Moving to computing are auditors ready for the security challenges? Albert Otete CPA CISA ISACA Uganda Workshop

Transcription

1 Moving to computing are auditors ready for the security challenges? Albert Otete CPA CISA ISACA Uganda Workshop

2 What is computing?

3 Examples of service providers

4 Computing preface Cloud computing is defined by the US National Institute of Standards and Technology (NIST) as: Model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. 1. Traditionally, one required a software licence for each application to be installed on desktop, laptop or server. Thanks the Local Area Network was born and client-server model (CSM) implemented. 2. Cloud computing utilises CSM to login via secure web protocol 3. TYPES: Private, Public, Community or Hybrid 4. SERVICES: SaaS Applications, patch and version management PaaS Android, Java, Web browsers IaaS Storage, hardware, networks, servers 4

5 Computing fundamentals 5

6 Few examples of computing 1. Webmail has traditionally been hotmail, Yahoo!, Gmail. Wherever one went in the world, the s could be accessed. Microsoft Outlook Web Access an attempt at hybrid cloud 2. DATA STORAGE: Large files like MP3, videos and photo consume lots of hard drive and may not be accessible on the move. Examples include Microsoft SkyDrive, Amazon s S3, Apple s icloud. 3. COLLABORATION: Using Google Wave, professionals can enrich a project document from diverse locations. Others are Spicebird and Mikogo 4. VIRTUAL OFFICE: Use cloud for file sharing, storage and remote access. GoogleDocs, Microsoft Office Live, ThinkFree 5. PROCESSING POWER: Scalable IT infrastructure to suit needs. Amazon EC2 and ElasticHosts (EH)

7 Governance Governance of Enterprise IT COBIT: Val IT: BMIS: Risk IT: Plan/Organise Acquire/Implement Deliver/Support Measure/Evaluate Value Governance Portfolio Management Investment Management Governance Evaluation Response Organisation design People Technology Process 7

8 Preparedness for computing assurance 1. Involve internal and external auditors early in the process of designing a Business Case for migration to the Cloud 2. Right to audit clauses including statement on standards for attestation engagements (SSAE) reviews 3. Due-diligence of the Cloud service providers 4. Operational governance through formal Cloud policies, processes and procedures. 5. Cloud service catalogue and SLAs 6. Classify data, infrastructure, applications on Cloud with appropriate parameters and rating based on their criticality/ business need 7. Data location requirements and arrangements. Consider country risk due to different data regulations (Data privacy and IP)

9 Cloud computing security risks 1. UNAUTHORISED ACCESS TO DATA: Hackers switching from stealing credit card data and selling on black market to theft of company secrets and Government data. Proliferation of mobile devices (tablets and smart phones) connected to the company network using Internet, coupled with weak password and encryption protection for files shared by . Hackers using Cloud computing to make their work easier. 2. DATA SECURITY: Users do not know the physical location of their data and the configuration of the system that delivers their services. Inherent weakness of hypervisors to protect deleted data and traffic moving along interfaces. Hypervisor enables different applications to co-exist and is the enabling technology for server virtualisation. Security in obscurity may become a weakness.

10 Computing security risks 3. DATA LOSS: Major cloud service providers are based in US and Europe, with few authorised agents locally. Companies invariably require a backup of SaaS data. What happens if provider goes bankrupt. Which type of data to upload to Cloud! 4. LEGAL : Some laws do not allow data to be stored outside the country of origin. There are countries where history of data protection is poor, and those Governments can tap into any data 5. DATA MIXUP: Virtualisation and data segments may not be set up accurately. Insecure Application Programming Interfaces (API) 6. DATA OWNERSHIP: To make cloud services attractive, providers are offering 2-3 year contracts that lock in the client. SLA must spell out clearly who owns the data, especially after termination of contract. 7. CHAIN OF CUSTODY: Cloud server could be required for forensic investigations, thus compromising data of other clients. 8. INSIDER THREAT: Traditionally, employees have posed the biggest threat to IT security. The Cloud magnifies the problem.

11 Guidance for computing assurance Chapters 1. Cloud computing preface 2. Cloud computing fundamentals 3. Governance in the cloud 4. Security and cloud computing 5. Assurance in cloud computing Appendix A. IT control objectives for cloud computing B. Cloud computing management audit/assurance program 11