SME Cloud Security Tool

{"opportunities":[{"id":"e3ab501c-aca8-45ed-9610-ad3cc30516b1","position":0,"type":"Opportunity","title":"Geographic spread","description":"Geographic spread can provide resiliency against regional issues and local disasters such as storms, earthquakes, or cable cuts. It can also be used to mitigate certain Denial of Service (DoS) attacks, allowing customers to get access at other locations."},{"id":"db1a4e7d-70d4-4af5-9c20-512027d8886b","position":1,"type":"Opportunity","title":"Elasticity","description":"Cloud computing providers can use large data centers with large amounts of spare resources, to be able to respond to rapid changes in resource usage, peak usage, and Denial of Service (DDoS) attacks."},{"id":"c799e382-b00f-4f75-960e-83b8310a4176","position":2,"type":"Opportunity","title":"Standard formats and interfaces","description":"Cloud services can be more easily integrated with other services, or ported to other platforms. It facilitates backup, fail-over, and integration with existing security tools the customer may use, for example monitoring tools"},{"id":"1f07e106-633f-4e79-803a-8e35acfc9d98","position":3,"type":"Opportunity","title":"Physical security","description":"Resource concentration makes physical security relatively cheap. If the costs of physical security measures can be shared with many customers then the cost per customer is low."},{"id":"ca4752b4-7ba1-45cd-bf3d-6aba072b0839","position":4,"type":"Opportunity","title":"Incident response around-the-clock","description":"24/7 monitoring and incidence response is offered by the cloud provide to the customer making the service cheaper."},{"id":"bfcfe3b6-224e-4464-8c3b-69cb586989ff","position":5,"type":"Opportunity","title":"Software development","description":"Cloud providers can afford to invest in secure software development, spreading these high costs across many customers. Customers may lose some flexibility in terms of customization, but they reduce the risk of software vulnerabilities in code they developed."},{"id":"121727a8-2cfd-487b-9e91-1a2b22ea27f9","position":6,"type":"Opportunity","title":"Patching and updating","description":"Due to their scale, and because they deliver the same software to all customers, cloud providers can automate patching and updating to a high degree."},{"id":"26e68dcc-a207-493b-8840-46071c08519d","position":7,"type":"Opportunity","title":"Backups","description":"Keeping backups, across a range of applications and devices, and restoring them when needed, can be difficult and time-consuming. Cloud providers can implement tools to automate creation and testing of backupsand offer advanced backup restore solutions, allowing customers to roll-back mistakes and errors quickly."},{"id":"1fdbe4f6-a55e-4cb2-886f-459dcf9905ac","position":8,"type":"Opportunity","title":"Server-side storage","description":"Using cloud services SMEs can reduce the amount of data on the end-user devices."},{"id":"e8a0e707-c7e6-408d-ac6b-54358c89eed9","position":9,"type":"Opportunity","title":"Security-as-a-service and security add-ons","description":"In cloud computing it is often more easy to outsource some of these security tasks to third-parties or the provider (if it offers such services)."},{"id":"ba923790-2de6-4d02-9b48-dac08b2bb133","position":10,"type":"Opportunity","title":"Certification and compliance","description":"Certification, by independent auditors, against network and information security standards could be used by customers to fulfill their own compliance obligation."}],"risks":[{"id":"47816f8f-2cb7-4544-a654-a8ecda78e05f","position":0,"type":"Risk","title":"Software security vulnerabilities","description":"Software vulnerabilities in cloud software could have a major impact on customers affecting also the provider's reputation."},{"id":"3a893c33-cb57-4397-b468-f37257e80444","position":1,"type":"Risk","title":"Network attacks","description":"The common network attacks (eavesdropping, sniffing, spoofing, man in the middle attack etc) can affect both service provider and customer."},{"id":"e14a2ed4-4cc5-418a-acd5-a4460f4226be","position":2,"type":"Risk","title":"Social engineering attacks","description":"In cloud computing, some administrative processes, like issuing user credentials, do not happen face-to-face between colleagues, but online via emails and websites. This increases the risk of social engineering attacks, in which an attacker fakes communication or information so it appears to come from a trusted source, like the cloud provider."},{"id":"cade97d4-0c95-45dd-b681-57667e561d1d","position":3,"type":"Risk","title":"Management GUI and API compromise","description":"Most cloud services offer the customer a management interface, which give administrators access to a a large number of assets. Compromise of this interface can cause loss of service/data from the cloud."},{"id":"b66de955-48e1-408d-a5fa-5f231db35c95","position":4,"type":"Risk","title":"Device theft/loss","description":"A complicating factor is the trend bring-your-own-device (BYOD), which means that employees use different types of devices, not fully under control of the SME’s IT experts. Features like screenlock, disk and storage media encryption, and many more may work differently on different types of devices and the provider or the customer cannot control them all."},{"id":"93b9af36-29aa-48bb-8c41-73968a275e65","position":5,"type":"Risk","title":"Physical hazards","description":"Natural disasters like floods, earthquakes, or fires, can affect the customer’s ICT asset, or the data centres and infrastructure of a cloud provider. In cloud computing, customers might be affected by natural disasters occurring far away from their own premises."},{"id":"b9a06da1-a28c-4533-a118-0f9995592896","position":6,"type":"Risk","title":"Overloads","description":"Logical isolation ensures that tenants cannot access each other’s data, but cloud tenants still use the same physical infrastructure, so customers may be affected by peaks in resource usage by other tenants or DoS attacks on other tenants."},{"id":"a13c63c9-b412-4781-85dd-ad2cd6382d03","position":7,"type":"Risk","title":"Unexpected costs","description":"Cloud computing is often pay-as-you-go, which means costs are not always fixed. This also means that costs could unexpectedly become very high."},{"id":"895b602a-16be-4df6-866e-5f2230dda9e3","position":8,"type":"Risk","title":"Vendor lock-in","description":"Vendor lock-in is a situation where it is hard for the customer to migrate to another cloud provider."},{"id":"62628c5f-2c48-4d20-a328-27ba80f036dc","position":9,"type":"Risk","title":"Administrative or legal outages","description":"Administrative and/or legal conflicts (even if no technology breaks) could have an impact on the availability of a cloud service."},{"id":"eef4a5ce-6fc5-4266-ab98-dd942254f582","position":10,"type":"Risk","title":"Foreign jurisdiction issues","description":"Cloud services sometimes involves the use of cloud providers or data centers abroad, which means that to a certain extent foreign jurisdictions may have an impact on the security and privacy of the cloud service."}],"sec_questions":[{"id":"483eafe5-2d35-4fea-b605-35aff3d19dad","position":0,"opportunities":["1f07e106-633f-4e79-803a-8e35acfc9d98","ca4752b4-7ba1-45cd-bf3d-6aba072b0839","bfcfe3b6-224e-4464-8c3b-69cb586989ff","ba923790-2de6-4d02-9b48-dac08b2bb133"],"risks":["93b9af36-29aa-48bb-8c41-73968a275e65"],"type":"Security Question","title":"Organizational security, governance and risk management","description":"How does the cloud provider manage network and information security risks related to the cloud service?"},{"id":"2438c6aa-eed5-4e77-a853-9981729b0da3","position":1,"opportunities":["ca4752b4-7ba1-45cd-bf3d-6aba072b0839","e8a0e707-c7e6-408d-ac6b-54358c89eed9"],"risks":["93b9af36-29aa-48bb-8c41-73968a275e65"],"type":"Security Question","title":"Responsibilities and liabilities","description":"Which security tasks are carried out by the provider, which type of security incidents are mitigated by the provider (and which tasks and incidents remain under the responsibility of the customer)?"},{"id":"731efab4-d51f-42cf-af78-09b23e2dd738","position":2,"opportunities":["e3ab501c-aca8-45ed-9610-ad3cc30516b1","1f07e106-633f-4e79-803a-8e35acfc9d98","ca4752b4-7ba1-45cd-bf3d-6aba072b0839","26e68dcc-a207-493b-8840-46071c08519d"],"risks":["b66de955-48e1-408d-a5fa-5f231db35c95","93b9af36-29aa-48bb-8c41-73968a275e65","b9a06da1-a28c-4533-a118-0f9995592896"],"type":"Security Question","title":"Contingencies and backups","description":"How does the cloud service sustain disasters affecting datacentres or connections and which data is backed up where?"},{"id":"1ae99614-48c9-443c-8444-2fc4c1cb0b31","position":3,"opportunities":[],"risks":["62628c5f-2c48-4d20-a328-27ba80f036dc"],"type":"Security Question","title":"Legal and administrative issues","description":"How is security of the cloud service guaranteed when there are legal issues or administrative disputes?"},{"id":"20317ca0-4832-4ba5-bbf3-fb440e44c357","position":4,"opportunities":["1f07e106-633f-4e79-803a-8e35acfc9d98"],"risks":["93b9af36-29aa-48bb-8c41-73968a275e65"],"type":"Security Question","title":"Personnel security","description":"How does the provider ensure that personnel works securely?"},{"id":"9eeb972c-d01a-4b2e-9b4b-304f7846d6da","position":5,"opportunities":["1f07e106-633f-4e79-803a-8e35acfc9d98","1fdbe4f6-a55e-4cb2-886f-459dcf9905ac"],"risks":["93b9af36-29aa-48bb-8c41-73968a275e65"],"type":"Security Question","title":"Access Control","description":"How is customer data or processes protected from unauthorized physical and logical access?"},{"id":"99e0ce13-6b8a-41ba-80cf-2a502e3f9d60","position":6,"opportunities":["bfcfe3b6-224e-4464-8c3b-69cb586989ff","121727a8-2cfd-487b-9e91-1a2b22ea27f9"],"risks":["47816f8f-2cb7-4544-a654-a8ecda78e05f","cade97d4-0c95-45dd-b681-57667e561d1d"],"type":"Security Question","title":"Software security","description":"How does provider ensure software security and which software remains customers responsibility?"},{"id":"4145bdb0-f54a-4b3c-bfd1-c771d0e09b48","position":7,"opportunities":["bfcfe3b6-224e-4464-8c3b-69cb586989ff","121727a8-2cfd-487b-9e91-1a2b22ea27f9","1fdbe4f6-a55e-4cb2-886f-459dcf9905ac"],"risks":["e14a2ed4-4cc5-418a-acd5-a4460f4226be","cade97d4-0c95-45dd-b681-57667e561d1d","b66de955-48e1-408d-a5fa-5f231db35c95"],"type":"Security Question","title":"User, management and application programming interfaces","description":"How is access to the GUI’s and API’s protected, and are their additional measures for administrators/high privilege roles (under the customer’s side)?"},{"id":"ab20732e-7e9e-4caf-8a9f-298d096676b8","position":8,"opportunities":["121727a8-2cfd-487b-9e91-1a2b22ea27f9"],"risks":["cade97d4-0c95-45dd-b681-57667e561d1d"],"type":"Security Question","title":"Monitoring and logging","description":"How can the customer monitor the service, which logs are kept, and how can they be accessed for example when the customer needs to analyse an incident?"},{"id":"72eed04e-81b2-4861-b782-b41dadcbca5e","position":9,"opportunities":["c799e382-b00f-4f75-960e-83b8310a4176"],"risks":["93b9af36-29aa-48bb-8c41-73968a275e65","895b602a-16be-4df6-866e-5f2230dda9e3"],"type":"Security Question","title":"Interoperability and portability","description":"Which standards make the cloud service portable and interoperable?"},{"id":"84dbf8d7-29a7-4b44-87d9-7daec4e67b93","position":10,"opportunities":["db1a4e7d-70d4-4af5-9c20-512027d8886b"],"risks":["b9a06da1-a28c-4533-a118-0f9995592896","a13c63c9-b412-4781-85dd-ad2cd6382d03"],"type":"Security Question","title":"Scaling, sizing and costs","description":"How do you handle increase of usage or peaks, and what are the corresponding costs?"},{"id":"9a28bb5c-4fc3-4c23-9e73-bc386be221f5","position":11,"opportunities":[],"risks":["eef4a5ce-6fc5-4266-ab98-dd942254f582"],"type":"Security Question","title":"Compliance with national/foreign legislation","description":"Which national legislation is applicable and which foreign jurisdictions are involved, for instance due to the physical location of datacentres or cables?"}]}

Choose use case scenario to demo the tool

Scenario 1: SME using SaaS

ConsultLess is a small consultancy firm in the EU that has 20 employees (mostly legal and management experts). One of the employees is partner and also the Chief Information Officer (CIO) of the firm. Occasionally the CIO pays consultants for IT advice or support. ConsultLess decides to procure office software as a service (SaaS) for use by its employees: the cloud service offers document storage/editing, email and calendar. This cloud service should replace an internal mail-server and office software installed on computers.

In this scenario the security tasks which will be carried out by the cloud provider are:

Managing of hardware and facilities, including physical security, power, cooling, etc.;
Managing of server operating systems and the application server, including development, deployment, patching, updating, monitoring, checking logs, etc. For example, it is the responsibility of the provider to patch the server operating systems in time;
Managing the application software, including development, patching, updating, monitoring, and checking logs, and so on. For example, it is the responsibility of the provider to fix software flaws in the office software;
Managing updates of software and data.

The customer, ConsultLess, is merely responsible for handing out accounts to its employees, revoking accounts when employees leave, resetting passwords, etc.

Most security tasks are outsourced to the provider. The customer, once the service has been procured and is up and running, will have few security tasks left to perform. It should be stressed that the responsibility for security cannot be “outsourced”. If something goes wrong with the office software ConsultLess has procured, causing sensitive data about its clients to leak, then ConsultLess will in the first place be held responsible for the damages. For ConsultLess, hence, clarity about security tasks and responsibilities is a crucial consideration in the procurement process.

Scenario 2: SME using IaaS/PaaS

EasyAgriSelling is a small tech start-up in the EU, which developed an online web shop software (as a service) for farmers who would like to start direct-selling their vegetables and other products. Their slogan is: “Selling your agricultural produce to consumers, made easy”. Farmers can set up an online shop in a few clicks - customizing their shop with a logo, colours and a description of their farm.

EasyAgriSelling operates a pay-as-you-go model, charging no monthly fee, but only charging their customers when products are sold. EasyAgriSelling is a SaaS provider and they are a cloud services customer building services on a cloud provider who offers them IaaS and PaaS on which to build their product. he SaaS platform runs on top of the IaaS/PaaS platform.

EasyAgriSelling is a customer of an IaaS/PaaS service which it uses for running its web shop software for farmers.

In this setting the security tasks the IaaS/PaaS provider carries out are:

Managing hardware and facilities, including physical security, power, cooling, etc.;
Managing the server operating systems and the application server, including development, deployment, patching, updating, monitoring, checking logs, and so on. For example, it is the responsibility of the provider to patch the server operating systems in time.

EasyAgriSelling, the customer, remains responsible for:

Managing the application software, including development, patching, updating, monitoring, and checking logs, and so on. For example, it is the responsibility of EasyAgriSelling to fix software flaws in the deployed web shop software;
Managing the accounts of the farmers using their web shop software, as well as the consumer accounts, including resetting passwords, troubleshooting issues with payments etc.;
Managing backups of application software and data.

Some security tasks are outsourced to the provider, but many security tasks still have to be carried out by the customer (EasyAgriSelling). Security considerations in the procurement process really only regard security of the facilities, the operating system and the application servers which are under control of the provider.

Opportunities

As every SME is different, not all of these security opportunities to cloud services are as important for all of you. This tool enables you to select the rating or ranking of the opportunities most relevant to you as an SME using the following scale:

Small opportunity: As an SME you could exploit this opportunity, but benefits would be limited.
Medium opportunity: As an SME you should exploit this opportunity, because benefits would be significant.
Large opportunity: As an SME you must exploit this opportunity, as there would be crucial benefits.

ID	Title / Description	Opportunity	Rating	Explanation
{{ 'O' + (opportunity.position + 1) }}	{{ opportunity.title }} {{ opportunity.description }}

Risks

Applicable	ID	Title	Impact
	{{ 'R' + (risk.position + 1) }}	{{ risk.title }} {{ risk.description }}
1 = Low, 5 = High
			Major Significant Minor High impact, low probability

Security Questions

ID	Title / Description	Opportunities	Risks	Relevant information
{{ 'SQ' + (sec_q.position + 1)}}	{{ sec_q.title }} {{ sec_q.description }}

Choose use case scenario to demo the tool

Scenario 1: SME using SaaS

Scenario 2: SME using IaaS/PaaS

Opportunities

{{ 'O' + (opportunity.position + 1) }}

{{ opportunity.title }}

Risks

{{ 'R' + (risk.position + 1) }}

{{ risk.title }}

Security Questions

{{ 'SQ' + (sec_q.position + 1)}}

{{ sec_q.title }}