Governance in the Cloud
Sai Honig Waikato District Health Board, Hamilton, New Zealand
Abstract
Governance is ensuring accountability and oversight of an entity’s operations. Governance is also identifying opportunities and risks and implementing strategies to manage them. One of many strategies becoming increasing popular is to move operations “into the cloud”. Although this may be seen as opportunity for agile development, faster deployment and reduced investment, there are risks that need to be managed. These risks, such as data security, interoperability and portability, and compliance, may actually reduce the real value of the investment.
With any investment, a calculation of return on investment (ROI) should be conducted. This is not necessarily a complex calculation, however, an understanding of the variables is necessary. These variables should include not only the upfront costs and reoccurring costs but also termination costs. Upfront costs may include customization and configuration as well as terminating existing systems when cloud systems come online. Reoccurring costs may include agreed-upon subscription fees but also additional fees for upsizing services on an as-needed basis. Termination costs may include data transfer or translation costs when moving from cloud service provider (CSP) to another or bringing that service within the entity. Calculating ROI can begin to address the question of whether expected value is obtainable from using these services.
As more services are contracted to CSPs, the need for assurance becomes greater. Although data, software, and hardware may be housed in other locations, the responsibility for maintaining compliance still lies with the data owner or entity. In our globally connected world, compliance and good business practices may be difficult to enforce. One method of gaining assurance is to audit those services. The challenge here is that CSPs are not within your entity’s operating control. However, there are actions that can be taken to gain assurance expected controls are in place and functioning as designed.
1 Why is governance important?
The mission of the Organisation for Economic Co-operation and Development (OECD) is to promote policies that will improve the economic and social well-being of people around the world. The OECD works to advance these causes, throughout its 34 member nations, through various means including corporate governance. To this end, the OECD has produced guidelines for and reporting of corporate governance.1
The OECD defines corporate governance as “Procedures and processes according to which an organization is directed and controlled. The corporate governance structure specifies the distribution of rights and responsibilities among the different participants in the organization—such as the board, managers, shareholders and other stakeholders— and lays down the rules and procedures for decision-making.”2
So why is governance important? As the OECD has stated, governance defines the rules and procedures for decision making and ensuring oversight of operations. As business operations are moved to cloud service providers (CSPs), the decision-making process can become (for lack of a better word) cloudy. Oversight of operations can become difficult. How do customers, their boards, managers, shareholders, and other stakeholders ensure that their business requirements and interests are adequately met? Unless the risk is also outsourced (e.g., insurance), the responsibility still remains with the customer.
Boards are hearing much about the benefits of cloud computing—lower cost, higher efficiency, faster innovation, and implementation. These are some of the potential benefits depending on strategy and implementation. A full discussion of these potential benefits will not be included in this chapter. For the purpose of this chapter, it is assumed that the enterprise is considering an external cloud provider. Also, for the purpose of this chapter, the word “enterprise” will refer to the organization, or customer, seeking services from a CSP.
2 What are the questions that boards should be asking?
There are questions that boards, to whom the responsibility for the overall governance falls, as well as managers, shareholders, and other stakeholders should be asking. These questions apply to both for-profit and non-profit enterprises. Ideally, these questions should be asked before the transition of operations to cloud services. With the exuberance of something new and exciting, these questions may be ignored or set aside. The answers can determine the readiness of an enterprise in implementing a cloud technology solution and whether that enterprise can be comfortable with the governance and operations of the cloud provider.
These questions may be simple but do require an extensive review of the internal structure of an enterprise.3 Here is a brief discussion of some of these questions:
• Is there a plan for cloud computing and does that plan include benefits as well as risks?
There are potential benefits to implementing a cloud technology solution. These include competitive advantage by bringing new or improved products faster to market (faster development to deployment time), increasing productivity, containing costs. All of these should not be overlooked. If effectively implemented, cloud technology adoption may be worth the risks when compared to opportunity costs of transforming the customer’s enterprise.
What operations will be transitioned to a CSP? Is there an opportunity cost to outsourcing critical operations? An enterprise should consider the potential loss of knowledge (technical and business) if moving to a CSP. Is there a business continuity plan in case of disruption?
• Does these plans support the enterprise’s strategy?
It is not enough to implement cloud technology. How will the solution support the enterprise? What objectives are to be achieved by implementing a cloud technology solution? Careful consideration should be given to tie the objectives of cloud technology implementation to specific goals of the enterprise’s strategy.
• Is the enterprise ready for such a transition?
Does the enterprise have the appropriate staffing to develop and manage cloud services? The expectation will be that the CSP will be hosting services. However, those services will need to be managed. Contracts and service level agreements (SLAs) will have to be negotiated. Terms and conditions will have to be understood and adhered to by the enterprise. If the CSP does not meet the enterprise’s needs, the remaining needs will have to be undertaken by the enterprise.
Does the enterprise understand the effort to transition to a cloud technology? Cloud technology has the potential to disrupt an enterprise’s operations and culture. An enterprise with a centralized structure may not be adequately ready for potentially decentralizing their operations and functions. Also, an enterprise may have to consider adapting their change management or sourcing functions. In addition, the enterprise may have to undertake a review of their staffing skills in order to determine if they can support their own users of cloud services (e.g., access management, help desk support).
What about the enterprise’s regulatory and compliance requirements? The CSP’s data center may not be physically located in the same legal jurisdiction. They may not even be located in the same country. Several nations have their own regulations about the movement of data within and outside their borders. What are the enterprise’s responsibilities regarding compliance? What is the enterprise’s responsibility in case of a breach?
One area that is not often fully defined within organizations prior to migrating to a cloud infrastructure is data management. The issues encountered here include4:
• Unclear ownership—ownership is dispersed among various groups within the organization
• Undefined data meaning—incomplete or nonexistent data dictionaries which may lead to data obtained for one purpose but used for another purpose which may not be captured when loading data into a warehouse
• Inflexible data structures or legacy systems
• Ever increasing amounts of data—potential for metadata-related risk, where various sources are correlated to obtain confidential information, or data loss due to incomplete, invalid, or inconsistent practices
• Access controls—acquiring more privileges due to limited access review
What about the enterprise’s existing investments or commitments (e.g., technology, procurement, financial, etc.)?
A cloud technology solution may not be easily or immediately adopted. Current technologies or contracts may be in place with a pre-determined end date (e.g., software or services that are still supported or under contract). If it is determined that adopting a cloud technology solution is in the best interest of the enterprise, the costs of continuing existing technology may have to be included in the cost of implementation.
In addition to staffing skills that may need to be updated, the enterprise may need to consider if there are additional technology investments that need to be made (e.g., data centers, software applications, network infrastructure).
• How will the enterprise measure benefit or risk after implementing cloud technology solution?
As with any new investment and implementation, it is best to measure the value obtained or risk introduced. It is advisable to determine how the value or risk is to be measured before implementation. This is to better understand the position of the enterprise after potentially strategic changes are implemented. These measurements should be shared with the board in order to assess determine if further implementations are warranted.
One commonly used measurement is return on investment (ROI). Such calculations need not be complicated. The next section discusses one methodology.
Cloud services and providers are increasing their abilities to service their customers and many providing niche services such as storage, backup, security, and customer relations management. Therefore, more enterprises will find that cloud technology solutions will become more available. Enterprises will need their boards to provide governance in managing cloud technology solutions and realizing potential benefits while reducing risk and cost.
In order for the board to provide governance, expectations of the cloud technology solution must be aligned with the strategic initiatives of the enterprise. These expectations should also be aligned with guiding principles for using the cloud: enablement, cost benefit, enterprise risk, capability, accountability, and trust.5
The process of implementing a cloud technology solution will not be discussed in this chapter. However, a basic process could be defined in four steps6:
1. Preparation of the internal environment—principles, policies, frameworks, processes, organization structure, etc.
2. Selection of the cloud service model—determine if migration to cloud model is best solution for the enterprise and, if so, what service (e.g., SaaS, PaaS, IaaS, some combination or subset)
3. Selection of cloud deployment model—determine if a private, public, hybrid, or community cloud model is the best solution for the enterprise
4. Selection of the CSP
This chapter will not discuss in detail the various service or deployment models. For a more detailed review, the reader is urged to consult “The NIST Definition of Cloud Computing.”7
3 Calculating ROI
The ROI is one of several methods of estimating potential financial outcome of an investment. To calculate (simple) ROI, the investment cost is subtracted from the investment gain; the result is then divided by the investment gain and expressed as a percentage8:
It must be understood that this calculation does not factor in cost of funding (e.g., interest) or time value of money (e.g., the value of money in the future is less than the value of money today). An enterprise needs to define what financial calculations it would use to determine if an investment is worthy of its efforts. Also, an enterprise needs to define what is its investment timeframe horizon (e.g., 1 year, 5 years, etc.). Doing so will indicate what costs and well as gains are to be included in the financial calculations.
Despite its simplicity, the ROI calculation is a good starting point for those investments where the benefits and costs can be quantified. In implementing a cloud technology solution, there are both tangible (which can be quantified) benefits and costs and intangible (could be considered as strategic) benefits and costs. CSPs and other providers would gladly calculate these benefits and costs. The true calculation must be considered from the perspective of the enterprise.9
It may be easy to list the tangible benefits of a cloud implementation. There are potential benefits to be gained by cost reductions (e.g., physical hosting, labor, licensing, support, maintenance), increased productivity, scalability, and reliability. What may not be easy is defining the metrics in order to quantify these benefits.
For example, an enterprise may consider greater customer satisfaction as a benefit. This may be defined as reduced time in collaborative efforts with or reduced response time to customer inquires. After consideration, an enterprise may consider this to be an intangible benefit. As an enterprise details their cloud technology solution, addition benefits may be evident.10
Intangible benefits are those that may not be quantifiable and, therefore, may not be included in financial calculations. However, they should be considered as part of the proposal to consider a cloud technology solution. These benefits may not initially have quantitative value but may produce such values as the enterprise moves through its implementation phase and conducts business. For example, increased business opportunities (or avoidance of missed business opportunities) may not be evident initially.11
One potential intangible benefit that an enterprise may consider is security risk transfer. CSP’s may be better able to prevent or mitigate security breaches or loss of data. They may also be partners in disaster recovery. However, the customer must understand that ultimate responsibility for their assets (including data), regardless of their location, rests with the customer. The enterprise is ultimately responsible for security and compliance.12
The ROI includes not only benefits but costs as well. These costs can be broken down into upfront, recurring, and termination costs. As with benefits, the costs must be considered over the timeframe of the investment. These costs also need to be considered from the enterprise’s perspective.13
It may be easier to consider the upfront or initial costs. As with implementing any new technology, there are costs for configuration and integration. As mentioned in the previous section, there are costs to be considered regarding the enterprise’s readiness. These could include training and process reevaluation.14
Recurring costs include those items that the enterprise pays on a periodic basis. These include subscription and support fees, which are usually defined in the contract and may be incurred on a per user basis. However, there are costs in monitoring the CSP’s activities and verifying that they are meeting the enterprise’s mutually agreed contract, SLAs, and other operating procedures.15 This is where the governance of the enterprise can dictate the level of review.
The costs due to termination of a contract may not always be considered as part of the cost of investment. These costs are incurred when services are either transferred to another provider or reverted into the enterprise’s internal operations. In some cases, this transition may be due to changes in regulations or economics. It may also be due to changes in the enterprise’s business operations.16
Regardless of the causes, considerations should be given for these costs. Once assets are placed in the cloud, extraction and validation from cloud storage or processing hardware will be necessary. This may also require reconfiguration or reprovisioning of systems, recruitment of staff resources, and early termination fees. A customer may consider including costs due to running dual processes as data and systems are being transferred and confirmed.17
Once an enterprise has determined that the investment is necessary, the need to verify operations in a cloud technology solution may be required. There are a number of regulations, such as Sarbanes-Oxley in the United States, that require enterprises to verify controls are in place and working effectively. The following section describes a methodology to audit a cloud technology solution.
4 Auditing the cloud
4.1 Planning and scoping the audit
Planning an audit of the cloud will require understanding of information governance, IT management, as well as network, data, disaster recovery, and encryption controls used by the enterprise. An understanding of the cloud technology solution used by the enterprise is also necessary. It is also helpful to have an understanding of the regulatory and compliance requirements of the enterprise. Therefore, staff performing this audit will need to a wide variety of skills. The audit scope may need to be tailored to match the skills of the enterprise’s staff or external resources may be necessary for a more complete review.
It also necessary to understand what the objective of such an audit will provide to the enterprise. ISACA® has published an audit program that intends to provide18:
• An assessment of the internal controls of a CSP.
• Identify internal control deficiencies within the enterprise.
• An assessment of the ability to rely on the CSP’s attestations regarding internal controls.
This audit program has included in its scope19:
• Governance affecting cloud computing
• Contractual compliance between the CSP and the enterprise
It should be noted that the identification of internal controls deficiencies is of the enterprise and not the CSP. This is due to the fact that, unless negotiated prior to service, most CSPs will not allow their customers to review their internal controls. However, there are some methods, including external reporting, which will provide an assessment of the CSP’s internal controls. A brief review of elements of such an audit is included here.
4.2 Governance and enterprise risk management
An initial review should include an assessment of governance functions within the enterprise. This is to determine if there are effective processes in place with clear lines of responsibility and is in alignment with the enterprise’s regulatory requirements and policies. This would include the enterprise’s governance model, information security collaboration with CSPs and performance metrics.20
Since the use of a cloud technology solution can be done quickly and easily, the enterprise should have mechanisms to identify all CSPs and all deployments. This is to ensure that all business activities, including those of the CSPs, are aligned with the enterprise’s policies and procedures. It would be helpful if the enterprise has a method of inventorying all services provided via CSPs or if services can be procured without the involvement of the enterprise’s information technology and security staff and key business units.21
An example of the lack of governance of cloud deployment can be observed when such deployments are procured outside of the organization’s procurement processes. In one such case, staff at a Fortune 1000 company, with a large development group, found it easier and faster to purchase instances from a CSP, using corporate-issued credit cards. (Such purchases generally do not require management pre-approval or procurement review.) The results may have achieved faster development but also failed the procurement process:
• Failure to identify all services provided by CSPs and confirming such services comply with organization’s requirements.
• Increased operational costs due to instances being purchased but not monitored and closed after use.
• Failure to manage organization’s intellectual property.
Collaboration between the enterprise and the CSP may be inherent. However, such collaboration should have the responsibilities and reporting relationships defined. Often, key contacts within the enterprise and the CSP are assigned. In addition, metrics, SLAs, and contract terms are defined to indicate to all parties what is considered acceptable performance. This facilitates the governance processes of both the enterprise and the CSP.22
It is also worth noting that contracts between organizations’ and CSP are often dependent up the number of instances or licenses. Careful consideration should be given for such quantities. CSPs may give a specific rate for up to a specified number of instances or licenses. Exceeding the specified number may require additional unplanned costs. A Fortune 50 company implemented a SaaS solution with a specified number of licenses. This number was quickly used and each additional license added an unexpected higher per license cost. These additional higher per license costs canceled any savings in using the SaaS solution.
It is easy to dismiss operational risks if an external entity is providing services. However, the enterprise’s risk management processes may need to be updated to evaluate any inherent risks in using a cloud technology solution. An enterprise should consider information usage, access controls, security controls, location management, privacy controls. Depending on the service (e.g., SasS, PaaS, IaaS), the enterprise needs to determine what analytical information it will need to verify contractual obligations are met. For example23:
• For SaaS—analytical data relating to performance and security
• For PaaS—control practices relating to availability, confidentiality, data ownership, privacy
• For IaaS—controls for a secure operating environment
The depth of a review of the CSP’s operations will be determined by mutually agreed contract. The CSP may provide policies regarding incident management, business continuity, and disaster recovery. If so, these policies should be in alignment with the enterprise’s policies.
4.3 Legal and electronic discovery
It would benefit the enterprise to take a detailed review of the contract terms and establish an understanding of those terms. If possible, a due diligence of the CSP’s security governance, risk management, and compliance should also be conducted. The enterprise would also find that developing business continuity and disaster recovery plans, in case of the loss of services by the CSP, useful. These plans should be evaluated for adequacy.24
The contract terms should also be reviewed to ensure that they address the compliance requirements of both the enterprise and the CSP. Since there may be more than one set of jurisdictional oversight (e.g., across national borders) or regulatory requirements (e.g., US HIPAA, PCI DSS, etc.), it is important to identify responsibilities of all parties. Procedures on data retention, security practices, and geographic location of data should be made available to the enterprise. With regard to electronic discovery (e-Discovery), there may be circumstances in which data could be legally obtained by law enforcement authorities and notification of such events should be delineated.25
4.4 Compliance and audit
The “right to audit” is a broad term. Often when it is used in contracts, it gives the customer of a service provider some availability to review the service provider’s operations. Generally, the availability is limited. In the case of a CSP, third-party reviews may be conducted and the results may be shared with external parties upon request. Such third-party reviews may be conducted by external auditing assurance and advisory services.
One such report is the “Service Organization Control” (SOC) reports. The SOC reports (Type 1 and Type 2) are prepared under the guidance of the American Institute of CPAs® (AICPA). The use of these reports is intended for stakeholders of the service organization. The SOC Type 2 reports on the “suitability of the design and operating effectiveness of controls.” These reports are intended to provide26:
• Oversight of the organization
• Vendor management program
• Internal corporate governance and risk management processes
• Regulatory oversight
The Cloud Security Alliance® (CSA) is also working to provide further assurance of CSPs. The CSA Security, Trust, and Assurance Registry (STAR) Program is multiple reporting mechanisms for cloud provider trust and assurance through a publicly accessible registry. Currently, CSPs can conduct a self-assessment (level 1) based on the CSA’s Cloud Controls Matrix (CCM). The CSA CCM is a controls framework intended to provide structure, detail, and clarity relating to information security tailored to cloud computing.27
Currently, there is also an external attestation (level 2) and an external certification (level 2) that CSPs can have conducted28:
• CSA STAR Attestation provides guidelines for conducting SOC Type 2 engagements using criteria from the AICPA (Trust Service Principles, AT 101) and the CSA CCM. The CSA has recently published “Guidelines for CPAs Providing CSA STAR Attestation.”29
• The CSA STAR Certification is a third-party independent assessment of the security of a CSP. The technology-neutral certification leverages the requirements of the ISO/IEC 27001:2005 management system standard together with the CSA CCM.
It must be understood that these reports are intended for those who are familiar with the controls of the service provider. These reports may not provide complete assurance of the service provider’s controls. The controls described in these reports may also not match controls of the customer. Some evaluation of these reports will have to be conducted by the customer to determine if:30
• Report addresses control environment used by customer
• Descriptions and processes are relevant to customer
• Testing satisfies customer’s regulatory and compliance objectives including any trans-border requirements
4.5 Portability and interoperability
Although planning to transition into a cloud technology platform is conducted, planning to transition from that platform is often overlooked. Such planning should include not only data but also formats. Portability testing should include procedures and alternatives to prove a state of readiness exists should the need to be transfer cloud computing operations. This could prevent unnecessary delays if an event occurs that requires disaster recovery or business continuity plans to be implemented.31
A number of testing steps could be done validate a state of readiness in the event a transition occurs. For each cloud initiative, a portability analysis should be conducted to32:
• Determine hardware and software requirements.
• Validate procedures and time estimates to move large volumes of data, applications, and infrastructure (as needed).
• Identify proprietary functions, processes, applications modules that may require customized programming and could delay transfer.
• Determine if backup data and applications are routinely stored in a format that is usable by other systems.
4.6 Operating in the cloud
A strong partnership is necessary between the CSP and the customer when operating in a cloud technology platform. Therefore, incident notification, responses, and remediation should be timely and addresses the risk that caused the incident. It is necessary to have such procedures documented as to the notification timeliness and process. Issue monitoring should be conducted on both the customer side and on the provider’s side.33
Faster innovation and implementation are consistently touted as part of the development processes in a cloud technology environment. However, such fast changes could introduce unintended and unwanted security risks. As part of the design process, the customer should consider including security reviews as part of the change management process. This may require the use of subject matter experts.34
Maintaining data security and integrity is a consideration for data in transit as well as data at rest and data backup. If encryption is used, key management processes should be reviewed. The customer should review if the level of encryption is appropriate.35
Because of the multi-tenancy nature of many cloud technology environments, there is a potential for cross-contamination. Virtualized operating systems should be hardened with isolation and security controls implemented by the CSP. Additional controls may also be considered and incidents should be reported through incident monitoring process:36
• Vulnerability scanning
• Security-related APIs
• Virtual machine validation
• Separate production and testing/development environments
4.7 Identity and access management
A strong identity and access management process should ensure that only authorized users have access to resources and users activities can be reviewed. In a cloud technology environment, the customer should have control over user provisioning, user deprovisioning, and access changes. The controls should allow for management of user access, including authentication, according to the customer’s user access policies.37
Authentication is dependent upon the service that an enterprise chooses. For SaaS and PaaS, the enterprise may want to verify that a trust relationship exists between the enterprise’s internal authentication system and the cloud system. For IaaS, the enterprise may want to employ dedicated VPNs between enterprise’s systems and the cloud system. Where possible, standard authentication formats, such as SAML or WS-Federation, should be considered.38
5 Conclusion
A successful implementation of cloud technology depends upon the relationship between the enterprise and the CSP. That relationship starts with an understanding of the governance structures of both parties. This understanding can start with the enterprise asking questions of how the cloud technology solution is to benefit the enterprise’s strategic goals and how the enterprise is ready for such a transition. A calculation of the investment from the enterprise’s perspective can provide a starting point of the benefits as well as the costs of a cloud technology implementation.
Even prior to an implementation, an enterprise could consider reviewing the operations of a potential CSP. Such a review could include available policies and procedures as well as third-party reports. Regulatory and compliance requirements of both parties should be understood prior to services being conducted. This is particularly important in industries with multiple regulatory bodies or where there is a potential for trans-border data flows. It is important to note that cloud technology development should be integrated into the enterprise’s change management process. Monitoring and incident reporting should also be integrated into an enterprise’s processes.
Finally, the breadth and depth of a review of the implementation of a cloud technology can be broad. The level of review needs to be defined by the enterprise’s governance requirements and agreements with the CSP.