Chapter 2

Selecting and Engaging with a Cloud Service Provider

Abstract

Selecting a cloud service provider will need to consider a number of key criteria, price being only one of these. This chapter will consider the available mechanisms to measure the security deployed by prospective providers.

Keywords

Assessment; Continuous monitoring; STAR initiative; Service level agreement The worst case scenario ? Security, Trust and Assurance Repository (STAR) initiative ? Engaging with the cloud service provider The cloud service provider that you selected has just gone out of business. A letter has arrived at your door from administrators of the provider warning you that unless you provided a large upfront cash payment by close of business today then the data center will close, oh and by the way, if you do not want to pay and simply get your data back, it will probably take up to four months! This may sound like a hypothetical worst case scenario, but it is exactly the position customers of 2e2 recently found themselves in.1 Administrators were hoping to raise a total of £960,000, with smaller users expected to contribute £5000 each. Failure to meet the required total would likely prove devastating to many if not all customers:

We have received a number of requests from customers seeking to gain access to their data immediately. Unfortunately, the levels of data held in the companies' datacentres are such that this process could take up to 16weeks and we will need to ensure that the integrity of third-party data and security is maintained.

Consider the impact this type of scenario can have not only on your business, but also on your career and credibility within your place of employment. After all, you did undergo appropriate due diligence did you not? There is no suggestion that 2e2 customers failed to undertake appropriate due diligence, and indeed the cause of the issue was financial and not as a result of a security-related incident. However, it is presented as a warning, that selecting and engaging with a cloud provider demands due diligence to satisfy not only appropriate regulatory bodies (where applicable), but also the internal organization, and in a worst case scenario the media and irate customers. This due diligence will likely include not only the security maturity of the provider, but also their financial viability (wherever possible), possible analysis into the directors of the company, etc. One option would be to adopt a modified Know Your Customer (KYC) principle adopted by financial institutions. The KYC controls typically include the following2: ? Collection and analysis of basis identity information. ? Name matching against lists of known parties. ? Determination of the customer's risk in terms of propensity to commit money laundering, terrorist finance, or identity theft. ? Creation of an expectation of a customer's transactional behavior. ? Monitoring of a customer's transactions against their expected behavior and recorded profile as well as that of the customer's peers. While a like for like approach is unrealistic as this application is so very different to selecting a cloud provider, a comprehensive assessment is advisable as recommended by the Federal Financial Information Examination Council.3 In their 2012 statement, they stated that "Cloud computing may require more robust controls due to the nature of the service. When evaluating the feasibility of outsourcing to a cloud computing service provider, it is important to look beyond potential benefits and to perform a thorough due diligence and risk assessments of elements specific to that service."3 Some of the steps that should be considered under the Know Your Cloud Service Provider process should include the following, according to a paper by Peak the Cloud entitled "Tips for Selecting Your Cloud Provider"4: ? Solid reputation: This will involve checking for references from the provider's existing clients, and whether these implementations relate to the service prospective clients are considering. This should also include whether their implementations align with industry/geography where relevant. ? Best of breed technology partnerships: It is advised to determine whether the prospective provider has the appropriate partnerships with technology providers that align with the potential service. ? Financial stability and growth: This measure will determine the financial viability of the provider, and will ultimately determine on the willingness of the provider to discuss their financial state. This may be feasible if the accounts are publicly accessible, and will allow potential customers to determine if the provider has a history of stability and growth. ? Enterprise-grade data centers and state-of-the-art equipment: Where possible the potential customer should ensure that the infrastructure is capable of supporting the overall business. This will be a difficult measure to ascertain as the right to audit is generally unavailable. ? Compliance, availability, and performance: These measures will be covered in further detail later in this chapter. Many of these tips address those that relate to the business viability and as such are out of scope of this book, with security and privacy considerations the focus of this publication. Further, dependent on the service sought not all of these measures will be required as the level of due diligence should be commensurate with the level of risk the organization is willing to tolerate. For example, where a provider is sought to host commercially sensitive data then the level of due diligence should be higher than if noncommercially sensitive data are being hosted. There is no magic formula with regards to the level of due diligence that should be undertaken, nor is there any specific methodology that must be followed, although certain frameworks for regulated data may either be advisable or required (for example, the Privacy Impact Assessment for personal data). Determining these factors will be entirely subjective; therefore, the following should be used as guidance and tailored according to the business (and business function).

Security, Trust and Assurance Repository Initiative

One option afforded to potential end customers is to engage with each and every potential cloud service provider to determine the security controls implemented. In fact, in discussions with many providers today this appears to be the default method used by potential customers. Although such a method is likely to receive a response, it is an incredibly inefficient method for both provider and customer. For this reason, the Cloud Security Alliance launched the Security, Trust and Assurance Repository (STAR) in 2011. As discussed in Chapter 1, one of the greatest challenges associated with cloud computing is the lack of transparency regarding the level of security deployed by the provider. In an effort to address this issue, STAR was launched to provide a central repository where potential customers can freely access to determine the level of security deployed by providers it allows. This provides a level of transparency that historically would have required more than likely multiple e-mails/calls to each and every provider under consideration. Now potential customers not only have a single place to go to understand the security employed by multiple providers, it also allows for comparisons to be made providers therefore improving assurance in the cloud. The registry itself is based on three layers: 1. Self-assessment: The first layer publishes the result of the Consensus Assessment Initiative Questionnaire (CAIQ) and/or the Cloud Controls Matrix (CCM). As the name suggests, this particular layer has been filled out and completed by the provider. Therefore, entries on this layer provide less assurance and transparency than subsequent layers. Please note that from March 2014, providers were given the option of using either CCM v1.4 or CCM v3. The opportunity to use both standards will remain until February 2015, whereupon all providers will be assessed against CCM v3. 2. Third-party assessment-based certification: The second layer publishes the results of an assessment undertaken by a third party on the cloud service provider against the CCM and International Organization for Standardization (ISO)/ International Electrotechnical Commission (IEC) 27001 (please refer to Chapter 6 for more details on ISO/IEC standards), or American Institute of Certified Public Accountants (AICPA) Service Organization Control (SOC) 2. Results within this layer provide a greater level of assurance, in that they are verified by a third party. 3. Continuous monitoring-based certification: Results within this layer are published in a continuous fashion. While previous layers would update the registry based on the audit or certification cycle (usually annually) of the provider, continuous monitoring leverages the Cloud Trust Protocol (CTP) to update as the name suggests, continuously! As the results are provided even outside of annual audits, end customers are given the greatest transparency and assurance regarding the security maturity of the provider. Please refer to Chapter 6 for...