infrastructure, data, network and applications, can cost-effectively deliver the multi-layered digital security requirements that every security conscious business expects from a Cloud computing service. The trusted Cloud becomes a reality By embracing the right risk and security strategy that fits each individual business, organisations can overcome the number one perceived Cloud computing challenge - security - and enjoy all the benefits of Cloud computing, including business agility and increased competitiveness. In effect, we are already seeing more and more investments in private Cloud deployments using an IaaS service model that enables more control and visibility for security conscious buyers. So, can security conscious businesses really adopt the Cloud safely? Yes, but only with a security conscious Cloud service provider and working with experts that have an in depth understanding and appreciation of all aspects of digital security. Finally, with Cloud technology capabilities, security measures and controls rapidly strengthening, there is a risk of not moving to Cloud from a competitive perspective and from an employee support perspective. Technology enables the movement of data, decision-making, and is the foundation of information and operations; not having what may be the most effective technology for getting the job done could leave some organisations behind. This is not a security risk. It s a business risk - the risk of missed opportunity in not adopting Cloud technology. Don t miss that opportunity because of misperception. The trusted Cloud is here. It s time to take that opportunity. 12 Phone: Fax: info@

13 About The Bunker Here at The Bunker we understand: That your data is precious That data security is of the utmost importance The impact any kind of security breach could have on your reputation, your brand, your customers and your business. We also understand the importance of multi-layered physical security and a resilient site. We understand the laws and we only hold data in the UK. We know that a good security strategy requires ongoing risk assessment and testing and our team are experts in delivering innovate security solutions to keep the threats at bay. We also offer a layered digital security service, a defense-in-depth solution designed to minimize risk by adopting a multi-layered security solution across networks, host, applications and data to fully protect critical IT data and resources. And we work only with like-minded businesses who put security at the top of the agenda - just as we do. We believe that information security should enable businesses to be more competitive, manage risk, protect brand and allow innovation in a controlled manner. It s our philosophy. So, if you are looking to start your journey into a secure Cloud, talk to one of our technical security experts today. The Bunker: Taking security seriously. Information Security should enable businesses to be more competitive, manage risk, protect brand and allow innovation in a controlled manner. For more information about The Bunker: Call us today to discuss how we can help your business adopt the Cloud securely: Visit 13 Phone: Fax: info@ The Bunker Ash Radar Station Marshborough Road Sandwich Kent CT13 0PL

14 The Bunker Protocol is an all-encompassing methodology that secures against risk and ensures the most secure IT delivery in the UK. The Bunker Protocol incorporates Physical, Human and Digital security capability and processes and wraps them with a governance and standards layer that ensures that client data and client systems are continually secure against threats to confidentiality, integrity and availability. This is Ultra Secure Physical - Military Grade data centres Human - All employees are fully background checked and our culture starts and ends with security Digital - We build and integrate systems in-house, Ultra Secure from the source code up. 14 Phone: Fax: info@