Which Methodology Do You Use to Make the Right Decision?
By Zsolt Baranya, Information Security Auditor, Black Cell Ltd.
Numerous organizations are thinking about introducing cloud-based systems or cloud services. The decision is rather difficult and complex because of the advantages and disadvantages. Usually, the decision makers’ main arguments are the higher availability and the reduced IT operations cost compared to an on-premises architecture.
There are legal requirements and recommendations describing the importance of advantage- disadvantage analysis. There is no uniform / formalized methodology to conduct the analysis, which offer a criteria system or decision process.
First, the organization must identify all the legal rules in the cloud service introduction to know the exact requirements. These obligations can vary greatly from country to country. There are mandatory and discretionary requirements, that the organization shall consider. The decision on the cloud implementation shall primarily depend on the mandatory requirements.
There are many organizations – subsidiary/affiliate – which depend on the parent company in the usage of cloud-based services. In this situation the possibilities for implementing a cloud usage depends on the parent organization.
Considering all the circumstances, the organizations need a methodology or a criterion to make the right decision. The following list and criteria may help to your organization. Each question has a score, which is based on the priority of the question. If you finish providing the answers, you gain an aggregated score on the advantage side and the disadvantage side. The aggregated scores can help the decision-makers.
The scores (values) are only recommendations. These can be changed due to the special needs of the organization.
| No. | Question | Advantage | Disadvantage | Score |
| 1 | Is management committed to using cloud services? If not, the whole project can fail. | Yes | No | 2 |
| 2 | Organizational cloud service usage rules sholud implemented easily? In case of the procedures and/or the rules of the organization are overly different form the procedures and rules of the cloud service (provider) can make the implementation inapplicable. | Yes | No | 1,9 |
| 3 | Is the information security policy of the organization allowing the usage of cloud services? This is a relatively easy decision to change the policy, if the first questions answer is yes. | Yes | No | 1,5 |
| 4 | Does a contract prohibit the use of the cloud service? If yes, do you have a possibility to negotiate with the partner to change it? If the contract’s content can not be changed, the value of the disadvantage is as follows. | No | Yes | 1,9 |
| 5 | Is the cloud service appropriate to handle business needs? It is an important question, but the business has to understand the operation and functionality of the service provided by the cloud service provider. | Yes | No | 1,8 |
| 6 | Is the cloud service suitable for the efficient implementation of organizational cost allocation? Many organization have a cost allocation system. If the cloud can not handle (or not capable to handle) the needs, the answer is no. | Yes | No | 2 |
| 7 | Does the IT experts possess specific knowledge to operate cloud services? There are many cloud trainings available, if the IT staff requires further education, therefore this part of the introduction is manageable. | Yes | No | 1,7 |
| 8 | Are there any legal or other legislative obligation, which can limit the using of cloud services? If yes, the organization have take into account the legislative actions. | No | Yes | 2 |
| 9 | Is the data migration relatively easy and securely feasible? If it’s not, you have the possibility to establish a full back plan, or other plans if some confusion appears. | Yes | No | 1,8 |
| 10 | Is the cloud solution compatible with organizational architecture elements? If it’s not, to handle this will be more expensive. | Yes | No | 1,9 |
| 11 | Is it possible to establish an Exit strategy or not (in case of unique cloud solution)? The establishment of a good Exit strategy is very complicated. There are many possible scenario which the organization can not anticipate. | Yes | No | 1,9 |
| 12 | Could the service implementation costs be cheaper than the operational costs of the on premise solution? The exact amounts are required to answer properly. | Yes | No | 2 |
| 13 | Do you need to further develop the cloud service or it is available as a compact service? | Compact Yes | Developing No | 1,8 |
| 14 | Can the cloud service’s technical implementation be considered risky (interfaces, encription etc.)? With the help of a qualified risk management team, the risk mitigation process will cover all difficulties. | No | Yes | 1,7 |
| 15 | Does the cloud provider and service have relevant certificates? Without certification, you have to make sure that it complies with your information security and data protection standards by conducting audit. | Yes | No | 1,7 |
| 16 | Does the reporting function available that the cloud service use support the deceision making process? It is important for the managers but not exactly relevant for the operators. If the answer is no, you have to find the work-around solution to handle the problem. | Yes | No | 1,5 |
| 17 | The cloud service provider that you want to deploy recently published an incident? It is a good indicator, if the cloud service provider publish incidents, but it should be considered what was the incident and what kind of failure could cause it. | No | Yes | 1,6 |
| 18 | Could the management of a cloud service take more time than operating an on premise system? More estimated time, more money. | No | Yes | 1,8 |
| 19 | Will the usage of the cloud service be based on a contract or placed under general terms and conditions? If it based on contract, than the answer is yes. Therefore you have a possibility to include individual needs in the contract. | Yes | No | 1,6 |
| Aggregated scores |
The methodology represented above promulgates the pre-implementation assessment process by providing a solution to analyze the advantages and disadvantages of cloud service implementation. In practice, many organization-specific situations could occur, that cannot be divided along the lines of a yes/no answer. If a situation like this arises, it is advisable to collect the arguments from both sides.
To utilize the methodology in the best way possible, determining the scores in advance of providing the answers for the questionnaire is crucial. If the aggregated scores come up equally at the end of the analysis, the decision makers could rely on the unique results and debates of each question above.
I hope this methodology can help to make the right decision!
About the Author
Zsolt Baranya is an Information Security Auditor and head of compliance of Black Cell Ltd. in Hungary. Formerly, he has been in information security officer and data protection officer roles at a local governmental organization. He also worked as a senior desk officer at National Directorate General for Disaster Management, Department for Critical Infrastructure Coordination, where he was responsible for the Hungarian critical infrastructures’ information security compliance. Zsolt can be reached at [email protected] and at his company’s website https://blackcell.io/
;
We are in our 11th year, and Global InfoSec Awards are incredibly well received – helping build buzz, customer awareness, sales and marketing growth opportunities, investment opportunities and so much more.