Securing Cloud Computing Through IT Governance

Abstract

Lack of alignment between information technology (IT) and the business is a problem facing many organizations. Most organizations, today, fundamentally depend on IT. When IT and the business are aligned in an organization, IT delivers what the business needs and the business is able to deliver what the market needs. IT has become a strategic function for most organizations, and it is imperative that IT and business are aligned. IT governance is one of the most powerful ways to achieve IT to business alignment. Furthermore, as the use of cloud computing for delivering IT functions becomes pervasive, organizations using cloud computing must effectively apply IT governance to it. While cloud computing presents tremendous opportunities, it comes with risks as well. Information security is one of the top risks in cloud computing. Thus, IT governance must be applied to cloud computing information security to help manage the risks associated with cloud computing information security. This study advances knowledge by extending IT governance to cloud computing and information security governance.

IS Risks Governance for Cloud Computing Service

“…K. Brandis et al developed a framework to show the effect of using standards in cloud computing in mitigating risks according to five aspects which are legal, organizational, technical, cultural, and financial in order to use the cloud without risk in these aspects [25]. S. M. Faizi et al divided cloud computing security domains into storage, software, network security, trust management, Internet and services, compliance, legal, and virtualization [26]. M. Al-Ruithe et al provided a strategy for determining the critical success factors (CSF) in implementing cloud services that include (1) organizational (defining the responsibilities, business, and IT alignment), ( 2) technological (automation of data integration life-cycle, having data metrics), (3) strategic points of control, (4) training and awareness of data stakeholders, and ( 5) monitoring the compliance [27].…”

“…Thus, in this step, CC's auditor will define all risks that relate to these layers. Risk areas are categorized into eight domains (storage, software, network security, trust management, Internet services, compliance, legal, and virtualization) [26]. So determining risks must cover these domains in the CSP's side.…”

“…Also, in case of using SaaS, CC may have risk areas to control. Examples of covering missing controls in CSP's side are if CSP does not provide data encryption or data redundancy in many sites.Step(10) Determine needed controls: Auditor determines controls that must be applied in CC side to avoid the risk areas in CC's side according to the risks determined to cover all security domains[26] in CC's side. In previous step examples, the CC's auditor must recommend encrypting data before sending to CSP's side.…”

Exploring Challenges and Opportunities in Cybersecurity Risk and Threat Communications Related to the Medical Internet of Things (MIOT)

“…In recent multiple case studies conducted to assess the scope and depth of cybersecurity risk [26] and threat communications delivered to an extremely vulnerable patient population, semistructured interviews were held with cardiac medical device specialists across the United States. These cardiac medical devices experts were intimately involved in the care and patient safety of cardiac implantable electronic devices (CIED) patients who used home monitoring systems to connect their implantable cardioverter-defibrillator (ICD) and pacemaker (PM) devices, typically through the cloud [23], to their physician's offices or device clinic. The case study examined the question: How are the cybersecurity risks [30] and threats related to wireless implanted medical devices being communicated to patients who have or will have these devices implanted in their bodies?…”