1 / 38

Auditing Cloud Services

Auditing Cloud Services. Brian Daniels, CISA, GCFA David Crotts, CISA. Overview. Introduction to cloud services in a decentralized environment Audit perspective of cloud service risks Conducting the audit Outcomes Questions or comments. Why Utilize Cloud Services?

enye
Télécharger la présentation

Auditing Cloud Services

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Auditing Cloud Services Brian Daniels, CISA, GCFA David Crotts, CISA

  2. Overview • Introduction to cloud services in a decentralized environment • Audit perspective of cloud service risks • Conducting the audit • Outcomes • Questions or comments

  3. Why Utilize Cloud Services? Who Uses Cloud Services? How Can You Identify Cloud Service Implementations? What is Virginia Tech’s Cloud Service Environment Like? Introduction

  4. Why Use Cloud Services • Collaboration • Need for excess storage • Lack of resources to manage internally • Cost effective

  5. Who Uses Cloud Services • Researchers • IT Professionals • Administrators • Students • Alumni • EVERYONE!

  6. How to Identify Cloud Services • Request info from Central IT • Request info from Departments • Query technology related expenditures • Account Codes • MCC • Unlikely to identify all

  7. Control Environment at VT • Departmental purchasing authority. • Difficult to identify all purchases. • Purchase records only show vendor, not product detail. • What about free services? • Mobile device apps?

  8. Control Environment at VT • Guidelines suggest reviews by: • Central IT (Security, Network) • Data Stewards • Legal Counsel • Is it realistic?

  9. Risk Environment Risk Assessment Contract Risks Cloud Services Risks

  10. Risk Environment • Risks of outsourcing are similar to risks of operating internally . • Additional risks exist when the system is outside of your control. • Low cost/free services vs. high cost? • How do you monitor these risks?

  11. Risk Assessment • A need has been identified. • What could go wrong utilizing a cloud service provider? • What is the worst possible outcome? • What is a more likely outcome? • What am I exposing myself to?

  12. Risk Assessment • What data elements will be utilized? • Are there any regulatory requirements? • FERPA • HIPAA • ITAR • PCI • PII

  13. Risk Assessment • What risks are significant enough to warrant special consideration in contract negotiations?

  14. Contract Risks • Who has signature authority? • Click through agreements? • Does the defined service adequately represent the identified need? • How complete is the audit clause? • Client access to audit vendor performance. • Client access to review third party audits.

  15. Contract Risks • Does the agreement require acknowledgement of regulatory compliance? • Who owns the data once it’s in the cloud?

  16. Contract Risks • What invokes the termination clause and what does it address? • Access to data upon termination. • Secure removal of data. • Termination fees or waiver of fees. • Responsibilities of each party upon termination.

  17. Contract Risks • Service Level Agreements • Are they complete? • Are they reasonable? • What is the measurement period? • What is the penalty for non-compliance?

  18. Contract Risks • Are the specific obligations explicitly stated in the contract? • If not, where are they located? • Policies, procedures, or privacy statements are typically subject to change without notice. • Click through agreements may also change without notice.

  19. Contract Risks • Do the elements of the contract apply to any subcontracted vendors? • Negotiation of appropriate contract terms is an effective means to reducing risk exposure. • It is often not possible to get all desired terms and conditions in the contract.

  20. Sampling Document Requests Audit Testing Conducting the audit

  21. Sampling • What factors exist in the population? • Users • Type of service • Functional Use • Cost

  22. Sampling • Select a cross section • Single user to organization wide • Application or storage • Administrative, teaching, research • High cost, low cost

  23. Documentation Request • Planning Documentation • Risk assessments • Steering committee minutes • Product reviews • Security reviews

  24. Documentation Request • Original and most recently executed contract. • Most recent SLA performance review • Most recent third party audit report • Preferred report is the SOC 2 Type 2

  25. Testing • Risk assessment • Centrally created questionnaire • Only required for purchases greater than $2,000 • Yes/No responses • Developed in 2011

  26. Testing • Steering Committee Minutes • No steering committee for most department specific purchases • Expected for central systems purchases (i.e. email, business intelligence software)

  27. Testing • Security Reviews • Performed on 4 of 5 services with a cost greater than $2,000 • Not performed on smaller dollar purchases • IT Security Office provides an opinion on the security architecture of the service • Has resulted in corrective action by the vendor.

  28. Testing • Signature Authority • Department and Central authorization OK • Data steward review was often absent • Based on the data utilized by the service • Legal Counsel review was often absent

  29. Testing • Terms and Conditions • Audit Clauses • One audit clause gave the vendor the right to audit Virginia Tech! • Termination agreements • Beware of data retrieval and removal provisions • Definition of adequate and robust SLAs

  30. Testing • Terms and Conditions • Subcontractors • Use of subcontractors permitted? • Enforcement of parent contract to subcontractors? • Regulatory compliance requirements? • Personnel vetting?

  31. Testing • Contract Monitoring • Periodic review of Terms and Conditions • Still reflect current operating environment? • What changes have occurred? • SLA Performance • Third party audit reviews • Identified one subcontractor who had significant data breaches occur in 2009.

  32. outcomes

  33. Outcomes • Risk assessment questionnaire • Revised questions to target specific risks and help assess data elements used and need for ongoing monitoring. • Expanded scope to include items under $2,000.

  34. Outcomes • Communication and Training • Ensure adequate knowledge of the risks of outsourcing for department staff. • Focus on training business staff and IT professionals.

  35. Outcomes • Assess the impact of restricting use of certain MCC codes on selected Pcard holders. • Manage the risk at the point of procurement by limiting the number of people able to purchase such services.

  36. Outcomes • Establishment of preferred standard contract language. • Joint effort led by IT Acquisitions in collaboration with Procurement, Legal Counsel, and Central IT.

  37. Outcomes • Processes and procedures designed to help manage and monitor contracts. • Led by IT Acquisitions with input from Central IT or other administrative functions.

  38. Questions or comments?

More Related