Datum 27-11-2011 1 Bedrijfszekerheid in ketens Risk Towards Trustworthy ICT Service Chains Control Assurance Integrated Assurance framework for ICT enabled service chains Drs Y.W. (Ype) van Wijk RE RA Rijksuniversiteit Groningen Business & ICT IT auditing 24 november 2011
Datum 27-11-2011 2 Agenda Towards Trustworthy ICT service chains (TTISC project) Bedrijfszekerheid en trends in ketens Content versus Delivery networks Assurance guidelines The atomic approach for controls in service chains Samenvatting en conclusie
Datum 27-11-2011 3 Towards Trustworthy ICT Service Chains Innovatie samenwerkingsverband ICT services chains Chain Governance, SaaS, SOA, ICT, IT Audit Risk Control - Assurance Bedrijfszekerheid in ketenautomatisering Framework Assurance Leading Indicators Rijksuniversiteit Groningen Bestuurlijke Informatica Drs Y.W. van Wijk RE RA PWC Accountant en IT consulting Nedlloyd operational audit Euronext Amvest BV Cobalus BV Rijksuniversiteit Groningen
Datum 27-11-2011 4 Bedrijfszekerheid in ICT ketens
Bedrijfszekerheid en ICT ketens service Datum 27-11-2011 5 service request service request Consument service Enabler (certificaat) Techniek ICT Netwerk - Architectuur Service leverancier Bedrijfszekerheid 44,4 mlrd Inkomstenbelasting Miljoenennota 2010
Datum 27-11-2011 6 Trends ICT ketens van Applicaties naar ketens van gekoppelde externe service netwerken van applicaties (linkedin, maps) SaaS en Cloud computing als distributeur Toename afhankelijkheid Nieuwe risico s en bedreigingen Applicatie leverancier afhankelijk vertrouwen leveranciers van leveranciers, ad infinitum. Need for assurance (e-government, e-business) Objectieve methode assurance Security, availability, quality of service (QoS) Assurance over totale keten.
Datum 27-11-2011 7 Service chain Assurance approach Business content risk Risk Control Assurance Delivery technical risk Risico in service ketens content networks - business inhoud network controls delivery networks - technische ICT control Generalisatie en conceptualisatie Integrated Assurance Framework for ICT enabled service chains
Datum 27-11-2011 8 Standards, Guidelines, Frameworks, Best Practices, Architecture theory s Standards ISO 27000 series ENISA Guidelines COBIT IT control objectives for cloud computing ITAF (IT Assurance Framework) Val IT Risk IT IEEE Practitioners research TEXO SAP research Project Master Chain governance Scientific research Organization theory Technical ICT research Architecture Audit theory Operations research Accountancy Architectures SOA SaaS Cloud computing Assurance Conceptualization in service chains?
Datum 27-11-2011 9 Assurance Back to Basic.
Datum 27-11-2011 10 Het basis Atoom van de service chain Content network Service Chain service Content Network request A B C Add value service request Risk Control Enactment Enforcement Delivery Network Delivery network Service Chain Risk Control Assurance
Datum 27-11-2011 11 Service chain propagation in content and delivery networks Content Network Service Chain Propagation Backward Content network Front Chain propagation Risk Delivery network Service Chain Propagation Delivery Network Service Chain Propagation Chain propagation Risk
Level business content assurance network Datum 27-11-2011 12 Enactment Organisatie Client Skin Organisatie Organisatie 3. Service Chain Assurance inkoop = service + service.. Enforcement Risk Control Assurance 1. INTRA-organisatie risk-control-assurance 2. INTER-organisatie risk-control-assurance
Level Technical delivery assurance network Datum 27-11-2011 13 Enactment Mobile network Client ISP TNT Enforcement Risk Control Assurance Security Vulnerability, confidentiality, Integrity, Authentication Quality of service (QoS) Bandwidth, Delay, Jitter, Round-trip time Availability Downtime, Mean-time between failure, Self healing properties
Datum 27-11-2011 14 Consequences for Architecture Service chain architecture Split content and delivery for chains Develop content assurance chain Develop delivery assurance chain Take care of proper enactment in the chain Agree on service chain enforcement Integrate on specific assurance indicators Service Based Auditing Institutionalize audit and dissemination assurance
Datum 27-11-2011 15 Conclusions Assurance is a primary condition for services business Assurance in service chains must add predictive value For Architecture it is important to integrate a-priori the leading indicators content and delivery network assurance Integrating assurance indicators in the design phase of service oriented architecture can support content and delivery assurance. Assurance by professional independent party opinion can be fundamental for trustworthy services in chains
Datum 27-11-2011 16 Towards Trustworthy ICT Service Chains Risk Control Dank voor uw aandacht Assurance Drs Y.W. (Ype) van Wijk RE RA Rijksuniversiteit Groningen Business & ICT IT auditing
Practitioners References Datum 27-11-2011 17 Standards ISO 27000 www.iso.org ENISA www.enisa.europa.eu Guidelines COBIT www.isaca.org IT control objectives for cloud computing www.isaca.org ITAF (IT Assurance Framework) www.isaca.org Val IT www.isaca.org Risk IT www.isaca.org Practitioners research TEXO Governance framework (SAP research) Project Master www.project-master.eu