4.1 Security policy

The information security policy describes how information security has to be developed in an organization, for which purpose and with which resources and structures. A security policy describes information security objectives and strategies of an organization. The basic purpose of a security policy is to protect people and information, set the rules for expected behaviors by users, define, and authorize the consequences of violation (Canavan, 2006). There are many standards available to keep the information secure and establish security policy. ISO/IEC 27001 (ISO/IEC27001:2005, 2005), ISO/IEC 27002 (ISO/IEC27002:2005, 2005), ISO 13335 (ISO/IEC13335–1:2004, 2004), ISO 17799 (ISO/IEC17799:2005, 2005) are the best-known standards for providing requirements for an Information Security Management System (ISMS). A security policy for the law office is developed according to the BSI standard 100-1 (BSI-Standard100-1, 2008). The information security policy contains statements on the following issues:

• Information security objectives of the institution (e.g., a public agency or private company),

• relationship between the information security objectives and the business objectives or functions of the institution,

• aspired level of information security,

• guiding statements on how the aspired level of information security should be achieved,

• guiding statements whether and by what means the level of information security should be verified,

• the policy is approved by the management and made public in the company.

4.2 Policy development

BSI-Standards 100-1, 100-2 (BSI-Standard100-2, 2008) and SANS institute (Institute, 2008; Canavan, 2006) describe the details of creation of a policy for information security. It is important that as many departments as possible should be involved in the development of a security policy. The security policy must be designed in such a way that all organizational units can be represented with its contents. The general composition of the policy development team varies according to the policy being developed and it is the task of an organization to decide which departments and hierarchical levels will be participated in the policy development. BSI standard 100-1 suggested a life cycle of a policy for information security. This model is known as PDCA cycle as it is based on four phases, i.e., (P)lan, (D)o, (C)heck, (A)ct. The life cycle starts with the Planning and Conception (P) phase to develop a strategy for handling risks in an organization, Implementation (D) phase to implement the plan for the security concept and safeguards, Performance (C) review and monitoring phase to monitor the performance of safeguards and security operations during operation, Optimization and Improvement (A) phase to correct any defects and improve the safeguards.

4.3 Security and Privacy

The loss of confidentiality, integrity, or availability of data of law office can have a negative impact on the business of the company. The company has an access to court application and database of sensitive information of its customers. Similarly, any breach in the information privacy is also an important concern. Privacy refers to an individual’s ability to control how his or her information is collected, used, and disclosed. CSPs must protect consumer’s assets from internal and external threats, maintain the privacy of the data, remain available and reliable, and perform consistently. A system must ensure that subjects cannot manipulate the protected data unnoticed or in an unauthorized way. CSPs store data on a virtual hard drive, which must be protected against unauthorized manipulation. A minute must be reliably assigned to the sender, and it can be proved that this information has not been changed since it was created or distributed. The Cloud Security Alliance has developed a useful model of information life cycle management, with phases of Create, Store, Use, Share, Archive, and Destroy, data (see Figure 2). The life cycle is shown in a linear progression but once the data is created, it can bounce between phases, and may not pass through all stages (Simmonds et al., 2011). There are many scenarios where security and privacy requirements play an active role in the context of moving a technology to the cloud.

4.4 Detecting and preventing sensitive data migration to the cloud

Many organizations face the problem with the management of sensitive data. They reported the migration of sensitive data to the cloud services by an individual or business unit without the approval or even notification. Data needs to be pulled out from its existing repository before moving to the cloud. The law office must adopt database activity monitoring to detect any extraction of data or replication from a database.

4.5 Protecting data moving to the cloud

It is important to protect data in transit. Data can be moved from a traditional infrastructure to a CSP; data can be moved between CSPs and between instances or components within a given cloud. Data that a customer wants to upload into a cloud must be protected in transit; similarly, data that a customer wants to download from a cloud must be protected in transit.

4.6 Protecting data in the cloud

Data should be accessed only by entities that have been authorized by the concerned customer for specific access rights. CSP must enforce a mechanism to protect against access attempts by unauthorized entities or access in unauthorized modes while preserving the availability for authorized customers.

4.7 IT-Knowledge

The decision to move IT-Processes to a CSP implies by the stakeholders often to save costs for expensive, often less productive IT-Staff. However, it will be mostly forgotten that qualified IT-Knowledge is also necessary for planning and maintenance of a running business processes supported by the (outsourced) IT-Services. The law office needs to stress on the point that migration of computing and communication services into the cloud give the IT-Staff the opportunity to do strategic work in the direction of tactical and strategic business support. In most companies, IT is a strategic factor and mostly, maintenance effort and user support prevents IT-Staff from strategic development for improving the real business of the company (IT as an enabling factor).

4.8 Control and visibility

This requirement relates to the fact that cloud consumers have very limited visibility into the provider’s policy, incident alert, audit information, and security measures. CSPs are reluctant to share this information to avoid any attack on their policies and avoiding disclosing internals. It is important for the law office to monitor their workloads, keep track of any security related incident, compliance, or privacy breach, and general the status of the systems. A workload is an encapsulation of one or more of the following: application processes, data, configuration information, and state. CSP can provide distinct and effective services but consumer must not be locked-in to the provider. Cloud consumers must be able to monitor the cloud operations so that they can replicate these operations elsewhere.

Consumers have very limited control over the security policies enforced by the CSPs. A proper set of control over the information is necessary while moving IT components to the cloud. It raises an important question on the maintenance of the control by the cloud consumers over their workloads even though they may not know the protection mechanisms and the locations of workload. It is essential for the cloud customer to define in their security policy the requirements for controlling the correct application of the policy rules by the CSP.

4.9 Costs

Customers must assess payment and pricing models regarding the decision to migrate to cloud environment and a particular CSP. The decision to migrate to cloud must be considered only when it would be cost effective. The payment opportunities include the possible payment method (e.g., credit card or bank transfer), the time of payment (prepaid or postpaid) and which level of granularity is priced (e.g., storage capacity of 1 MB, 100 MB, or 1 GB steps, CPU utilization, or network transfer volume/throughput) (Repschläger et al., 2012). Service charging defines how the service is charged (volume based, time-based, account based) and the available booking concept, e.g., pay per use, a subscription fee, market-based prices (spot pricing). Figure 3 shows the cost using the cloud cost estimator of DimensionData (DimensionData, n.d.). Customers need to pay only what they use. DimensionData allows consumers to customize CPU (up to 16) and RAM (up to 128 GB) for each server on the fly.

4.10 Interoperability and portability

This requirement ensures the ability to move data or services from one CSP to another, or rollback to traditional computing. It also defines the ease of ability to which application components are moved and reused regardless of provider, platform, OS, infrastructure, location, storage, the format of data, e.g., how proprietary virtual images (AMI) of Amazon are transferable to a Microsoft Azure platform (Repschläger et al., 2012). A lack of interoperability and portability can lead to being locked-in to a particular CSP. There must be adequate flexibility in the contract and renewal of contract between the law office and the CSP. The cloud computing community has not yet defined a universal set of standards, resulting in a significant risk of vendor lock-in. When a customer migrates workload from one CSP to another, it requires extracting the data from the existing cloud environment and uploading data into another cloud environment. The requirement of interoperability is necessary to ensure that any program that performing CRUD operations (create, retrieve, update, delete) on the migrated data in the original CSP continues to work with the new CSP.

4.11 Performance

Performance includes more extensive concepts such as reliability, energy efficiency, and scalability. The time required retrieving the data in cloud when it faces any error or failure will be effective on the cloud performance. CSP and cloud customer must agree on a proper network bandwidth to initiate the cloud service. The performance can be degraded if the bandwidth is too low to provide service to the customer. Organizations usually discover issues with the communication bandwidth shortly after adopting cloud services (InformationWeek, 2008). Customer must assess the communication bandwidth requirements and evaluate the performance of the applications/services before migrating to cloud (Kim et al., 2009). Customers must also discuss the possible location of data centers and their distances from their location, as it is an important factor to affect the performance. Users who are at a long distance from CSPs may experience high latency and delays (Ravanmehr and Khanghahi, 2013; Borko Furht, 2010).

The concern of vendor lock-in is often described as the “Hotel-California” syndrome. You can check-in but you can never leave.

a. What is vendor lock-in?
In the given scenario in this chapter, the law office adopts cloud computing in order to outsource its workload to a CSP. The CSP provides services in terms of processing and/or storing the data, providing platform or infrastructure to develop application, maintain database, etc. CSP configures and optimizes the given application according to own standards, protocols, and policy. This creates a risk of vendor lock-in and makes customer dependent on the current vendor. Lock-in occurs when a cloud consumer cannot move, or it costs a significant amount of money or time to do it. Cloud consumer may want to move to another CSP or to move to its own infrastructure.
Robert Jenkins, CTO of Cloud Sigma, says in an article published on GigaOm,¹ “It’s not just privacy and security. It’s also—if I change my mind or it doesn’t work out, how do I move on?” There may be many reasons for the cloud consumer to change the CSP or rollback to the On-premise technology. For instance:

- an unacceptable increase in cost at contract renewal time,

- the ability to get the same service at a cheaper price,

- the CSP shuts down one or more services being used without acceptable migration plans,

- a dispute between cloud customer and CSP,

- a CSP ceases business operations.

The absence of cloud computing standards has also led to vendor lock-in, where each cloud vendor offers a proprietary cloud. When a cloud consumer writes its application using a specific API of the CSP, it will be extremely difficult for him to move to another CSP, offering a different platform.

b. How to avoid lock-in?
“When you put a lot of your resources, a lot of your data in the cloud, you want to know that you can move all that away to another CSP, or even bring that back on premises, if that’s the exit strategy,” says Thomas Erl, CEO of Arcitura Education Inc. (McKendrick, 2011).
The law office must ensure during the planning phase of cloud migration that the architecture of the IT-Business can run on multiple cloud platforms and the data can be migrated from one CSP to another. Cloud Foundry² platform, which is Apache 2.0-licensed, is the industry’s Open PaaS and provides a choice of clouds, frameworks, and application services. Some PaaS has limited offerings in terms of language and framework support that restrict the cloud consumer to deploy its technology to a single cloud.
There have been a major research and development efforts invested into methods, tools, and standards to avoid the problem of vendor lock-in. Open-source platform is designed to avoid the problem of lock-in. For instance, TM Forum Cloud Services Initiative is an approach to increase cloud computing adoption such as common terminology, transparent movement among CSPs, security issues, and benchmarking.

c. Steps to avoid lock-in
It is indeed a challenging task to figure out whether a vendor is trustworthy or trying to lock you in. However, there are certain steps that the law office can follow as a consumer to avoid lock-in.

i. Read the Service level agreement (SLA) of the CSP carefully. Check the definition of services, performance measurement, data handling, disaster recovery, termination of agreement. Accept the SLA only if it meets your need. The management team or the team responsible for the analysis of the SLA must consult IT-Team and the legal department.

ii. Ask the CSP before the planning phase about their policies of data moving. How the CSP supports toward moving the services to another CSP?

iii. Select the architecture of the selected technology such that it can be executed on multiple cloud platforms and can be easily moved from one cloud to another.

iv. Ask your CSP to give you detailed information about their architecture so that you can investigate the technical boundary conditions. If you are going to move large section of business functionality to a CSP then demand specific architecture diagrams and get it reviewed by the system architect.

v. Ask the CSP if it is possible for you to maintain same image of the data On-premise or to export data in raw format.

vi. Check with the provider if they use any standards to ensure transparent movement among CSPs.

vii. Check with the provider if they need your application to be rewritten in their proprietary language or they are comfortable with the favorable languages for cloud application, e.g., C++, Java, Python.

7.1 Latency

Latency is becoming a major challenge for the cloud customer. It represents loss of availability and slows down network performance. Users access a cloud service through a network that introduces latency into every communication. Cloud latency is a bit different from the concept of latency known before the ubiquitous Internet. The latency is the time that packets use to travel from source to destination. In the case of cloud computing, the endpoints are not static. The geographical location of the user can be anywhere. Similarly, the cloud applications can be located anywhere. It is important to know the location of the ultimate end users and the networks that connect them to the destination networks (van der Zwet and Storm, n.d.).

According to White Paper published by Internap.com (Internap, 2013), every 0.1 s in latency reduces sales by 1% of Amazon.com. According to Equation Research sanctioned by Gomez, 78% of the site visitors have gone to a competitor’s site due to poor performance during peak hours. CSPs like Amazon, Google, and Microsoft offer no better than 99.95% availability as Service Level Agreements. This signifies that the cloud service will remain down for an average time of 21.6 min per month. This can prevent enterprises from adopting IT-Services through a CSP.

7.2 Security

Security is a major concern in the adoption of cloud computing services. Most customers are unwilling to place their sensitive corporate data in the cloud as the CSPs, or other competitive customers of the same CSP could compromise the data. Customers feel the lack of transparency as they are not aware of how, why, and where their sensitive data is processed. A customer can access cloud computing services anywhere with Internet. On the connection between the CSP and cloud customer, the data may be compromised if they are not secured. A survey conducted on 800 IT-Professionals across four countries by Intel in 2012 states that 57% of the respondents accepted that they are unwilling to move their workload and data into the cloud due to security and compliance issues (Intel, 2012).

Organizations do often not have control or knowledge of the location of the data storage in the cloud. Cloud customers have very limited control over the security policies enforced by the CSPs on their behalf. In traditional IT-Environments, IT-Infrastructure is present behind the firewall of an organization. Virtualized and nonvirtualized servers serve only a fixed line of business. IT-Professionals can select advanced security tools that give them a high degree of control over the security and compliance issues related to the organization. In the case of cloud infrastructure, servers are virtualized and shared across several lines of business or even across multiple organizations. It is important to connect multiple cloud data centers to gain efficiencies. For instance, IT-Professional may want to link a public cloud data center based in UK with their private cloud-based one in Germany. If there is not an advanced tool available to secure the connection among the distant infrastructure, local IT-Staff loses a degree of control and visibility into workload and data.

7.3 Interoperability

Interoperability is still a big challenge in cloud migration. The cloud computing community does not have a universal set of standards now. Cloud interoperability might force the user to be dependent on a single CSP and causes vendor lock-in. Once an organization has selected a CSP, it is often extremely difficult to move to another CSP. It mostly incurs huge cost to change providers. It ceases the negotiation power toward the increment of service cost and service discontinuation.

The common practice to enable interoperability is the use of open standards. There are many cloud standardization projects. These projects focus on standardizing cloud computing solution such as workloads, authentication, and data access. The cloud standards coordination Wiki maintains a list of some projects (Standards, n.d.). Table 1 lists some of the projects related to standards for cloud computing interoperability (Hogan et al., 2011). The table titled “Cloud Standardization Effort” from the report “The Role of Standards in Cloud-Computing Interoperability” (http://www.sei.cmu.edu/reports/12tn012.pdf) (c) 2012 Carnegie Mellon University is used with special permission from its Software Engineering Institute.

7.4 Internet speed

Cloud computing needs mostly a public network connection to access cloud data and applications with any computing device. To access cloud data, an Internet connection is used in the most cases. In a traditional noncloud environment, the server and client devices are connected by an internal high-speed network infrastructure. In cloud computing environment, all the access to data is done using an Internet connection. Internet speeds are on average 20 times slower than local network speeds. The download speed is in often (ADSL) not identical to upload speeds, i.e., pushing information from the cloud user device to the cloud server is slower than pulling information from the cloud to the device. Internet Service Provider (ISP) does not guarantee the Internet speed and performance. Internet bandwidth is typically shared by all users in the local office (TrinusTech, n.d.). The solution to mitigate this problem is to use an enterprise-class Internet connection (symmetric) that has better fault tolerance and repair service than a consumer-class connection. The main disadvantage of this solution is the high price of enterprise-class connection.

7.5 Cloud integration

The integration of “traditional” On-premise systems with a cloud infrastructure is still a huge problem. KPMG International’s 2012 global CSPs survey (KPMG, 2012) found that the integration with existing architecture is the second biggest challenges/concerns (41%) about adopting cloud services (see Figure 4). The issue of integration takes into account the ability to connect with both source and target systems. In order to execute a smooth integration, data must be extracted from the source system, resolve all the technical and semantics differences and publish the data to the target system. In order to achieve the complete benefit of cloud computing, it is important to plan and execute integration for data, application, network, and identity:

Data—Data integration addresses the requirement to synchronize data that resides in two or more systems so that both systems always contain timely and meaningful data (SalesForce, 2014). InformaticaCloud (Cloud, n.d.) provides a solution for cloud data integration for SaaS and IaaS by integrating data between cloud-based and On-premise systems.

Application—Application integration addresses the requirement to connect business applications at a functional level. Application integration involves generation of an event in one application and triggering some activities in another application. The widely adopted application integration scenario is described by Kolluru and Mantha (2013):

• On-premise application to cloud application integration

• Cloud application to On-premise application integration

• Cloud to cloud application integration.

Network—Network integration ensures smooth and reliable communication between the On-premise and cloud server. Small size businesses often set up a Virtual private network (VPN) that connects the individual machine to the cloud network. VPN connection allows a user to access any application or database on the cloud server by using encrypted point-to-point communication.

Identity—Identity management is the aspect of cloud integration that is usually left unaddressed while planning cloud migration. IT- and management-teams pay great attention toward the integration of functionality and data. A business system comprises of many credentials to access different services. If a user can access a set of services On-premise using his credentials then, he must be able to access the same service in the cloud without any interruption. A cloud integration solution must be able to establish proper authentication and authorizing mechanism to access any resource in the cloud and On-premise.

8.1 Planning

The planning phase is the most important phase because the prerequisites for all following phases and the accompanying procedures will be defined during the planning phase. Mistakes or uncertainties during this phase can affect the whole migration and operation. Especially an eventually necessary termination process could be massively disturbed or is not possible without enormous costs and may be with loss of reputation for the cloud customer.

The business analysis and the constitutive security analysis are the fundaments for all further decisions and concepts. So it is recommended to develop these two concepts very carefully and complete. From the practical experience, a comprehensive business analysis will often also give starting-points for an improvement of detailed or entire processes. So at the example of the lawyer office, we were able to detect optimization potentials in some of the internal workflows as well as in communication procedures with courts.

The subtasks of the planning phase shall include as a minimum the following points:

- Business analysis

- Security analysis

- Definition of required SLAs

- Definition of security requirements

- Definition of required cloud services

- Definition of required cloud deployment model

- Definition of the CSP (call for tender or scan the Internet)

- Requirements for interoperability

• Virtualization software (vendor, type, version, upgrade cycle, …)

• Flexibility in upgrading or keeping the version level in accordance also to other cloud customers

- Definition of the basic rollback scenario

8.2 Contracts

Based on the strategy and the cloud policy, the contracts with the CSP as well as with the ISPs have to be negotiated. Depending on the legal situation in the country of the cloud customer, the contracts have to be negotiated and regularly adopted if necessary. Basic guidelines are described in Section 5. Because network connectivity is the basis of the successful access to the cloud services, it is essential that the ISP (mostly the CSP will be accessed via Internet) will offer the required service quality and availability. All contractual defined service levels with the CSP cannot be provisioned if the network is not available in the required condition. This often causes complex disputes.

Furthermore, it is important to describe the termination processes in the contract that includes the secure and complete erasure of all customer data and process information (including backups). The CSP has to ensure that no data can be retrieved in any way from any media after termination of the cloud service. Nondisclosure agreements also for the time after service provisioning are essential and have to be part of the contract with the CSP.

Essential subtasks for the contract design are:

- Definition of the form of the contracts (especially in international services)

- Ensure that all related law areas are involved and covered

- Description of the location, where the service are allowed to be provided (processing and storage of data)

- Definition of indicators of service provisioning and other relevant requirements (measurability and auditing)

- Definition of required certifications, quality of the certifications, and cycles to renew the certifications

- Definition of the framework for auditing processes

- Definition of Service Level Agreements and how to ensure the provisioning of the defined services (this includes the conditions and terms of termination)

- Definition of technical forms and software versions

- Definition of termination of the cloud service.

8.3 Migration

The migration phase is the most complex phase. On the basis of the former conducted business and security analysis the implementation and Migration Security Concept (MSC) has to be developed. The migration starts with a realistic test scenario, which is executed by employees of the cloud customer with real applications, but mostly as a simulation and not in real service. During this subphase, the decision to keep staying in the former situation or to migrate has to be made and necessary changes in the concept of service provisioning by the CSP can be done. During each stage of the migration phase, a rollback to the beginning must be possible.

Relevant aspects for the migration phase are:

- Implementation of the IT-Processes and IT-Services according to the business processes analysis

- Definition of the IT-Service concept

- Definition of the security concept for the migration phase (MSC) and the operation phase

- Definition of the migration concept, this includes:

• Test-concept, description, requirements, documentation, evaluation of the test

• Concept for change over (parallel service provision, consistency of services and data, rollback scenario)

• Secure transfer of the data and processes to the CSP

- Definition of a checklist for the migration process, as a basis for a necessary start of the rollback scenario

- Definition of responsibilities during the whole migration process from definition of concepts—testing—transfer—takeover, etc.

8.4 Operation

The operations phase is a more or less steady-state situation where the cloud customer mostly has to take care that the quality of the IT-Service provision is sufficient. Measures described in ISO 9000 (Quality Management) and ISO 27000 (Information Security Management) families have to be applied to guaranty the required service quality. Independent audits have to be done to guarantee the defined service quality.

Relevant aspects for the operation phase are:

- Definition of the IT-Service operation

• What services are available?

• How to access the services?

• Authentication and authorization requirements and how are they realized

• Service provisioning (e.g., based on ITIL)

- Security concept (based on ISO 27001)—follows from the planning phase

- Qualification concept for administrators and users

- Definition of the concrete auditing concept

- Emergency Handbook and test-procedure for the emergency case

- Auditing concept (see also Chapter 8)

8.5 Termination

The termination phase is necessary under the consideration that the rollback to internal IT-Service provisioning or the change of the CSP usually is not under consideration by a cloud customer in long-term planning. Often economic reasons or insufficient service provisioning leads to a decision to change the IT-Service provisioning that might lead to leaving the actual CSP. An intensive preparation makes a change of the CSP safer and more secure.

Relevant aspects for the termination phase are:

- Termination plan

• Definition, who shall provide the IT-Services

• Ensure how to get access to all data and business processes during the whole termination process (documented guideline)

• New contract with another CSP or an internal IT-Service Provider

• Time schedule of the termination and remigration process

• SLAs for the remigration

- Definition how to secure the processes and the data

• Secure permanent access to the data during the termination process

• Secure data in transit

• Ensure secure and sustainable erasure of customer data

- Termination of the contract with the existing CSP

- Penalty rules if the CSP does not fulfill the SLAs (part of the contract)

- Definition of an emergency scenario for the case that the CSP does not cooperate

- Nondisclosure agreement for a time after service provisioning of the former CSP