Question

Using Cloud Computing Risk Assessment: A Case Study.

Describe and discuss each of the following important elements of the risk management plan case study.

The plan objectives.

The scope of the plan.

The roles and responsibilities of the team members.

Findings and recommendations.

Answer 1

Cloud Computing Risk Assessment -To help organizations understand the risks associated with certain cloud computing service providers, researchers from business, academia, government and the non-profit sector have developed a range of risk assessments. These risk assessments help businesses make informed decisions on cloud computing service providers before they purchase a service.

There are few  principles which are detail:

Executives must have oversight. Leaders must be vigilant in keeping the cloud and information assets safe, especially as the cloud security environment evolves over time.

Management must take responsibility for cloud risks. Namely, IT leadership must understand that the risks taken are their own and must evaluate the risks on an on-going basis.

All requisite staff must know about the cloud. Ignorance of IT is no longer allowed, and all stakeholders must know how the cloud works.

Management must be aware of users. Management should know who has access to cloud data and who can make changes and decisions.

Management must authorize what the cloud is used for. Management needs to be involved in giving approval for the specific purposes cloud technology should be used for.

Sophisticated IT processes must be used. While the cloud may be new, IT best practices live on and should be followed.

Management must invest in security. It’s not enough to want security, but investments must be made to ensure data remains secure.

Management must foster compliance. Certain rules must be followed in order to use the cloud.

Management must continuously assess risk. Risk changes over time based on technology or business needs. Management must consistently reevaluate risk.

Everyone must follow best practices. Cloud computing features its own set of industry best practices, and they should be followed.

The Company is a start-up that offers business software branded as Business Exp. Company A offers Business Exp as a Software as a Service (SaaS) solution.

• The ability to offer the software solution on a variety of hardware platforms such as Windows, UNIX and Linux
• Rapid scalability
• Pay-as-you-go capabilities
• Resource availability Due to the numerous benefits of IaaS, Company A leapt into a cloud computing arrangement. The cloud’s economies of scale and flexibility are both a friend and a foe from a security point of view.⁴ The chief information officer (CIO) of the company engaged an information systems (IS) auditor to conduct a review and assess the risks of offering a SaaS solution and adopting IaaS cloud computing for this arrangement. The following paragraphs describe the steps followed by the IS auditor to conduct the exercise. This exercise will help the CIO in determining what Company A needs to protect, prioritizing the risks and determining a response.

Risk IT provides a list of 36 generic high-level risk scenarios, which can be adapted for each organization. Starting with the set of generic risk scenarios helps ensure that the IS auditor does not overlook risks and attains a more comprehensive view of IT risk.

The auditor created a heat map of risks -Implement controls,Transfer risk(s),Avoid risk(s),Accept risk(s).

Conclusion-Businesses are realizing the power of cloud computing, and its use is increasing. This case study represents a one-time attempt at risk assessment of the cloud computing arrangement. The risk assessment helped uncover some of the key risks, prioritize those risks and formulate a plan of action. Given the evolving nature of risks in cloud computing, no longer can one-time risk assessments suffice. As newer risks emerge, risk assessments need to evolve and the mitigation approach needs to innovate. A risk assessment needs to occur before an enterprise enters into a cloud computing arrangement—to help avoid surprises and minimize the costs of implementing and maintaining controls.