Cloud Computing - Risk Management Evaluation - For Ultimate_Writer

Section

Completed by:

Completed by:

Date

1. Current Operational Status

2. Privacy Focus

3. Documentation Focus

4. Employee Focus

5. Application Focus

6. Data Focus

7. Identity Management Focus

8. Physical Focus

9. Server Focus

10. Network Focus

11. Cloud Services

12. Third Party Agreements

Version

Date

Author

Summary of changes

1.0

<date>

Author

<changes>

Please select the current operational status of the service being assessed?

Operational (currently in production)

In-Development (being designed, developed, or deployed)

Transition (currently undergoing a major upgrade or transition)

Qualification (Note: Personal Information = Personally Identifiable Information and Health Information)

Yes / No / NA (Not Applicable)

Details

Controls to be used

2.1

Does the system involve the collection of personal information, compulsorily or otherwise?

2.2

Does the system envisage a new use for personal information that is already held?

2.3

Will the system change or create any system of regular disclosure of personal information, whether to another part of State or local government, or to the private sector, or to the public at large?

2.4

Will the system restrict access by individuals to their own personal information?

2.5

Will the system establish or amend a public register?

2.6

Does the system change or create any confidentiality provisions or secrecy provisions relating to personal information?

2.7

Are any new or amended offences proposed relating to the misuse of personal information?

2.8

Are any new or amended requirements proposed to store, secure or retain personal information?

2.9

Will the system create an identification system, e.g. using a name, a number, or a biometric signature like a fingerscan? Will it require existing ID, such as a driver’s licence?

2.10

Does the system link or match personal information across or within agencies?

2.11

Does the system involve exchange or transfer of personal information outside NSW, whether with another government or otherwise?

2.12

Does the system relate to handling personal information for research or statistics, de-identified or otherwise?

2.13

Does the system contain any other measures that may affect privacy?

Governance

Yes / No / NA (Not Applicable)

Proposed Controls

CONSEQUENCES

LIKELIHOOD

RATING

3.1

Are there documented procedures for the system and are they current?

3.2

Is there a system diagram and is it current?

3.3

Is the ICT change management process followed for all changes to the system?

3.4

Is there DR documentation for this system, is it reviewed and tested regularly?

3.5

Is there BCP documentation for this system, is it reviewed and tested regularly?

Awareness and Training

Yes / No / NA (Not Applicable)

Proposed Controls

CONSEQUENCES

LIKELIHOOD

Rating

4.1

Have staff completed Information Security Awareness training?

4.2

Are staff members aware of security policy and guideline changes?

4.3

Are staff aware of incident reporting procedures?

4.4

Are there adequate staff to implement/support the system? (i.e. more than one)

4.5

Are staff adequately skilled?

4.6

Is applicable training available and funded for staff?

4.7

Is there sufficient funding to run the system according to business requirements?

4.8

Are staff resources sufficient to manage the system? (Technology, books, journals, etc)

4.9

Are key stakeholders identified and recorded?

A. Application Development

Yes / No / NA (Not Applicable)

Proposed Controls

CONSEQUENCES

LIKELIHOOD

Rating

5.1

Is the ICT System Development Life Cycle (SDLC) followed for this system?

5.2

Do you perform a security code review during each phase of the systems development?

5.3

Are all software developers working on the system given orientation/made aware of the security requirements of the system before commencing work?

B. Application in Production

Yes / No / NA (Not Applicable)

Proposed Controls

CONSEQUENCES

LIKELIHOOD

Rating

5.4

Are only authorised users able to access and make modifications to production software, configuration files, scripts, databases, etc.?

5.5

Are the interactions by authorised users on the server, to production software, configuration files, scripts, databases, etc. are logged and stored?

5.6

All application database users have the least privilege required to perform their application and/or job functions?

5.7

All logs containing restricted/confidential data are stored in a secure and centralized location?

5.8

Stored passwords are encrypted by MD5 or a similar mechanism and salted?

5.9

If a web application processes credit card payments, does it use SSL and does it handle/store card holder data according to PCI-DSS?

5.10

If a web application stores, processes, or transmits restricted data, an application firewall is in place to protect the restricted data?

5.11

Stored SQL data containing restricted or confidential information is not directly manipulated?

5.12

All input fields are validated to mitigate the risk of SQL injection (for web-based and non web-based applications)?

5.13

URL based SQL injections have been addressed and mitigated?

5.14

Load testing has been performed to identify any security bugs related to threading and session management?

5.15

Is web application authentication of users conducted over HTTPS and do not proxy, store or retransmit authentication information?

5.16

Once a user has been authenticated on the system, the level of security is not degraded beyond this baseline?

5.17

All authenticated mechanisms and sessions are encrypted?

5.18

All authentication interfaces do not mimic or might reasonably confuse others with official authentication interfaces?

5.19

Development, test and production are separate environments available for the system?

A. Data Classification

Yes / No / NA (Not Applicable)

Proposed Controls

CONSEQUENCES

LIKELIHOOD

Rating

6.1

Does all critical business data have an identified owner?

6.2

Data is classified according to the NSW Classifications and Labelling Guidelines?

6.3

Is access to sensitive customer data authorised by the data owner?

6.4

All data files and locations that may contain confidential or restricted data are documented?

B. Database

Yes / No / NA (Not Applicable)

Proposed Controls

CONSEQUENCES

LIKELIHOOD

Rating

6.5

Is access to database software restricted to privileged users based on a business requirement?

6.6

Is database access regularly reviewed?

6.7

Is confidential and restricted data encrypted in the table columns of the database?

6.8

Restricted data fields are not used as a database key and is consolidated into one table?

6.9

All database backup dumps and exports with restricted data are encrypted and have restricted access?

6.10

The test environment is restricted and data is de-identified?

6.11

Database passwords are routinely changed and meet the criteria for strong security standards?

6.12

Database vulnerability assessment scan has been run?

6.13

Database software is patched regularly?

C. Backup

Yes / No / NA (Not Applicable)

Proposed Controls

CONSEQUENCES

LIKELIHOOD

Rating

6.14

Are backups of business critical data performed regularly?

6.15

Is there an automated way to verify all backups completed?

6.16

Do you periodically restore from backup tapes to ensure integrity?

6.17

Are backup tapes stored in an environmentally controlled and secure area?

6.18

Are backup tapes stored off-site and how is access protected?

6.19

Is a regular audit conducted to account for all backup tapes?

6.20

If backup tapes are ever destroyed is there a procedure?

A. Account Management

Yes / No / NA (Not Applicable)

Proposed Controls

CONSEQUENCES

LIKELIHOOD

Rating

7.1

Is each customer account owned or sponsored by the customer?

7.2

Is concurrent access prohibited?

7.3

Are accounts locked out after a number of failed attempts?

7.4

Are accounts disabled after a period of inactivity?

7.7

Are accounts periodically reconciled to existing users?

7.8

Are privileged accounts set up for emergency access and logged and subject to regular reviews?

7.9

Do you have a list of accounts with root or admin privileges?

7.10

Are default system accounts disabled? (e.g. Windows default remote assistant accounts, Oracle’s default DBA account)

B. Password Management

Yes / No / NA (Not Applicable)

Proposed Controls

CONSEQUENCES

LIKELIHOOD

Rating

7.5

Are users forced to change their password at first login and do passwords expire periodically?

7.6

Are users prevented from re-using passwords?

7.7

All passwords contain 8 characters or more and contain characters from at least two of the following: Alphabetic (a-z, A-Z), Numeric (0-9), Punctuation and other characters?

7.8

Passwords are not sent “in clear text” (unencrypted) and are transmitted securely?

7.9

All systems passwords have been changed from their default?

A. Data Centre Security

Yes / No / NA (Not Applicable)

Proposed Controls

CONSEQUENCES

LIKELIHOOD

Rating

8.1

A primarily responsible person and their backup has been identified?

8.2

Access to restricted areas is based on a business need and is periodically reviewed?

8.3

Alarms are working, monitored externally, maintained and tested regularly?

8.4

Surveillance equipment is working, backed up, maintained and tested regularly?

8.5

Adequate power supplies are in place and maintained?

8.6

UPS are in place, maintained and tested regularly?

8.7

Adequate aircon is in place, maintained and tested regularly?

8.8

Backup generator is in place, maintained and tested regularly?

8.9

Fire suppression systems are in place, maintained and tested regularly?

8.10

Environment is regularly cleaned?

8.11

Appropriate work aids (WHS) are provided and in good condition?

8.12

Work Health Safety is reviewed regularly?

8.13

Hardware with confidential or restricted data is physically segmented from non-secure systems?

8.14

Data cables and power cables are separated?

B. Asset Inventory

Yes / No / NA (Not Applicable)

Proposed Controls

CONSEQUENCES

LIKELIHOOD

Rating

8.15

Are their documented processes for removing equipment?

8.16

Is there an inventory kept of physical devices and is it regularly reviewed?

8.17

Are there methods for the secure disposal of unwanted equipment and documents?

8.18

Is there a process to ensure software inventory is maintained and is accurate and current?

8.19

Is there an authorised list maintained of software that can be installed?

8.20

Is license information kept and reviewed?

8.21

Devices are configured to lock and require a user to re-authenticate if left unattended?

Vulnerability and Hardening

Yes / No / NA (Not Applicable)

Proposed Controls

CONSEQUENCES

LIKELIHOOD

Rating

9.1

Is there a process to obtain the latest security patches and updates?

9.2

Is there a process to identify vulnerabilities?

9.3

Are automated tools used to assess system vulnerabilities?

9.4

Is a pen test conducted against systems to identify vulnerabilities?

9.5

Do you have a security checklist for each operating system deployed?

9.6

Do you perform reviews of your security checklist?

9.7

Are the security checklists updated regularly?

9.8

Are root or admin account privileges regulated on systems and is this documented?

9.9

Are applications regulated from running as root or admin privilege?

9.10

Are login banners on systems?

9.11

Is anti-virus installed on all operating systems?

9.12

Are the virus definitions automatically updated?

9.13

Are all email and ftp transmissions checked for malware?

9.14

Is access to directories that contain confidential or restricted data, restricted?

9.15

Is security auditing enabled on business critical systems?

9.16

Logging of access to confidential or restricted information is being performed and securely stored?

9.17

Failed logins are logged with IP address and timestamp (archived and backed up) and repeated failures are locked out?

9.18

Are logs reviewed in a timely and consistent manner, with identified events reviewed?

9.19

Is automatic alerting configured for defined thresholds?

9.20

Is an active SMTP service provided that allows unauthorised parties to relay e-mail messages?

A. Router/Firewall/Switch /Proxy

Yes / No / NA (Not Applicable)

Proposed Controls

CONSEQUENCES

LIKELIHOOD

Rating

10.1

Is there a current network diagram and is it maintained?

10.2

Have stateful firewalls been deployed at all external connections?

10.3

Is the firewall configured with a policy that all services are denied unless expressly permitted?

10.4

Is the risk of opening protocols and ports assessed before implementing any changes on the firewall?

10.5

Is outgoing traffic directed to external proxy servers and are they in the DMZ?

10.6

Are all services forbidden except when specifically requested?

10.7

Is logging enabled?

10.8

Are logs reviewed regularly and in a consistent manner with identified events reviewed?

10.9

Are network devices hardened and backed up?

10.10

Is access restricted to those with a business need?

10.11

For remote administration are administrators securely authenticated, if so how?

10.12

Are network devices regularly patched?

10.13

Is the business critical network configured with switches so that sniffer software is ineffective?

B. VPN

Yes / No / NA (Not Applicable)

Proposed Controls

CONSEQUENCES

LIKELIHOOD

Rating

10.14

Is a personal firewall implemented for computers which use a VPN?

10.15

Is VPN access only granted to computers running antivirus software and a personal firewall?

10.16

IS VPN access cancelled as soon as the business requirement is no longer needed?

C. Intrusion Detection

Yes / No / NA (Not Applicable)

Proposed Controls

CONSEQUENCES

LIKELIHOOD

Rating

10.17

Is the placement of the IDS reviewed to ensure appropriate coverage?

10.18

Is there automated alerting configured?

10.19

Is the NIPS monitoring interconnections (internet, web-hosting platforms, third party connections)?

D. Cryptography

Yes / No / NA (Not Applicable)

Proposed Controls

CONSEQUENCES

LIKELIHOOD

Rating

10.20

Is there a register of all SSL certificates and their expiry date?

10.21

Do SSL certificates match domains?

10.22

Is SSL/HTTPS enforced for all web applications accessing confidential and restricted data?

Access/Change/BCP/Service

Yes / No / NA (Not Applicable)

Proposed Controls

CONSEQUENCES

LIKELIHOOD

Rating

11.1

Access Control: Is the solution Security Assertion Markup Language 2.0 (SAML 2.0) compliant for authenticating users?

11.2

Change Control: Authorisation – what degree of granularity does the system offer in defining roles?

11.3

Change Control: Isolation – what security standards are followed in the operation of the service?

11.4

Change Control: Isolation – is compliance with internal security standards assessed by a compliance audit at least annually?

11.5

Change Control: Isolation – what external application vulnerability scans / assessments / audits are done and how often?

11.6

Change Control: Isolation – does data transit non – Australian networks, if so where?

11.7

Change Control: Isolation – is data stored outside of Australia, if so where?

11.8

Business Continuity: what level of availability does the service offer?

11.9

Business Continuity: what provisions are in place to exit the service?

11.10

Business Continuity: what provisions are in place to protect intellectual property?

11.11

Business Continuity: what provisions are in place for decryption key escrow, for encrypted solutions?

11.12

Access, Change and Fault Reporting: what activity and resource usage reports are provided?

11.13

Service Details: does the solution follow web standards? e.g. OWASP

11.14

Service Details: if handling credit card details, is the solution PCI-DSS compliant?

11.15

Service Details: what other auditable IT standards are followed and how often are audits performed?

11.16

Service Details: are the results of audits and certifications made available to customers?

Contractors

Yes / No / NA (Not Applicable)

Proposed Controls

CONSEQUENCES

LIKELIHOOD

Rating

12.1

Have the appropriate HR checks been completed and a non-disclosure agreement signed?

12.2

Do the (proposed) team members have IT security certifications? e.g. CISSP, TOGAF

12.3

Have the (proposed) team members worked on projects of similar size, nature and complexity in the past?

12.4

Do the (proposed) team members have vendor or technology specific certifications?

12.5

Are security standards such as OWASP or TOGAF followed in development of solutions?

12.6

What coding methodology, review practices are followed in the development of solutions?

12.7

Has the developer anticipated the need to perform a Privacy Impact Assessment (PIA) and Threat and Risk Assessment (TRA) and budgeted time to do so?

12.8

If so, how much time has been reserved?

12.9

How has the PIA and TRA been integrated into the development process?

Project Step

Tasks

Director, ICT

Info Sec Team

Technical Services Team

Communications Team

Customer Services Team

Development Services

Other specialist units

Startup

1. Identification of requirements

2. Document scope

3. Resources

4. Audience

Initiate

5. Review of existing document

6. Risk assessment

Plan

7. Areas to address

8. Control selection

9. Risk treatment plan

10. Consultation

11. Draft document

Execute & Monitor

12. Approval and sign-off

Close/Review

13. Measurement program entry

14. Communication to stakeholders

15. Initiating flow-on reviews

EFFECTIVENESS OF CURRENT CONTROLS

Unsatisfactory

No recovery plan; Change is across multiple systems / sites; Change to a critical system that is a dependency for key business system(s); Evidence is present that controls are non-existent or completely ineffective and urgent improvements are required; No contingencies are identified and activity disruption is likely;

Inconsistent

Change cannot be verified until under normal load; Change requires support from multiple sources (suppliers etc.); Pilot/Go live of a new application; Controls are largely ineffective and there is likelihood that controls will be breached; Few contingencies are in place and significant activity disruptions are expected;

Effective

Recovery plan untested; Previous change(s) have had issues; Change is to a non critical system; Change tested successfully but test environment does not replicate live environment; Most controls are functioning, but areas for improvement are identified; There is some likelihood that controls may be breached; There is recent evidence that a small number of controls have been breached; Contingencies are in place for a few key areas to manage potential activity disruptions;

Highly Effective

Change replicates normal user behavior; History of successful implementation; Successful implementation of pilot and subsequent phases; Controls are effective but small improvements could be made; There is a low likelihood that controls may be breached; There are no recent examples of control breaches; Control effectiveness is assessed regularly; Contingencies are in place for key business areas to manage potential activity disruptions;

Exceptional

Recovery plan is known and tested; Non-complex change; Change tested successfully in test environment that fully replicates live environment; Controls are effective and stable; There is an extremely low probability of controls being breached; There are no previous incidents of control breaches; Control effectiveness is assessed frequently (more than once per year); Comprehensive contingencies are in place to manage most potential activity;

CONSEQUENCES

Catastrophic

Characteristics: Total loss of Data Centre; total loss of operations > 48 hours; total loss of strategic data sets and backups; Causes: Building fire, natural disaster (earthquake) affecting the city and surrounding area and/or building, pathogen, bomb, etc. Recovery Time: Potentially very long (e.g. total loss of building), significant staff losses including key IT disaster recovery personnel.

Extreme (Outage likely to exceed 3 days)

Characteristics: Total data centre failure (retain business areas), Retain data centre but business areas lost; data availability lost > 24 hours; Causes: Data centre fire, multiple supply systems failure (power combined with UPS), Building fire that partially destroys the building, pathogen. Recovery Time: Long depending on cause, some staff losses that could include key IT disaster recovery personnel.

Major (Outage likely to exceed 24 hours)

Characteristics: Partial data centre failure; major data storage failure >24 hours; major communications loss >24 hours;

Causes: Multiple critical systems fail at the same time possible due to power loss or fire/flood in the data centre.

Recovery Time: Medium-long depending on the equipment impacted, staff losses unlikely.

Minor (Outage will not exceed 24 hours)

Characteristics: The failure impacts business units and or floors but the majority of staff can continue to operate.

Causes: Failure of one or more major applications, network failure impacting one or more floors.

Recovery Time: Short-medium, DR unlikely to be initiated.

Isolated (Outage will not exceed 4 hours)

Characteristics: Impact the delivery of one major business application.

Causes: Server floor, database failure, application level failure.

Recovery Time: Short – normally handled within normal IT support timeframes.

LIKELIHOOD

Almost certain

Is expected to occur in most circumstances. Could occur within ‘days to weeks’.

Likely

Will probably occur in most circumstances. Could occur within ‘weeks to months’.

Possible

Might occur at some time. Could occur ‘within a year or so’.

Unlikely

Could occur at some time. Could occur ‘after several years’.

Rare

May occur only in exceptional circumstances. A ‘100 year event’ or greater.

Likelihood rating

Consequence rating

Isolated

Minor

Major

Extreme

Catastrophic

Almost certain

Moderate

Moderate

High

High

High

Likely

Moderate

Moderate

Moderate

High

High

Possible

Low

Moderate

Moderate

Moderate

High

Unlikely

Low

Low

Moderate

Moderate

Moderate

Rare

Low

Low

Low

Moderate

Moderate