Cloud computing – Niel Harper

Cloud Fundamentals Study Guide

April 13, 2021September 16, 2021nielharper

The Information Systems Audit and Control Association (ISACA) just released the ‘Cloud Fundamentals Study Guide’ publication.

“The ‘Cloud Fundamentals Study Guide’ works through each aspect of cloud computing, its characteristics, common decision points, gaps and security vulnerabilities. It helps individuals prepare for the ISACA Fundamentals certificate exams, one of the components of the ISACA Certified in Emerging Technology certification program. I served as an Expert Reviewer on this project.

As a member of ISACA’s Emerging Technology Advisory Group, I served as an Expert Reviewer of this document.

I can’t fully explain the distinct pleasure that I derive from working with so many recognised and respected subject matter experts (SMEs) in the development of this type of content. We owe it to the next generation of IT risk management, audit & assurance, information security, and privacy professionals to provide them with the tools needed to aid their success. This is why we do what we do as ISACA volunteers!

You can access the ‘Cloud Fundamentals Study Guide’ through ISACA’s Bookstore.

Navigating the cloud: SMEs and cloud services

October 26, 2014October 27, 2014nielharper

More and more small businesses are migrating to the cloud and reaping significant benefits like never before. With cloud services, small businesses no longer need to install physical infrastructure like e-mail servers and storage systems, or purchase software applications with exorbitant annual license fees. The “on-demand” availability of cloud solutions means seamless and simple collaboration with customers, business partners, and staff members using nothing more than a web browser. Cloud services also provide entrepreneurs and home-based businesses with access to advanced technology without the requirement to hire a full-time IT specialist.

But what exactly is this “cloud”?

Cloud computing is an overarching term which encompasses a number of different categories. Software-as-a-Service (SaaS) is where a particular application or service is provided to a business or individual as a subscription. Google Drive, QuickBooks Online Plus, and BaseCamp are all popular examples of SaaS.

Using Platform-as-a-Service (PaaS), businesses are provided with a platform on which they can build, install, and maintain customized apps, databases and integrated business unit services. Widely used PaaS include Windows Azure, SharePoint Online, and Google App Engine.

Infrastructure-as-a-Service (IaaS) allows businesses to outsource infrastructure in the form of virtual resources. Components include servers, storage, networking and more. IaaS providers include Rackspace, HP Converged Infrastructure, and Amazon Web Services.

Most small businesses generally don’t need much more than SaaS to meet their operational needs. SaaS provides them with the capabilities to deliver a myriad of IT services that would otherwise be expensive and resource intensive to administer as localized, on-site solutions.

It must however be emphasized that cloud services bring with them a number of security, stability, and data control issues. That is why it is critically important that small businesses stay informed and strictly require that cloud providers furnish them with detailed business continuity plans and security controls to remediate outages and protect sensitive data.

What to do when your cloud brings the rain?

There are a plethora of reasons why cloud computing is popular. It gives small businesses the technology that enables them to be lean, agile, and competitive. But as is quite evident, trusting your information assets to a single entity whose equipment is stored in a centralized location, means that you’re extremely vulnerable to whatever outages, security compromises, or natural disasters that they are exposed to.

So what are small business owners to do? Here are some recommendations that can allow you to better manage the risks associated with cloud providers.

Fine Tune Your SLA: Service level agreements (SLA) should codify the exact parameters and minimum levels of service required by the business, as well as compensation when those service levels are not met. It should assert the ownership of the business’ data stored on the cloud platform, and outline all rights to retaining ownership. It should include the infrastructure and security standards to be adhered to, along with a right to audit for compliance. It should also specify the cost and rights around continuing/discontinuing use of the cloud service.

Keep Critical Data Local: Decide which business processes require maximum uptime, and keep them on-site. Avoiding the cloud totally for specific mission-critical applications, small businesses can minimize data unavailability as well as security and privacy issues. Most definitely some businesses have regulatory requirements to meet, and this ought to be a key consideration when deciding not to ship your data offshore.

Two-Factor Authentication: More and more providers are offering two-factor authentication (2FA) as a means of securing access to cloud services. Two-factor authentication adds a second layer of authentication to user logon credentials. When you have to enter only your username and one password, that’s considered as single-factor authentication. 2FA mandates that users have 2 out of 3 types of credentials before access to cloud resources are granted.

Deploy A Hybrid Configuration: Maintaining a hybrid implementation of cloud and local services is a best practice approach for protecting company data. Replication or archiving solutions often deliver a service with both a local appliance at the customer’s premises and cloud storage too. This type of on-premise-to-cloud replication strategy ensures that you have local copies of the data you transmit to the cloud. Actively seek out cloud providers that can configure this kind of scenario.

Availability, integrity and confidentiality issues will always exist when using IT systems. And when a business employs cloud-based computing, these challenges are even more pronounced. Be extremely meticulous when searching for cloud providers, and question them about their security controls and disaster recovery options. Even though you outsource the processing of your business data; there’s no reason why you should lose control.

Cyber Threats and Security in the Caribbean 2014 Update

March 5, 2014July 10, 2014nielharper

[Exert from a recent interview I did with ICT Pulse on the state of cybersecurity in the Caribbean]

ICT Pulse: Niel, give us a quick recap of what were the most prevalent incidents in Barbados and/or in the region in 2013?
Niel Harper: In 2013, Barbados was subjected to attacks from a number of different threat vectors. Several government agencies, financial institutions and private businesses were the focus of targeted website compromises. Some of the techniques used were distributed denial-of-service (DDoS), cross-site scripting (XSS), and SQL injection attacks. There was also a sophisticated ATM skimming campaign that was perpetrated by Eastern Europeans whereby several commercial banks were targeted. I would like to emphasize that these are the known issues. I am pretty certain that the occurrences and complexity of the attacks were much higher, but as there is no legal requirement to report breaches, we will simply never know.

ICTP: Although we are still early in 2014, how is the threat landscape changing? Are there any particular areas of concerns that you have for Caribbean organisations this year?
NH: The Caribbean will be facing the same evolving threat landscape as the rest of the world. For one, as more companies and individuals in the region move their information to the cloud, we should expect to see more focused attacks on corporate and personal data stored on cloud services. Secondly, we will witness greater adoption of advanced persistent threat (APT) techniques to be used in the distribution of traditional malware. There will be growth in the amount of Android and iOS malware, and the burgeoning use of mobile apps for enterprise applications coupled with increased social media usage will broaden the overall attack surface. Given that Windows XP is still widely deployed across enterprises and on personal computers, the platform will become a huge target for attackers as Microsoft ends support activities. And finally, spam is evolving to a point where it is being employed more and more for malware payloads.

ICTP: At the CARICOM level, there appears to be a growing awareness of cybercrime and calls by leaders that something be done. In your opinion, have there been any improvements in the cyber security-associated resources or support structures in Barbados, and/or perhaps regionally? What might still be missing?
NH: The Government of Barbados has signed a MOU with the ITU to setup a Computer Incident Response Team (CIRT) within the framework of the ITU-IMPACT initiative on strengthening cybersecurity. I believe that this step is a signal of intent by government to improve cyber response capabilities in the country. However, my concern is that the accompanying cybersecurity legislation and the necessary capacity building for personnel is not being addressed in as robust a manner as it needs to be. Jamaica has expanded the capabilities of the Communication Forensic and Cybercrime Unit (CFCU) of the Jamaica Constabulary Force, and has also taken steps to establish a national computer security incident response team (CSIRT). A National Cybersecurity Task Force was also established in 2012. However, what have been missing in Jamaica are large-scale cybersecurity awareness programs to educate key at-risk groups. The Caribbean Telecommunications Union (CTU) has also been doing its part to combat cybercrime region-wide, but there are still a plethora of challenges in numerous countries in terms of adequate resources and funding for cyber security response. Moreover, there is little to no coordination among the cybersecurity entities in place across the CARICOM footprint. This prevents the region as a whole from jointly benefitting from crucial activities such as threat information sharing, critical infrastructure protection, active defense and incident preparedness.

ICTP: Are you observing any real evidence of a greater willingness among organisations to take cyber/network security more seriously? How is that awareness (or lack thereof) being manifested?
NH: I think there are generally two types of organizations across the CARICOM region: 1) Organizations that by the very nature of their business and the operational and regulatory requirements they are subject to, are compelled to take cybersecurity serious and invest heavily in a strong control framework to effectively mitigate the risks they are confronted with; and 2) Firms or institutions whose management simply does not recognise or understand the high risks which they are faced with as it pertains to cyber attacks and online crime. So what you now have is a situation where there are a handful of companies with very strong cybersecurity capabilities (mostly financial institutions), and a large amount with weak controls as it relates to cyber resilience. All in all, many Caribbean organizations are still facing serious financial constraints, and budgetary planning cycles regularly do not include large expenditures on things like IT security. Monies are spent on more seemingly important corporate interests, although this will likely change as cyber-risks increasingly pose threats to human, social and economic well being and stability.

ICTP: Are there any key areas businesses should be investing their network security/IT dollars this year?
NH: Businesses need to invest their money in personnel with specialized knowledge and expertise in implementing technical solutions, enhancing operational practices and developing effective cybersecurity-related policies. Governments as well as corporations also need to invest in awareness-raising programs around cybersecurity. And more dollars also have to be spent on research, monitoring, reporting, and coordination of responses to cybersecurity incidents.

The full article and interview can be found at: http://tinyurl.com/mlssfll