Auditing Hybrid IT Environments

Transcription

1 Audtng Hybrd IT Envronments Georgana Mateesu Computer Sene and Automat Control Faulty Polytehn Unversty of Buharest Buharest, Romana Marus Vlădesu Computer Sene and Automat Control Faulty Polytehn Unversty of Buharest Buharest, Romana Abstrat Ths paper presents a personal approah of audtng the hybrd IT envronments onsstng n both on premse and on demand serves and systems. The analyss s performed from both safety and proftablty perspetves and t ams to offer to strategy, tehnal and busness teams a representaton of the value added by the loud wthn the ompany s portfolo. Startng from the mportane of the IT Governane n the atual busness envronments, we presented n the frst seton the man prnples that drve the tehnology strategy n order to maxmze the value added by IT assets n the busness produts. Seton two summarzes the framewors leveraged by our approah n order to mplement the safety and proftablty omputaton algorthms desrbed n the thrd seton. The paper onludes wth benefts of our personal framewors and presents the future developments. Keywords audt loud omputng; loud serve safety; loud governane I. INTRODUCTION Nowadays, the ompanes must ontnuously provde effent nnovaton strateges, by mang the IT envronment more agle n order to support radal hanges on the busness proess and nformaton flows due to the eonom nstablty and permanent hanges n the maret. Together wth the requrements of flexblty, salablty and elastty, the IT envronment mandates a new dmenson that should ensure proper management of hange and effent operatons on both exstng and new IT assets. The tehnology manfests a trend of mgratng from spealzed systems to dedated serves, beomng more and more platform ndependent n order to get the maxmum value from the nformaton tehnology. Ths s how n 2003, a new onept was bult IT Governane that amed to put together all the onepts, defntons, proesses, proedures and methodologes that, by reassemblng them nto a ommon framewor, are able to mplements IT programs to delver hgh proftablty n the busness dmenson. Enterprse governane of IT (EGIT) represents the oneptual and pragmat defnton and mplementaton of proesses, strutures and relatonal mehansms that enable both busness and IT people to exeute ther responsbltes n support of busness/it algnment and the reaton of busness value from IT-enabled busness nvestments [1]. The sx prnples that defne the Enterprse Governane of IT are [2]: 1) Responsblty ths prnple refers to the people and the groups of people wthn the ompany that must be aware of ther responsbltes regardng the supply of and demand for IT. Also, ths prnple supposes that those wth responsblty for atons also have the authorty to perform those atons. 2) Strategy The organzaton's busness strategy onsders the urrent apabltes of IT, the value delvered by the nformaton tehnology as related to the programs mplemented and tres to address the busness needs n the ongong and future ntatves. 3) Aquston IT aqustons are made for vald reasons, on the bass of approprate and ongong analyss, wth lear and transparent deson mang based on pratal busness ases that demonstrate a proper balane between benefts, opportuntes, osts, and rss, n both the short term and the long term. 4) Performane IT s able to support the organzaton, by provdng the serves, levels of serve and serve qualty that meet urrent and future busness requrements. 5) Conformane IT omples wth all mandatory legslatons and regulatons. Poles and prates are learly defned, mplemented and enfored. 6) Human Behavor IT poles, prates and desons demonstrate respet for Human Behavor, nludng the urrent and evolvng needs of all the 'people n the proess'. In order to assess orretly the IT Governane, a proper audt proess must be onduted that, startng from mature evaluaton framewors, analyses the spef ompany and offers a value of the IT Governane level. In ths paper we propose an effent methodology to audt the hybrd IT envronments that onsst n both on premse and on demand systems, n order to evaluate the level of the loud serve safety and ts proftablty. Startng from two exstng framewors presented n Seton II, we desrbe our personal approah n the thrds seton of the paper. The paper onludes wth the benefts of our approah and future wors. II. AUDITING IT GOVERNANCE FRAMEWORKS There are a lot of framewors that evaluate the governane and the effeny of IT envronments from dfferent perspetves, one of them s defned n [14]. In our approah, we want to offer a methodology of assessng the safety of the loud serve and ts proftablty. In order to do that, we start from the Cloud Seurty Allane seurty model and, for eah of the domans defned n [3] we spefed seurty ontrols. The seurty ontrols ompose the audt questonnare. The audt proess evaluates the ontrol mehansms usng an 1 P a g e

2 algorthm based on the maturty level provded by COBIT. In ths seton, we made a summary of the man haratersts of the framewors and standards leveraged by our approah. A. CSA Seurty Model Aordng to [3] the level of seurty measures wthn an organzaton s haraterzed by the maturty, effetveness, and ompleteness of the rs-adjusted seurty ontrols mplemented. These ontrols are mplemented n one or more layers rangng from the faltes (physal seurty), to the networ nfrastruture (networ seurty), to the IT systems (system seurty), all the way to the nformaton and applatons (applaton seurty). Cloud Seurty Allane ategorzes seurty domans as presented n Table 1. TABLE I. Doman Governane and Enterprse Rs Management Legal Issues: Contrats and Eletron Dsovery Complane and Audt Informaton Management and Data Seurty Portablty and Interoperablty Tradtonal Seurty, Busness Contnuty and Dsaster Reovery Data Center Operatons Indent Response, Notfaton and Remedaton Applaton Seurty Enrypton and Key Management Identty and Aess Management Vrtualzaton Seurty as a Serve : CLOUD COMPUTING SECURITY DOMAINS Desrpton The ablty to govern and measure rs ntrodued by loud omputng Seurty breah dslosure law Evaluate how loud affets omplane Managng data stored n loud The ablty to move data from a loud provder to another How loud affets the urrent seurty proedures How to evaluate provder s data enter arhteture and operatons Proper ndent deteton, response, notfaton and remedaton Seurng applaton that runs on dfferent loud deployment model Identfy proper ey usage and ey management Cloud-based IdEA (Identty, Enttlement and Aess Management) Rs assoated wth VM solaton, VM o-resdene Thrd party seurty assurane nludng ndent management and omplane attestaton Startng from ths seurty domans lassfaton for the loud models [19], we defned for eah of the areas mentoned n the table above, the requred ontrols that lower the rs assoated wth the doman. Ths researh atvty was performed based on exstng loud prate and tradtonal seurty measures and onluded n the defnton of most relevant mehansms and proedures that must be evaluated durng an audt proess. In order to assess the level of onformty and the rs assoated wth the la of mature mplementaton of the mehansms, we used the apablty model defned by COBIT. B. COBIT COBIT (Control Objetves for Informaton and Related Tehnology) [4] represents the framewor mplemented by ISACA n order to defne the envronment of a ompany that defnes governane and management of enterprse IT from both busness and management perspetve. Ths framewor s based on fve prnples: 1) Meetng Staeholder Needs ths prnple desrbes the COBIT objetves from IT requrements perspetve that must fulfll the busness needs. 2) Coverng the Enterprse End-to-End ths prnple desrbes the approah used n ths framewor to address all the aspets related to IT omponents management and governane by relatng them wth the exstng busness proesses and nformaton flows. 3) Applyng Sngle Integrated Framewor ths prnple desrbes the sope of COBIT to nlude all the funtons and proess that exsts wthn a ompany n a sngle framewor. 4) Enablng a Holst Approah ths prnple presents the IT Governane and Management n s systemat way by ontrollng them wth a gener model proposed by ISACA. Ths model s drven by IT enablers that address all the exstng resoures and fats that lead to IT governane. 5) Separatng Governane from Management ths prnple desrbes the dfferenes between the two proesses and the mehansm that nteronnets them. Based on these prnples, ISACA buld a apablty model able to evaluate the level of IT governane and management. Ths model onssts of 6 dfferent apablty levels eah ontrol an mplement. The next pture depts the COBIT 5 Capablty model leveraged by our approah: Fg. 1. COBIT Capablty Model [4] Ths apablty level mplements the restrton that eah level an be aheved only after the prevous one was suessfully fulflled. Also, there s a huge dfferene between the proess that s n level 1 and the ones n superor levels beause, one the proess reahed level 1, t means that all the performane attrbutes were aheved. C. Val IT ISACA desrbes n [5] an evaluaton model for the value added to the enterprse by the IT programs. Ths framewor s based on the followng prnples: IT-enabled nvestments wll: 2 P a g e

3 1) Be managed by an nvestment portfolo 2) Inlude all the atvtes requred n order to obtan the busness benefts from the IT program 3) Be managed through ther entre eonomal lfeyle Value delvery prates wll: 4) Reognze there are dfferent ategores of nvestments that wll be evaluated and managed dfferently 5) Defne and montor ey metrs and respond quly to any hanges or devatons 6) Engage all staeholders and assgn approprate aountablty for the delvery of apabltes and the realzaton of busness benefts 7) Be ontnually montored, evaluated and mproved Val IT uses the followng onepts n order to assess the maturty level of an enterprse n mplementng IT programs [5]: Projet A strutured set of atvtes onerned wth delverng a defned apablty to the enterprse based on an agreed-upon shedule and budget Programme A strutured group of nter-dependent projets that are both neessary and suffent to aheve a desred busness outome and reate value.. The nvestment s the prmary unt of nvestment wthn Val IT. Portfolo Groupngs of objets of nterest (nvestment s, IT serves, IT projets, other IT assets or resoures) managed and montored to optmze busness value. The nvestment portfolo s of prmary nterest to Val IT. IT serve, projet, asset or other resoure portfolos are of prmary nterest to COBIT. The maturty evaluaton s mplemented wthn Val IT usng spef proess metrs that analyze the nformaton flows and busness proess from the followng perspetves: Value Governane - the goal of ths doman s to ensure that value management prates are embedded n the enterprse, enablng t to seure optmal value from ts ITenabled nvestments throughout ther full eonom lfe yle. Portfolo Management the goal of ths doman s to ensure that an enterprse seures optmal value aross ts portfolo of IT-enabled nvestments. Investment Management the goal of ths doman s to ensure that the enterprse's ndvdual IT-enabled nvestments ontrbute to optmal value. The pture below depts the Val IT proesses and domans: Fg. 2. Val IT Proesses and Domans In our approah we use ths model n order to determne the level of the enterprse maturty related to the mplementaton of loud pragrammes. Besde COBIT and Val IT, ISACA also ssued a number of papers that desrbe general gudelnes [6] regardng the evaluaton of busness ontnuty and the IT governane wthn loud omputng arhteture [7][8]. Startng from these spealzed opnons, we reated an audt framewor that quantfes the safety level of a loud serve based on the seurty measures mplemented wthn the arhteture analyzed. Durng our assess, we have a seond ndator the proftablty level of the that nvested n the loud serve, whh s omputed based on the maturty level of the ompany s prates used durng the and on the rs manfested by the loud serve, evaluated n the safety seton of the audt. III. PERSONAL APPROACH A. General Approah Our audt methodology s based on questonnares onsstng n seurty measures defned for hybrd TI envronments that ensure a hgh level of safety, governane and operablty wthn the nfrastruture. 3 P a g e

4 These ontrols and lassfed n domans aordng to the gudelnes from [3] presented n the seond seton of ths paper. They address the major aspets of eah doman by analyzng both on premse and on demand spef ontrols and proedures. The audt proess an address one or multple domans wthn one assessment [20]. Eah ontrol s evaluated usng the apablty model of COBIT presented n seton 2 whh represents the referene model n assessng the level of mplementaton of eah seurty mehansm nluded n the audt questonnare. The seurty measures [18] and proedures address both serve provder and onsumer assets. The safety level s omputed aganst an assumed level of rs for eah loud serve and an applaton sensblty: The assumed level of rs has dret mpat n omputng the safety level by addressng the dfferene between the atual level of seurty ontrol mplementaton and the maxmum one The applaton sensblty reflets n the orreton fator nserted n the omputaton of rs, by the prevously mentoned dfferene. After omputng the safety level, we offer an approah that quantfes also the level of onformty wth the CSA [3] best prates and reommendaton. Ths ndator s omputed aganst the assumed rs level that s materalzed n the mnmum safety level that must be met by the doman n order to be lassfed as omplant. One the doman s omplant, the onformty level s omputed based on the safety level. For the omputaton of proftablty level, besde the analyss of the seurty measures realzed usng the approah we defned above, we use Val IT proess measures to assess the level of ompany s maturty n mplementng, governng and operatng the hybrd IT s. The evaluaton that leverages the Val IT framewor uses the 3 domans desrbed n the prevous seton and evaluates the maturty of the metrs nluded n the audt questonnare by omparng estmated maturty level wth the one obtaned after the assessment. The proftablty assessment an be onduted for a sngle or for the entre portfolo. In ase the audt addresses the entre portfolo, the proftablty fator algorthm taes nto onsderaton the rs level of the audted wthn the portfolo, and for the other ones, t omputes the proftablty level by evaluatng only the maturty level. At the end of ths methodology, we present a mehansm to ompute the nternal rate of return of the audt target the portfolo or the addressed durng the audt proess. In the next two setons we present our personal methodology of evaluatng the safety and proftablty level for an assessed loud serve ontrated wthn a hybrd IT envronment. B. Computaton of Safety Level The safety level represents the level of seurty ontrols mplementaton as ompared to the assumed rs defned for the applaton that s been evaluated. In order to ompute the safety level, the audt proess must address the entre audt questonnare for the doman beng evaluated. Based on the responses, we defne the applaton rs as the unertanty rate reported to the loud vulnerabltes from the analyzed seurty doman, materalzed n the mplementaton level of eah ontrol: AR NSA n 1 ( 5 s ) (1) AR s the applaton rs for the evaluated doman NSA s the orreton rs onstant omputed based on the exstng loud ommunty experene. Its value s 0.01 and t s ntrodues for pratal reasons beause there s no doman wth zero rs. s s the mplementaton level for ontrol from the doman s the orreton onstant appled to the rs A defned for the ontrol. Ths onstant depends on the ndustry the target belongs to, and on the senstvty rate of the loud serve. n s the number ontrols beng evaluated n the audt proess Eah loud serve analyzed has assoated wth t the assumed level of rs raned from 1 to 3 1 meanng that the serve should be very seured and 3 meanng that, provdng the type of data and the busness proess and nformaton flows beng mplemented n the loud, the balane between seurty and osts should go on the ost savngs sde. The rs level s defned by the strategy team durng the doumentaton of the busness ase that leads to the mplementaton. The assumed level of rs s evaluated usng the followng expresson: AR ' AR RL n ' A (2) s the assumed rs for the evaluated doman RL s the rs level defned n the busness ase A s the orreton onstant appled to the rs defned for the ontrol. Ths onstant depends on the ndustry the target belongs to, and on the senstvty level of the loud serve. n s the number ontrols beng evaluated n the audt proess Usng the two measures presented above, the safety level s omputed usng the followng expresson: A 4 P a g e

5 AR 5 n(1 ) A ' AR 100 (3) 5n s the safety level for the evaluated doman mn s the mnmum safety level RL s the assumed rs level for the applaton s the onformty onstant and ts value depends on the assumed rs level aordng to the followng table: s the orreton onstant appled to the rs defned A for the ontrol. Ths onstant depends on the ndustry the target belongs to, and on the senstvty level of the loud serve. AR ' s the assumed rs for the evaluated doman AR s the applaton rs for the evaluated doman n s the number ontrols beng evaluated n the audt proess For the senaros when the audt proess evaluates multple domans, the safety level s the arthmet mean of the safety levels of the ndvdual domans: n 1 (4) n s the safety level of the audt proess s the safety level for the evaluated doman n s the number of domans n sope for the audt proess. Based on the safety level and on the assumed rs level, the onformty level s omputed usng the followng expresson: CL 1 ( 1) mn ( mn ) (5) 2 CL s the omplane level for the evaluated doman mn s the safety level for the evaluated doman s the omplane fator that ensure that the omplane level s zero f the mnmum safety level s not reahed. Ths fator s omputed usng the followng expresson: 1, 2, mn mn (6) mn s the mnmum safety level that must be obtaned by a doman n order to be omplant and t s omputed based on the assumed level of rs: mn 1 RL (7) TABLE II. CONFORMITY CONSTANT VALUES Rs Level = RL Conformty Constant = The onformty level s the measure of the seurty and governane measures and ontrols mplementaton wthn the audt arhteture evaluated aganst the best prates reommended by the standards used as referenes when we defned the audt framewor. Therefore the two levels omputed by our approah n the safety seton of the audt proess, offer a realst vew of the ontrated loud serve by analyzng the entre ntegraton ontext. Our methodology analyzes loud provder and onsumer ontrols n order to evaluate the level of performane, governane, rs, management and operaton of the IT doman by nludng n the audt questonnare assets from both partes. C. Computaton of Proftablty Level The proftablty level represents the rate of aptalzaton of the fnanal nvestments engaged for a. In order to ompute the proftablty level, our approah starts from the maturty level of evaluated usng spef proess metrs. All the proesses and flows metrs are lassfed nto the Val IT spef domans and address the followng tops: Level of leadershp agreement on value governane prnples Level of leadershp engagement Degree of mplementaton and omplane wth value management proesses Level of satsfaton wth IT's ontrbuton to busness value Perentage of IT expendtures that have dret traeablty to busness strategy Perentage nrease n portfolo value over tme New deas per nvestment ategory, and perentage that are developed nto detaled busness ases Completeness and omplane of busness ases (ntal and updated) Perentage of expeted value realse 5 P a g e

6 After the audt proess assesses all the audt questonnare tems, the maturty sore s omputed: m ms MS 1 (8) m MS s the maturty sore of the beng analyzed ms s the maturty sore of the metr m s the total number of metrs that are evaluated durng the audt proess Usng the maturty sore omputed usng (8) and the expeted maturty level defned wthn the busness ase of the audted, we defned the ndator of ahevement: MS a 100 (9) ML a s the ndator of ahevement of the analyzed MS s the maturty sore of the beng analyzed ML s the expeted maturty level defned for the beng analyzed Based on the ahevement ndator, we ompute the underperformane ndex: j 1 ( 1) u (1 a ) (10) 2 u s the underperformane ndex of the a s the ndator of ahevement of the analyzed f s the ompleton fator of the : f f 2, a 1 1, a 1 (11) s the ompleton fator of the a s the ndator of ahevement of the analyzed The underperformane ndex has dret mpat on the update rate used to ompute the Net Present Value whh lassfes an nvestment as beng proftable or not. The update rate s the method that provdes a measure to the omparson between the eonomal parameters and fnanal ndators aomplshed n dfferent perods of tme allowng n ths way the lassfaton of the program/nvestment as proftable. In order to ompute the update rate n the hybrd IT envronments audt proess we use the followng expresson: u f ( u,, R) r (12) ur s the update rate used n order to ompute the proftablty of the u s the underperformane ndex of the analyzed s the ost of the nvestment n the R s the rs ndator assoated wth the loud serve mplemented n the analyzed For the audt proesses that address the entre portfolo, wthout assessng the safety evaluaton for the all the s, the update rate s omputed as the arthmet mean of the updates rates of all the s. If the was not assessed for safety, the update rate s omputed usng the expresson: u r u (13) ur s the update rate used n order to ompute the proftablty of the u s the underperformane ndex of the analyzed s the ost of the nvestment n the For the s where the safety evaluaton was onduted, the update rate s: u r u R (14) ur s the update rate used n order to ompute the proftablty of the u s the underperformane ndex of the analyzed s the ost of the nvestment n the R s the rs ndator assoated wth the loud serve mplemented n the analyzed The rs ndator s the arthmet mean of the rss assoated wth all the domans beng addressed by the safety assessment: 6 P a g e

7 R n 1 1 (15) n R s the rs ndator assoated wth the loud serve mplemented n the analyzed program s the safety level for the evaluated doman n s the number of domans n sope for the audt proess The Net Present Value (NPV) represents an nvestment evaluaton method that s dependent on the total amount of osts and nomes for a. NPV maes omparsons between ash flow of the program and nvestment effort nvolved n dong so. The formula for alulatng ths s: NPV (16) I T C T NPV s Net Present Value of the IT CT s the total nome s the total ost The total nome s defned by: I T I T s the total nome I y E 1 (1 ur ) (17) I E s the estmated nome for year ur s the update rate y s number of years the lasts The total osts are omputed based on: Intal nvestments Operatonal osts durng the The perod The update rate C T C T TI s the total ost C y O 1 (1 ur ) (18) TI s total nvestment n the ur s the update rate y s number of years the lasts Consderng (17) and (18), the NPV s: y y I E CO NPV ( TI ) (19) 1 u ) (1 u ) 1 ( r 1 For the audt proesses that address the entre portfolo, the NPV s omputed for eah the portfolo ontans. In ths way we are able to assess the proftablty of eah of the portfolo omponents. In order to evaluate the overall proftablty, the update rate for the portfolo NPV s omputed usng the mean update rate of all s nluded n the portfolo. Based on NPV, we defned the proftablty level as: 0, NPV 0 1, NPV 0 PL (20) PL s the proftablty level NPV s Net Present Value of the In order to determne the proftablty level of the portfolo we use the same expresson, but the update rate s omputed by onsderng the ndvdual update rates for eah wth the portfolo. In order to evaluate another spef eonom fator, the nternal rate of return, we use the followng expresson: NPV IRR ur ( ur ur ) mn max mn NPV NPV IRR s the nternal rate of return r (21) u r mn s the mnmum update rate ths rate ensures a postve NPV whh lassfes the nvestment as proftable u r max s the maxmum update rate ths rate ensures a negatve NPV NPV s the postve Net Present Value of the ths value lassfes the nvestment as proftable NPV s the negatve Net Present Value of the In order to ompute the requred measures for the nternal rate of return, we use the followng algorthms: C O s the operaton ost for year 7 P a g e

8 Fg. 3. Algorthm to ompute IRR measures f the audted NPV s poztve The pture above depts the method used to fnd the measures requred n order to ompute the nternal rate of return f, after ondutng the proftablty audt aordng to the methodology we proposed, the result of NPV s postve. The pture below depts the method used to fnd the measures requred n order to ompute the nternal rate of return f, after ondutng the proftablty audt aordng to the methodology we proposed, the result of NPV s negatve. Usually, n ths senaro, the IRR obtaned wll be less than the one expeted by the nvestors provdng that a negatve NPV durng the audt hghlghts a la of proftablty for that. In these senaros a deep analyss must be performed n order to see f the rss and maturty levels assessed durng the audt must be fne-tuned whh means the expetatons for the were not properly set, or f the dd not reah the maturty expeted and ts seurty and governane mehansms and ontrols do not prove enough apabltes. Fg. 4. Algorthm to ompute IRR measures f the audted NPV s negatve In ths seton we presented an effent mehansm of eonomal rates evaluaton by onsderng durng the analyss both fnanal and tehnal aspets from the IT beng assessed. In ths way we offered a relevant representaton of the ontrated loud serve for both tehnal and non-tehnal representatves from ompany beng evaluated. We managed wth our approah to translate the seurty measures and proedures n busness fgures able to lassfy the nvestment as proftable or not. Also, based on the Val IT maturty level leveraged n our framewor, we measured the governane and management apabltes of the ompany n operatng the analyzed IT asset. Ths offers an mportant deson support for the strategy team regardng the development dreton and new loud adopton roadmap. 8 P a g e

9 IV. CONCLUSIONS The nformaton seurty and nowledge proftablty are some the most mportant aspets wthn an organzaton that ensure busness ontnuty and mnmzaton of rs [13]. Ther maxmum benefts an be aheved by leveragng the IT assets apabltes n order to ensure data avalablty, busness proess and nformaton flow hgh performane, senstve data proteton and busness aglty. All these haratersts an be obtaned only f the ompany mplements a proper IT governane and effent management and operatonal proesses and proedures. A proper IT Governane strategy ensures the followng benefts [9]: Cost reduton; Performane mprovement; Ablty to reat quly to maret hanges; Inreased ustomer satsfaton; More sustanable prates; Inreased revenue per dollar ost; General worplae benefts for the board, management and staff. By ombnng tehnal aspets [10] [12] dvded nto man seurty drvers wth governane and operatons related fators, our approah offers a full evaluaton analyss of loud system that quantfes the overall safety of the loud safety [11] from both tehnologal and operatonal perspetve. In ths way, the audt proess an be a ey deson support for the IT strategy roadmap. After the safety evaluaton, we mplemented a methodology to quantfy the proftablty of the IT that mplemented the loud serve, offerng n ths way an eonomal representaton of the serve rs related to the operatonal, governane and seurty aspets analyzed durng the frst step of the audt proess. Our approah offers the followng benefts: Quantfes the safety sore based on seurty measures and ontrols that are omplant wth loud standards by omparng the mplementaton rate of ey seurty ontrols wth the assumed rsed for the loud serve. In ths way we managed to mplement an effent algorthm that taes nto onsderaton all ey ontextual fators from the loud serve mplementaton and adopton proess. Measures the onformty level for the standards used as referene n defnng the audt framewor. The man standard leveraged s the CSA Seurty model [3], but when we defned the spef ontrols to be evaluated, we nluded the best prate and state of the art of the seurty measures mplemented n the tradtonal arhteture and adopted also by the loud ommunty. Computes the onformty level based on the assumed rs and t s evaluated on eah analyzed doman, emphaszng n ths way the domans that requre mprovement [17]. Offers an effent methodology for omplex analyss that shows strengths and weanesses of the analyzed loud serve [16] n the enterprse arhteture [18] Offers deson support for future loud adopton by evaluatng the rate of ompany maturty and adaptablty to hange by assessng the entre sta of mehansms, ontrols, proess and proedures defned wthn the ompany n order to obtan an effent governane and management proess. By usng as a referene model an nternatonal standard, we ensure that the prnpals, best prates and mature reommendatons are part of the audt proess. Also, by leveragng an exstng framewor for ntal assessment of the mplementaton level, we obtan all the benefts of a framewor that proved ts value durng the experene. Offers a busness relevant measures of the IT assets, by quantfyng the proftablty level of the based on the loud serve rs Offers a fnanal overvew of the IT that mplements the loud serve whh an be used as deson support for future IT nnovaton strateges Assesses the level of the organzaton adaptablty to the new trend of loud omputng Assesses the maturty and effeny of the exstng governane and management proedures for the new type of IT envronment: the loud omputng arhteture Assesses the ntegraton between on premse and on demand systems by evaluatng ey seurty fators. Ths s possble due to the holst representaton of the audt proess that assesses the ontrol measures on doman bass. By provdng all the advantages mentoned above, our methodology helps the ompany gan vsblty on ther own IT envronment by evaluatng the governane, management and operatons maturty levels usng a holst approah together wth the seurty aspets [15]. Ths approah suffers permanent hanges as the loud prate eeps on ganng more and more maturty and adopters. Consderng ths, our set of ontrols must be permanently updated and adapted on the spefty of the system and busness proesses beng analyzed. In order to optmze our evaluaton method, we want to fne tune the seurty measures beng assessed by spealzng the audt proess based on ndustres and types of ompanes. In ths way we an evaluate partular ontrols mposed by spef standards and regulatons. Other mprovement would onsst n leveragng the approah for loud provders spef envronments, n order to offer a measure of the provder tself nstead of addressng the loud serve n the onsumer ontext. 9 P a g e

10 REFERENCES [1] Wm Van Grembergen and Steven De Haes, Busness Strategy and Applatons n Enterprse IT Governane, 2012, IGI Global ISBN: [2] Wm Van Grembergen, Steven De Haes, Enterprse Governane of Informaton Tehnology: Ahevng Strateg Algnment and Value, 2008, Sprnger ISBN: [3] Cloud Seurty Allane, Seurty Gudane for rtal areas of fous n loud omputng v3.0, [4] ISACA, COBIT 5: A Busness Framewor for the Governane and Management of Enterprse IT, 2012, ISACA ISBN: [5] ISACA, Enterprse Value: Governane of IT Investments: The Val IT Framewor 2.0, Center/Researh/ResearhDelverables/Pages/Val-IT-Framewor- 2.0.aspx, ISACA ISBN: [6] ISACA, Montorng Internal Control Systems and IT: A Prmer for Busness Exeutves, Managers and Audtors on How to Embrae and Advane Best Prates, 2010, ISACA ISBN: [7] ISACA, Busness Contnuty Management Audt/Assurane Program, 2011, ISACA ISBN: [8] ISACA, IT Control Objetves for Cloud Computng: Controls and Assurane n the Cloud, 2011, ISACA ISBN: [9] A. L. Holt, Governane of IT: An Exeutve Gude to ISO/IEC 38500, 2013,BCS,ISBN: [10] Chrs Davs, Me Shller, Kevn Wheeler, IT Audtng: Usng Controls to Protet Informaton Assets, Seond Edton, 2011 MGraw- Hll/Osborne ISBN: [11] Ben Halpert, Audtng Cloud Computng: A Seurty and Prvay Gude, 2011, John Wley & Sons ISBN: [12] Bran J.S. Chee, Curts Franln, Cloud Computng: Tehnologes and Strateges of the Ubqutous Data Center, 2010, Auerbah Publatons ISBN: [13] Kurt J. Engemann and Douglas M. Henderson, Busness Contnuty and Rs Management: Essentals of Organzatonal Reslene, 2012, Rothsten Assoates ISBN: [14] Robert R. Moeller, COSO Enterprse Rs Management: Establshng Effetve Governane, Rs, and Complane, Seond Edton, 2011, John Wley & Sons ISBN: [15] Jatnder N. D. Gupta, Sushl K. Sharma, Handboo of Researh on Informaton Seurty and Assurane, 2009, IGI Global, ISBN: [16] Charles Babo, Management Strateges for the Cloud Revoluton: How Cloud Computng Is Transformng Busness and Why You Can't Afford to Be Left Behnd, 2010, MgGraw-Hll ISBN: [17] Perhuru Raj, Cloud Enterprse Arhteture, 2012, Auerbah Publatons ISBN: [18] Lee Newombe, Seurng Cloud Serves: A Pragmat Approah to Seurty Arhteture n the Cloud, 2012, IT Governane ISBN: [19] Alberto M. Bento, Anl K Aggarwal Cloud Computng Serve and Deployment Models: Layers and Management, 2013, IGI Global ISBN: [20] Tm Mather, Subra Kumaraswany, Shahed Latf, Cloud Seurty and Prvay. An Enterprse Perspetve on Rs and Complane, O Relly Unted States of Amera, frst verson P a g e