Security Organization, Governance, and the Cloud

The report recommends how to organize and implement governance for security and compliance when using cloud services, recognizing that many organizations already use more cloud services than they realize—sometimes strategically for business transformation and customer-facing improvements, sometimes to cut costs for commodity IT like email and CRM, and sometimes informally by employees trying to “get the job done.” Moving services to the cloud shifts control of infrastructure and service delivery to the Cloud Service Provider (CSP), reshaping risk and compliance; responsibility becomes shared, yet the customer remains responsible for the security and compliance of the data processed in cloud services.

Cloud offerings span layered models— IaaS, PaaS, SaaS, and BPaaS—plus adjacent cloud-delivered IT management services such as IDaaS, and can be deployed via public, private, community, or hybrid models. Risk is grouped into four principal categories: compliance, business continuity, data security, and cyber security, with loss of compliance identified as the most prominent organizational concern. The report highlights continuity threats such as provider lock-in, unclear data ownership and return conditions, proprietary PaaS architectures, acquisitions, outsourcing chains, and end-to-end dependencies on power, communications, and availability.

A governance-led approach, with board-level sponsorship, should define cloud business objectives, policies, constraints, and risk appetite, and implement managed processes for acquisition, security controls, and ongoing assurance. Organizational readiness depends on mature IT governance (e.g., COBIT), data/app classification, standard security controls (e.g., ISO/IEC 27001), service request processes, and audit capabilities. Procurement must be fast and user-friendly to prevent bypass by lines of business, incorporate risk assessment, clarify shared responsibilities, define measurable SLAs, and require independent evidence (e.g., ISO 27001/27017/27018, SOC, CSA STAR). CASBs are recommended to improve visibility, detect unsanctioned use, and enforce policy. Finally, successful cloud management requires a named leader—often best placed in IT services—to coordinate stakeholders and drive progress toward the Future IT Paradigm.

• Cloud service models are described as layered offerings: IaaS, PaaS, SaaS, and BPaaS, with cloud-delivered IT management services such as IDaaS alongside.
• Public cloud services are available for anyone to subscribe to and process customer data on shared infrastructure.
• Private cloud deployment guarantees that some infrastructure used to provide the service is exclusive to an individual customer.
• Community cloud services run for the exclusive use of a set of customers with shared security and compliance requirements.
• Hybrid cloud deployments combine in-house, public, private, or community clouds.
• Security and compliance responsibilities are shared between the cloud customer and the CSP, and the split depends on the service model.
• For IaaS, the CSP is responsible for securing the infrastructure, while the customer is responsible for security from the operating system upwards.
• For PaaS, the CSP is responsible for infrastructure and managed middleware security, while the customer is responsible for securing how managed services are used.
• For SaaS, the CSP is responsible for the security of infrastructure, operating system, middleware, and application.
• Four principal cloud risk categories are defined as compliance, business continuity, data security, and cyber security.

• “In all cases the cloud customer is responsible for the security and compliance of the data processed in cloud services.”
• “A governance-based approach allows trust in the CSP to be assured through a combination of internal processes, standards and independent assessments.”
• “These should be part of an overall governance scheme that covers all IT services however they are delivered.”
• “Many employees have used public file sharing services to interchange confidential information, YouTube to share sensitive internal corporate videos, as well as public email services to bypass corporate security controls or to work while out of the office.”
• “The process for requesting cloud-based services should be sufficiently quick and user friendly that it is not bypassed by lines of business.”
• “Not all risks are equal – you need to prioritize which risks are important and specify the controls needed to manage these.”
• “Customers should use a guide such as ENISA Procure Secure to help identify and specify the measures.”
• “There is no such thing as perfect security and so organizations must take a risk based approach to the use of cloud services.”
• “IT needs to take a marketing led approach to really understand the business needs and to position IT as the “go to” source for the services the business requires.”
• “There are many organizational stakeholders and the future IT organization needs to engage with all of these to ensure success.”