Applying BMIS to Cloud Security

Abstract

Recent developments in information technology operations have shown two distinct trends. Firstly, products and services have become increasingly commoditised, thus leading to successive waves of outsourcing and offshoring. Secondly, the introduction of intelligent end-point devices and direct accessibility of webbased services has blurred the boundaries of traditional companies and their perimeter. As a result, the “cloud computing” paradigm creates new challenges for security management, including the business value and cost-benefit considerations.

Traditional security models often fail to address this new universe, inasmuch as they are based upon the axiomatic idea of a “closed” corporate IT environment. Practical difficulties in outsourcing or third-party situations are therefore, at best, treated as a business issue that is addressed at the contractual or legal level. In many instances, this causes legal and technical problems, as service level agreements and contracts are flawed instruments for describing a fully de-perimeterised IT environment and its practical requirements. This in turn increases the risk of systemic failures, operational damage, and legal ramifications.

The ISACA Business Model for Information Security (BMIS) provides a systemic foundation for managing cloud-based products and services in terms of their security aspects. The paper shows how the general model is applied and how the use of BMIS enhances the overall security level. It is further shown how aspects of governance, risk and compliance (GRC) may be included in order to align operational information security management with business requirements. The paper addresses practical steps towards securing a heavily clouded environment using recognised frameworks such as COBIT or the ISO 27000 series. Recommendations are given to enable direct use of the BMIS in day-to-day security management.