Cloud Computing & Control Auditing
Download as PPTX, PDF1 like959 views
Cloud computing allows companies to access applications and store data remotely via the internet instead of locally. It provides scalable IT resources on demand that can be accessed from anywhere. Some key benefits include reduced costs, increased flexibility and collaboration capabilities. However, security and privacy concerns remain top issues that need to be addressed. Control testing and governance models are important to effectively mitigate risks when using cloud services. Case studies of companies like Salesforce.com and GSK demonstrate how cloud can drive innovation while reducing IT costs through the subscription-based model.
Ad
More Related Content
What's hot (20)
Viewers also liked (20)
Ad
Similar to Cloud Computing & Control Auditing (20)
Ad
Recently uploaded (20)
Cloud Computing & Control Auditing
- 1. Cloud Computing & Control Auditing ~ Navin Malhotra
- 2. Cloud Computing Basics Internet Your company doesn’t pay for h/w and maintenance The service provider pays for equipment and maintenance •Cloud computing is a construct that allows you to access applications that actually reside at a location other than your computer or other internet connected device, most often this will be a distant datacenter. Cloud computing can be defined as a benefit-driven operations solution that delivers scalable IT resources via the web, as opposed to hosting and operating these services locally. •These resources include tools, applications and services, in addition to the infrastructure in which these services operate. By deploying these tools and services over the web, companies and organizations can access resources on demand and significantly reduce (or possibly even eliminate) software and hardware costs. Additionally, a business‟ IT capacity can quickly and easily adjust to changes on demand, making the flexible nature of cloud computing immensely appealing. •One of the most valuable benefits of the cloud is the ability for employees to access, update and share files, documents and data, and use software applications from anywhere there is internet connectivity.
- 3. Cloud Topology Internet Client computers Distributed Servers Datacenter Client are in a cloud computing architecture, the exact same things that they are in plain old, everyday LAN. They may be your desktop, laptop, tablet PCs, mobile phones or PDAs. Servers located at remote locations but are all placed in one region.Servers are distributed across the remote locations. Advantages of “thin” client: •Lower h/w & IT cost •Data and information security •Less power consumption •Ease of repair
- 4. Cloud Service Models Service Models SaaS PaaS IaaS Moving apps to cloud costs can be a double edged sword. Proper ROI and needs to be measured before moving apps to cloud. Inter-operability or lock-in concerns. SaaS is a model in which an application is hosted as a service to customers who access it via the Internet. The customer doesn’t have to maintain it or support it. On the other hand, it is out of customer’s hand when the hosting service will decides to change it. The provider does all the maintenance and upgrades as well as keeping the infrastructure up and running. PaaS is another application delivery platform. PaaS supplies all the resources required to build applications and services completely from the Internet, without having to download or install software. PaaS service include application design, development, testing, deployment and hosting. Other services include database integration, security, scalability and storage to name a few. A downfall of PaaS interoperability and po providers. Also, if the pro business, your applicatio be lost as it is all stored th The ability of geographically isolated development teams to work together. The ability to merge web services from multiple sources. The ability to realize cost savings from using built-in infrastructure services for security, scalability and failover, rather obtaining them and test them separately. Rather than purchase servers, s/w, acks and having to pay for the atacenter space for them, the ervice provider rents those esources. Additionally, the nfrastructure can be dynamically caled up and down, based on the pplication resource needs. IaaS offers the hardware so that your organization can put whatever they want onto it. It is sometimes also called as Hardware as a Service (HaaS). Whereas SaaS and PaaS were providing applications to customers, IaaS doesn’t. We only talk about hardware in the cloud here.
- 5. Cloud Deployment Models Deployment Models Private PublicHybrid Community The cloud infrastructure is available only for an organization. – if you do not want your data to be shared with other tenants (parties) The cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services The cloud infrastructure is shared by several organizations and supports a specific community that has shared concern The cloud infrastructure is a composition of two or more clouds (private, community, or public)
- 6. System Architecture H/W - CPU cycles - Processor speed O/S Web Server App Server DB Application Cloud is everywhere
- 7. First movers in the cloud It is one of the first companies to offer cloud services to public. They offer a number of cloud services: •Elastic Compute Cloud (EC2): Offers virtual machines and extra CPU cycles. •Simple Storage Service (S3): Allows you to store items up to 5GB in size in Amazon’s virtual storage service •Simple Queue Service(SQS): Allows machines to talk to each other using this message passing API. •Simple DB: A web service for running queries on structured data in real time. This service works in close conjunction with S3 and EC2, collectively providing the ability to store, process and query datasets in the cloud. These services needs to be done on command line, so you may find it difficult to use it if you are not used to working in command line environment. Amazon’s virtual machines are versions of Linux distributions, so those who are experienced with Linux will find no difficulty in using the Amazon cloud platform. Applications can be written on your own machine and then uploaded to the cloud. You can see more about Amazon’s cloud services at http://aws.amazon.com Google offers online documents and spreadsheets and encourages developers to build features for those and other online s/w, using it’s Google App Engine. To store data you need to use Google database. Groups and individuals will likely get the most out of App Engine by writing a layer of Python that sits between the user and database. You can also have a look at the app engine at http://code.google.com/appengine/
- 8. First movers in the cloud Microsoft cloud computing solution is called Windows Azure, an OS that allows organizations to run Windows applications and store files and data using Microsoft’s datacenters. Key components of Azure service platform include: •Windows Azure: Provides service hosting and management and low level scalable storage, computation and networking. •MS SQL Service: Provides database services and reporting. •MS .NET Service: Provides service based implementation of .NET framework. •Live Services: Used to share, store and synchronize documents, photos and files across PCs, phones, PC apps and websites. •MS SharePoint services and Dynamics CRM services: Used for business content, collaboration and solution development in the cloud. MS plans the next version of Office to offer a browser based option so that users can read and edit documents online as well as offer the ability to users to collaborate using web, mobile and client versions of Office. MS cloud offerings can be found at http://www.microsoft.com/azure/default.mspx
- 9. Cloud Computing - Objective Increased focus on business: Facilitates superior user experience through agile and robust cloud services. Faster time-to-market: Cloud uses enterprise frameworks such as Authentication, authorization user-interface and workflow which reduces overall time-to-market Increased business agility: Empowers business users to make effective functional changes through configuration. Reduced operational costs: Pay-as-you-use model, low maintenance and support, reduces hardware, software, licensing and development Objectives
- 10. Cloud Computing - Benefits Benefits Scalability – If you are anticipating huge upswing in computing needs, cloud computing can help you manage. Rather than having to buy, install and configure new equipment, you can buy additional CPU cycles or storage from a third party by click of a button and let them handle the installation and configuration for you. Since you will asked to pay per use, so your actual costs will be lesser than when you would have opted to buy the equipments as a whole. Simplicity – The cloud solution makes it possible to get your application started immediately and it costs a fraction of what it would cost to implement an in-site solution. Knowledgeable Vendors – The first comers to the cloud computing are very reputable companies. Amazon, Google, Microsoft, IBM, Yahoo and lately Apple. They have offered reliable services, plenty of capacity and we get some brand familiarity with these well-known names. More internal resources – By shifting your non-mission-critical data needs to a cloud, resources are freed up to work on important, business-related tasks. Network outages are a nightmare for the IT staff, this burden in offloaded onto cloud service provider. Security – There are security risks when using a cloud, but the reputable companies strive to keep you safe and secure. Vendors have strict privacy policies and are auditable by external auditors. They have in place proven cryptographic methods to authenticate users.
- 11. When No to Cloud Computing Regulate d environm ents Geopoliti cal concerns Hardware dependen cies Server control Cost Lack of Need Integratio n Latency concern Throughp ut demands
- 12. Cloud Security – Concerns & Assurance Security Security is one of the top most concern in the cloud environment. Though reliable and reputable cloud service providers can be trusted to provide us safe and secure service, but still concerns are growing and we need to seriously look upon them before getting our data into cloud. Though data in our servers is also not secure if those servers can be connected via internet or VPN. The provider must ensure that their infrastructure is secure and that their clients’ data and applications are protected while the customer must ensure that the provider has taken the proper security measures to protect their information. Cloud security architecture is effective only if the correct defensive implementations are in place. An efficient cloud security architecture should recognize the issues that will arise with security management. The security management addresses these issues with security controls. These controls are put in place to safeguard any weaknesses in the system and reduce the effect of an attack. 1Gartner: Seven cloud-computing security risks Cloud Computing Security Correct security controls should be implemented according to asset, threat, and vulnerability risk assessment matrices. While cloud security concerns can be grouped into any number of dimensions (Gartner names seven1) these dimensions have been aggregated into three general areas: Security and Privacy, Compliance, and Legal or Contractual Issues
- 13. Cloud Security - Benefits Centralized data Monitorin g Reduced data loss Security testing Instant Swap over
- 14. Cloud Computing - Trends
- 15. Cloud Computing - Gartner Predictions for 2014 and Beyond Industry predictions By 2016, poor return on equity will drive more than 60% of banks worldwide to process the majority of their transactions in the Cloud. By 2017, 40% of utilities with smart metering solutions will use cloud-based big data analytics to address asset-, commodity-, customer- or revenue-related needs. Gartner recently shared the Top 10 strategic technology trends for 2014: Mobile device diversity and management - BYOD Mobile apps and applications Hybrid Cloud and IT as service broker Cloud/Client architecture The era of personal Cloud Web-scale IT As mobile users continue to demand more complex uses of their mobile technologies, it will drive a need for higher levels of server-side computing and storage capacity. The push for more personal cloud technologies will lead to a shift toward services and away from devices. The type of device one has will be less important, as the personal cloud takes over some of the role that the device has traditionally had with multiple devices accessing the personal cloud Large cloud services providers such as Amazon, Google, Salesforce.com, and the like are re-inventing the way in which IT services can be delivered. The suggestion is that IT organizations should align with and emulate the processes, architectures, and practices of these leading Cloud providers. The combination of the aforementioned three among others is how Gartner defines “Web-scale IT.” Gartner suggests that bringing together personal Clouds and external private Cloud services is essential. Enterprises should design private Cloud services with a hybrid future in mind and make sure future integration/interoperability is possible.
- 16. Cloud Attributes
- 17. Cloud Controls Controls to be put in place for Cloud environments Architecture & Design Security Environmental Controls SLA Service Availability Logical Security – Access Control Governance Regulatory Controls BC & DR Background Checks Physical Security Risk Management
- 18. Quality / Compliance in Cloud Before defining approach for cloud audits / assessments we need to have below requirements in place: • Expertise in terms of resources who have understanding of the cloud services/ environments. • We should have complete understanding of the business and IT risks. Those risks should include risk associated with data privacy, information security, statutory and regulatory requirements. •Define the controls(detective, corrective & preventative) to effectively mitigate those risks. •Control testing to be performed on frequent basis depending upon the risk associated with controls. •Control testing should be defined in way to measure the control effectiveness. •Governance model to be defined which should be owned by the organization’s steering committee. Control Objectives Control Definitions Control Testing Documentation of test results Business & IT Risks On defined frequency Governance / Steering Committee/ Business & IT Leadership
- 19. Case Study- Salesforce.com Salesforce.com is global cloud computing company started in 1999 and best known for the Customer Relationship management product. Salesforce.com disrupted the CRM industry in two different ways. First, it changed the earnings logic by applying the “rental” model (monthly payment billed based on the number of users) to an industry hitherto characterized by lump sum licensing fees (charged for a company as a whole). The company understood that not all small businesses could afford software costing many thousands of dollars. By offering an affordable solution (a monthly fee per user) to small and medium firms, Salesforce.com cashed on a significant blue ocean market at the time deemed unattractive by large players as it could not be served with their current business models. Second, Saleforce.com understood that prospective clients wanted to experiment with the product before committing to it. As a result, while other service providers were promising their clients a customized solution in exchange for commitment, the goal of Salesforce.com was to get prospective customers (specifically end-users) to try its product for free. In 2007, Salesforce.com extended its services by launching Force.com – a customization platform for corporations. The company knew it could not provide a complete back-end customized solution. Thus, Salesforce.com opened its infrastructure to external developers by allowing them to supplement its own inputs. By making Force.com compatible with all major development environments and tools (i.e. .NET, Java, PHP, Ruby on Rails, among others), independent developers (i.e. those outside Salesforce.com) were able to integrate services ranging from simple email to Facebook and Twitter within the platform. Competitors became partners, allowing Salesforce.com to better serve existing clients and acquire new ones. In 2011, more than 340,000 developers were contributing to the Salesforce.com platform.
- 20. Case Study- GSK: GlaxoSmithKline GSK, the second largest pharmaceutical company in the world chose to migrate to the Cloud offering of Microsoft Business Productivity Online Suite. Everything was hosted by Microsoft on its data centers across the globe. GSK was looking for a productivity and collaboration increase from the switch. The global implementation of Microsoft online services gave GSK numerous Benefits a. Reduce Operational Cost The migration to cloud resulted in 30% savings in their IT operational costs. b. Drive Innovation The subscription service can be tailored to fit growing and changing needs. So that when GlaxoSmithKline adapts to changing market, its software adapts too. c. Expand External Collaboration GlaxoSmithKline is aggressively driving a more externally collaborative business through all practices: research and development, manufacturing, and sales. This supports collaboration between partners and GlaxoSmithKline, allowing for a more innovative and competitive business. d. Simplification of user experience Moving away from the customized solutions environment, GlaxoSmithKline was looking for a simple solution that would effectively extend to the many branches, regions, and employee types internally.
- 21. •www.northbridge.com •www.wikipedia.org •Cloud Computing – A Practical Approach by Anthony T. Velte, Toby J. Velte and Robert Elsenpeter •www.gartner.com References