Methodology Of Cloud Computing Risk Assessment

Methodology Of Cloud Computing Risk Assessment

A Break in the Cloud’s Silver Lining

Though cloud computing is considered as the new paradigm of computing, it should not be considered as a new technology but merely a new implementation or application of existing technology, specifically networking and telecommunications technology. So this brings with it some inherent security risks, with some security experts stating that “the economies of scale and flexibility (that cloud computing brings) are both a friend and a foe from a security point of view.”

When your application and data is streamed half way around the world from your geographical location, there is a risk that whatever data is traveling may be intercepted by a third party with malicious intent. And as data and resources are massively concentrated virtually or literally, this creates a very attractive target for attackers. But cloud-based defenses can also be made to be robust, scalable and cost-effective. That is the goal that the ENISA working group had in mind when they drafted the Methodologies for Cloud Computing Risk Assessment.

Methodology for Cloud Risk Assessment

Because of the inherent risks associated with cloud computing, an ad-hoc working group within the European Network and Information Security Agency (ENISA), the European Union’s center for excellence in network and information security, made an assessment of the benefits and security risks that are present in cloud computing. Then the group gave recommendations on how to mitigate these risks and enhance the benefits of cloud computing.

The working group responsible for the risk assessment also determined a methodology which allows direct comparison between items that enable organizations to perform their own risk assessment and risk management of cloud services and infrastructure. The purpose of which is:

  • To be able to determine the most appropriate risk assessment and management items that an organization may use depending on their situation like which business sector they belong to, the size of the organization, culture, regulation requirements, the sophistication of their risk approach, and their available resources.
  •  To enable a direct comparison between risk assessment and management items in order to achieve a better understanding and permit expert advice on their suitability for use in the given situation of the organization.

The methodology considers the process of risk assessment and management items and together with their inputs and outputs, scores them against set benchmarks that were determined by the group. Depending on the nature of the organization, their business, and their geographical location which determines regulatory processes, they can determine their overall requirements for risk assessment and risk management (RA/RM) by considering and listing down a number of “use cases” and then determining the RA/RM requirements based on that. The organization then assign scores to their processes based on the benchmarks which results in an alignment profile created using a radar chart. It is recommended that individual organizations produce their own ideal alignment profile on which they may compare the score of their profile against.

All the recommendations and methodology are on a document that can be downloaded from ENISA’s website: http://www.enisa.europa.eu.

Conclusion

The importance of assessing and managing the risks that comes with cloud computing is very important so that an organization’s cloud computing foray may return positive rewards. If this was neglected and the organization jumps in blindly, they may not achieve the full potential of cloud computing and may not be able to cope with the risks involved.

By Abdul Salam

About Abdul

Abdul is a senior consultant with Energy Services, and author of numerous blogs, books, white papers, and tutorials on cloud computing and accomplished technical writer with CloudTweaks. He earned his bachelor’s degree in Information Technology, followed by an MBA-IT degree and certifications by Cisco and Juniper Networks.

He has recently co-authored: Deploying and Managing a Cloud Infrastructure: Real-World Skills for the CompTIA Cloud+ Certification (Wiley).

View All Articles

Sorry, comments are closed for this post.

Encrypting Your Cloud Data For Extra Protection

Encrypting Your Cloud Data For Extra Protection

Encrypting Your Cloud Data Encrypting data is one of the best ways of protecting your data as it moves to the cloud. The only thing better than encrypting your data, is not storing your data at all. Let’s first look at the case of using file sharing applications such as Dropbox. If you are the…

How Cloud Computing Is Changing The Retail Game

How Cloud Computing Is Changing The Retail Game

Cloud Computing Retail The retail industry is constantly evolving to meet the ever-changing needs of consumers. This transformation is influenced by e-commerce, social networking and the latest technologies. Today’s shoppers expect a connected and interactive consumer experience from start to finish. According to a report by the National Retail Federation, it is a projected that…

How Data Privacy Reform Is Wreaking Havoc In The Cloud

How Data Privacy Reform Is Wreaking Havoc In The Cloud

Data Privacy Reform Is Wreaking Havoc Nations around the globe are stepping up efforts to better protect the personal data of private citizens. In particular, cross-border data security regulations and legislative reform is on the rise. The laws must evolve in order to mitigate theft, abuse and misappropriation of personally identifiable information (PII), better guard…

Consequences Of Combining Off Premise Cloud Storage and Corporate Data

Consequences Of Combining Off Premise Cloud Storage and Corporate Data

Off Premise Corporate Data Storage Cloud storage is a broad term. It can encompass anything from on premise solutions, to file storage, disaster recovery and off premise options. To narrow the scope, I’ve dedicated the focus of today’s discussion to the more popular cloud storage services—such as Dropbox, Box, OneDrive—which are also known as hosted,…

Carve Outs And The Cloud: A Synergistic Coupling

Carve Outs And The Cloud: A Synergistic Coupling

Carve Outs and the Cloud The mergers and acquisitions market is a complex and challenging industry and the last two years has seen a rise in the number of transactions. Working with companies in this space over the last 10 years, we at RKON have seen and hopefully helped change the mindset of private equity…

New Smartphones From Apple, Samsung and HTC Promise To Light Up 2016

New Smartphones From Apple, Samsung and HTC Promise To Light Up 2016

New Smartphones from Apple, Samsung and HTC (Sponsored post courtesy of Verizon Wireless) The launch of the Galaxy S7 Edge at the Mobile World Congress in Barcelona during February was the first shot in a vintage year for mobile phones. The S7 is an incredible piece of hardware, but launches from HTC and Apple later in the…

Featured Sponsored Articles
How Successful Businesses Ensure Quality Team Communication

How Successful Businesses Ensure Quality Team Communication

Quality Team Communication  (Sponsored post courtesy of Hubgets) Successful team communication and collaboration are as vital to project and overall business success as the quality of products and services an organization develops. We rely on a host of business tools to ensure appropriate customer interactions, sound product manufacturing, and smooth back-end operations. However, the interpersonal relationships…

Featured Sponsored Articles
How To Develop A Business Continuity Plan Using Internet Performance Management

How To Develop A Business Continuity Plan Using Internet Performance Management

Internet Performance Management Planning CDN Performance Series Provided By Dyn In our previous post, we laid out the problems of business continuity and Internet Performance Management in today’s online environment.  In this article, we will take a look at some of the ways you can use traffic steering capabilities to execute business continuity planning and…

Featured Sponsored Articles

CloudTweaks is recognized as one of the leading influencers in cloud computing, infosec, big data and the internet of things (IoT) information. Our goal is to continue to build our growing information portal by providing the best in-depth articles, interviews, event listings, whitepapers, infographics and much more.

Sponsor