INTERNAL AUDIT AND CLOUD INFORMATION SECURITY

Анотація

In the past decade more and more companies moving their operations to the Cloud. In each case the reason for this decision is different: some are looking for a better ability to streamline the company processes and workloads and gain more robust organization flexibility. Others are after faster applications deployment and an ability to expand in different business areas. On the other hand, some companies just want to standardize their IT-capabilities by providing more unified software solutions across the enterprise. However, there are a few common grounds between all of these companies in their decisions. First, they want to cut cost (on technology infrastructure as well as software licensing). Secondly, they want to become less dependent on the delivery platform at the same time as get easier adaptable to changes in the IT-environments. Third, they want to get closer to their customers by providing new services and marketing programs at the same time as getting that done more efficient and cheaper. Fourth, these companies want to change their capital investment structure by reducing the cost structure. The number of benefits for the companies moving to the Cloud is endless; however, the potential security cost increases significantly as well. By moving to the Cloud, the companies losing one of their most valuable assets: ability to control their underlined infrastructure and create self-governed environments. On the Cloud this responsibility will be fully delegated to the Cloud service provided. In most instances, the space on the Cloud servers will need to be shared across multiple non-related companies, where some of them might have different standard of internal security and create extra, unnecessary traffic to the shared servers. That unrelated traffic might slow down all renters located on this Cloud server. Finally, the companies will expose their data to outside world as never before. That can create an opportunity to the malicious individuals to steal and compromise the information. Without adequate security protocols, established intrusion detection mechanisms, and full understanding of possible risks, decision to move to the Cloud should not be made. But even after the decision is reached, a search for the Cloud service vendor must be done in the very meticulous way. A common determination what data to put on the Cloud and what not must be accepted and verified on all technical and business levels of the company. And finally, an appropriate level of the data security and encryption must be established and enforced. This article will review risks and benefits of the decision to move to the Cloud in more details and address some aspects that companies need to take into consideration before making such type of move.

Класифікація

Ідентифікатори

Схожі роботи