Great articles on other sites
- iiNet founder Michael Malone finally backs TPG Telecom takeover
- How and why the public sector must make friends with artificial intelligence
- Second anniversary of IT pricing report approaches - Computerworld
- Doctors spend 15 mins opening Fiona Stanley Hospital software
- What to expect from Abbott's national cyber security strategy
- ISPs need more time for data retention compliance
- TPG iiNet bid: major shareholders complain
- Qld emergency services payroll replacement on the rocks
- Victoria to wait another eight months for public IT dashboard
- Superloop CEO slams Australian govt tech policies
Renai's other site: Sci-fi + fantasy book news and reviews
- Kim Stanley Robinson’s new book Aurora is due in July
- What’s the future of “Grimdark” fantasy?
- An epic rant from Richard Morgan about nuance in writing
- Brandon Sanderson’s Firefight: Review
- Get into Jeff VanderMeer’s head as he writes the Southern Reach trilogy
- George R. R. Martin’s next book The Winds of Winter won’t arrive in 2015
- Alastair Reynolds’ Poseidon’s Wake launches 16 April
- Ann Leckie’s Ancillary Sword: Review
- Ann Leckie finishes Ancillary Mercy
- Hannu Rajaniemi’s The Fractal Prince: Review
Enterprise IT, Sponsored Posts - Written by External Contributor on Tuesday, March 26, 2013 9:43 - 3 Comments
Assessing risk in cloud computing projects:
A free framework [sponsored post]
This article is a sponsored post by Microsoft Australia chief technology officer Greg Stone. Click here to download a free copy of Microsoft’s Cloud Risk Decision Framework.
sponsored post When many people come up against the term “risk” in the context of IT projects, they immediately reach for the telephone to call for their IT security experts. Risk, to many people, means the risk of data loss; in this sense, focusing on security has often been a logical proxy for more comprehensive IT risk management strategies.
However, the moves which many organisations are currently undertaking as they embrace cloud computing technologies for substantial cost reductions, performance improvements and greater scalability in their IT operations have made many IT professionals aware that such definitions of risk are not always comprehensive enough to meet their needs.
The fundamental promise of cloud computing technology is that it allows organisations to externalise many of the resources previously managed within their own operations. However, unlike traditional outsourcing, which has typically been provided by one or multiple suppliers, cloud computing involves a broad range of suppliers whose varying approaches to security, governance, resilience, availability and privacy create a level of uncertainty for organisations. This creates perceived risk.
Risk management is defined in the ISO 31000 international standard as “the effect of uncertainty on objectives”; therefore externalising IT resources via the cloud changes the risk profile for the workload and organisation. This demands a formalised approach to understanding and addressing the risk when considering a cloud-based option.
It is critical for an organisation to make a balanced assessment of this risk, because doing nothing may pose the greatest risk of all. And yet, currently, many organisations are ill-prepared to identify and weigh-up the risk landscape associated with a cloud option. With this in mind, Microsoft has developed a Cloud Risk Decision Framework; a set of tools designed to help organisations identify, analyse, assess and determine potential risk and solutions associated with deployments of cloud computing technologies.
Right now you’re probably thinking that The Cloud Risk Decision Framework is just another vendor-focused tool designed to get you to adopt Microsoft technologies. Somewhere in this document – probably just when you least expect it! – is a big fat promotion for Windows Azure, right? Or Office 365? Wrong ;)
This guide has been designed to assist IT and non-IT individuals to evaluate potential cloud-based IT capability, from a vendor-neutral standpoint. It aids the user in evaluating risk, no matter which brand of cloud computing solution you might be evaluating. No additional training should be required as this guide provides a well-structured process that should be easily followed by a competent business practitioner.
What’s more, it’s not intended to replace a comprehensive Enterprise Risk Management practice within an organisation. The Cloud Risk Decision Framework serves as support in the decision-making process as per the Risk Management best practice guidance outlined in the ISO31000 international standard.
The Cloud Risk Decision Framework in practice
Let’s go into an example of how The Cloud Risk Decision Framework can apply in practice, using the fictional example of a government department known as the Department of Citizen Engagement (DoCE).
The IT division of the department supports the IT needs of DoCE, as well as several other agencies and departments; not an uncommon situation in government, where large departments often support smaller ones. However, the number of staff being supported has increased steadily over the years. This has driven a situation where meeting load requirements has become more challenging, at the same time as in-house expertise has become more pressured for time and budget pressures have made themselves known. And of course there are ongoing concerns about IT security in a climate where external threats are growing.
The use of cloud computing technologies is one option to tackle this situation. However, it’s not an easy decision: Some of the supported agencies have stringent regulatory requirements they need to comply with, especially relating to data use and classification.
Using The Cloud Risk Decision Framework, the first task for DoCE would be establishing the scope for the potential cloud computing project. In this case, it consists of the core messaging system, identity and access systems supporting the messaging system, relevant devices accessing the messaging system (including, for example, smartphones and tablets) and business processes which touch on the messaging system.
Some time would then spent on agreeing on definitions regarding the impact and likelihood of various types of risks. For example, if a low risk eventuated, it might be able to be easily absorbed by normal business operations on the day concerned, while a severe risk, if it eventuated, might result in serious (but not complete) damage to assets of the department or its reputation. It’s important also at this stage that the diverse stakeholders in the project become involved in further analysis – including technical staff such as a representative from the department’s IT security team and its CIO, but also representatives from the department’s finance, legal and operations divisions, for example.
The next stage of the project would involve identifying the risks inherent in the department’s current system. This step can be crucial, as it can reveal some critical risks in the existing environment which might not be widely known, or be perceived as benign when they are actually more serious.
After that, DoCE would be able to evaluate the risks involved with using a public cloud computing platform as a replacement option, for example, and compare them with the risks involved in maintaining its currently platform. The same process can be applied to several specific cloud computing solutions in more detail to compare risks between different solutions.
What the department would end up with from this process was four major categories of risk (compliance, strategic, operational and market & finance), cross-linked with the likelihood of those risks eventuating. This would then flow into conclusions about which risks could be reasonably managed, and which couldn’t, and a comparison of the risks inherent in staying with their current platform, compared with the risks involved in migrating.
The last several steps in DoCE’s process would involve treating risks with risk mitigation strategies – for example, by implementing a hybrid cloud email system which would make some use of public cloud infrastructure while retaining in-house control over some sensitive accounts – and then producing a formal report which can be presented to the department’s executive council.
This may, or may not, result in an immediate decision to proceed with the project – but it may allow high-level decision-makers to authorise further in-depth investigation of the various options. The initial risk assessment conducted through the use of The Cloud Risk Decision Framework would then form a ‘launching point’ for further research.
You can see from this example that a department like DoCE would have had quite sensible fears about migrating its core messaging platform to a cloud computing solution. But here’s the thing about fear: When it’s broken down in its constituent parts and analysed, it starts to seem manageable, rather than unsurmountable. This is what The Cloud Risk Decision Framework is all about – building in a needed level of discipline amongst professional buyers of IT products and services. In the process, risk management turns from being an impediment to IT projects proceeding to an enabler of positive, considered change. And I think we can all agree that’s a very good thing.
News, Policy + Politics - Aug 4, 2015 16:12 - 21 Comments
More In Policy + Politics
- Sorry, ATO: The Senate hearts Bitcoin as a currency
- Foxtel is about to go after The Pirate Bay
- Turnbull’s NBN hiring spree is pure election fodder
- nbn project to hire 4,500 more staff
- Google ploughs $1m into Australian tech education
Enterprise IT, News - Aug 3, 2015 16:03 - 5 Comments
More In Enterprise IT
- [ad] Tatts Group optimises business performance with StruxureWare software
- Legacy health software lands SA Govt in court
- Microsoft wants to win you back with Windows 10
- Qld Govt Depts have no disaster recovery plan
- ASD releases Windows 8 hardening guide
More In Industry
- Uber takes ATO to court over GST
- SkyMesh offers symmetric 100/100Mbps NBN
- ICAC to investigate NSW TAFE ICT manager
- iiNet shareholders vote ‘yes’ for TPG buyout
- iiNet chairman “proud” as TPG sell-out looms
Consumer Tech, News - Jul 29, 2015 17:14 - 11 Comments
More In Consumer Tech
- Older Australians embracing video games
- Gasp … Qld will fuel electric vehicle charging stations with solar
- Oops … Tesla enthusiast charges car on Qld windfarm
- Netflix Australia: Review
- RAC builds electric vehicle highway in WA