The Unique Alternative to the Big Four ® SOC 2 Reports – A Third Party Risk Management Tool for Cloud Providers August 2014

The Unique Alternative to the Big Four®

SOC 2 Reports – A Third Party Risk Management Tool for Cloud Providers

August 2014


© 2014 Crowe Horwath LLP 2Audit | Tax | Advisory | Risk | Performance

Agenda Overview of Cloud Computing Importance of Third Party Risk Management SOC Reports – A Method of Third Party Risk Management

Alignment of Cloud Security Alliance (CSA) Cloud Control Matrix (CCM) and SOC 2 Trust Services Principles (TSP)

Summary and Conclusion Q&A



What is Cloud Computing Cloud computing is a model for enabling convenient, on-demand network access

to a shared pool of configurable computing resources. Networks, servers, storage, applications, and services that can be rapidly

provisioned and released with minimal management effort or service provider interaction.

This cloud model promotes availability and is composed of five essential characteristics, three service models, and four deployment models.



What is Cloud Computing



Opportunities Cost savings – Customers pay for only the computing resources used. There

are no physical space requirements or utility costs. All dollars are expensed (that is, receive a U.S. tax benefit).

Speed of deployment – The time to fulfill requests for computing power and applications can change from months to weeks, weeks to days, and days to hours.

Scalability and better alignment of technology resources – Companies can scale up or down their capacity without capital expenditures.

Decreased effort in managing technology – Cloud computing provides the organization more time to focus on core purpose and goals; more consistent technology upgrades; and expedited fulfillment of IT resource requests.

Environmental benefits – Significant adoption of cloud computing should yield less overall power consumption, carbon emissions, and physical land use.



Risks Some of the typical risks associated with cloud computing are:

Disruptive force Residing in the same risk ecosystem as the cloud service provider (CSP) and other

tenants of the cloud Lack of transparency Reliability and performance issues Vendor lock-in and lack of application portability and interoperability Security and compliance concerns Creation of high-value cyber-attack targets Risk of data leakage IT organizational changes Viability of the CSP



Changes in the Operating Environment With Cloud Computing Risks and other cloud computing effects should be incorporated in ERM

programs. Organizations can engage cloud computing solutions while bypassing normal

management oversight controls. Cloud computing solutions are: a) easily adopted within a short period of time,

b) require a small monetary investment, and c) involve very few personnel.



Shared Control Environment



Risk Levels – Shared Control Environment



Shared Control Environment Risk Profile Impact of CSPs and

fellow cloud tenants Using cloud computing converts an

organization’s internal environment into a combination of its own internal environment and the internal environment of the contracted CSP.

Why Both? Data and processes are hosted in a

shared environment with other cloud tenants.

Behavior and events of the CSP and fellow tenants could have a direct impact on the organization.



Cloud Governance Cloud governance” refers to the

controls and processes in place for cloud planning and strategy, vendor selection, contract negotiation, implementation, operation, monitoring and possible termination and transition of cloud services.



Investing in Third Party Risk Management – Disruption of Service

Suffered more than 1m Euro in costs per incident

IT or Telecommunication cause

Disruptions originated below the immediate tier one supplier

Experienced at least one disruption

0% 20% 40% 60% 80% 100%

15%

55%

42%

75%

21%

52%

39%

73%

79%

48%

61%

27%

2011

2012

2013

(Japan earthquake)

Source: “Supply Chain Resilience,” November 2012 and November 2013, Business Continuity Institute



Investing in Third Party Risk Management – Data Breach

“On average, third party errors increased the cost of data breach by as much as $43 per record in the US”

41%

33%

26%

Cause of Data Breaches

Malicious or criminal attackHuman errorSystem error

Source: “2013 Cost of Data Breach Study: Global Analysis”, Sponsored by Symantec, May 2013, Ponemon Institute



Third-Party Risk Management Concerns

Evaluating quality of products

Monitoring financial viability

Collecting financial performance or other information

Obtaining internal audit coverage of key risk areas

Identifying or aggregating risks

Monitoring third party risk management practices

Gaining assurance on compliance with laws and regulations

Determining protection of intellectual property

Evaluating technology controls to protect data

0.0% 20.0% 40.0% 60.0% 80.0% 100.0% 120.0%

None

Minimal

Some

High

Source: "Closing the Gaps in Third-Party Risk Management, Defining a Larger Role for Internal Audit,” December 2013, Sponsored by Crowe Horwath LLP



Third Party Risk Management Activities Vendor management activities performed should be based on risk associated

with the vendor In order to ensure the risks with outsourcing cloud services are properly

addressed organizations should consider performing the following activities: Review cloud provider’s policies and procedures Request cloud provider respond to internal control questionnaires Perform an onsite review of cloud provider operations Review a Service Organization Control (SOC) Report

Organizations can use SOC reports to obtain a level of comfort over a cloud provider’s controls related to security, availability, processing integrity, confidentiality and privacy controls.



Service Organization Controls (SOC) Reports – Overview AICPA created separate reports on internal controls over financial reporting and

reports on other types of controls. The AICPA has added additional reporting options. The three reporting options

now are: SOC 1 SOC 2 SOC 3



Types of SOC Reports

SOC 1

• Internal controls related to financial reporting

SOC 2

• Trust Services Principles

• Restricted Use Report

SOC 3

• Trust Services Principles

• General use report

SSAE 16/ AT 801 AT 101



Who May Need to Issue a SOC 2 Report? Organizations that need to demonstrate how they process transactions and/or

data on behalf of their customers Organizations that need to demonstrate how their security controls operate Organizations that need to demonstrate how their controls related to system

availability function Organizations that need to demonstrate how their controls related to data privacy

or confidentiality operate

A Cloud Service Provider Fits These Characteristics!



Trust Services Principles

Security – The system is protected against unauthorized

access (both physical and logical).

Availability – The system is available for operation and use

as committed or agreed to.

Processing Integrity – System processing is complete,

accurate, timely, and authorized.

Confidentiality – Information designated as confidential is protected as committed or

agreed to.

Privacy – Personal information is collected, used, retained, disclosed, and destroyed in conformity with the commitments in the entity’s privacy notice and with criteria set forth in

generally accepted privacy principles (GAPP) issued by the AICPA and the

Canadian Institute of Chartered Accountants (CICA).



Relationship Between Principles, Criteria and Controls

Principle

Criteria

Controls



Example Criteria and Illustrative Controls

Security Principle - Criteria 3.3 Procedures exist to restrict physical access to the defined system including, but not limited

to, facilities, backup media, and other system components such as firewalls, routers, and servers.

Illustrative Controls: Physical access to the computer rooms, which house the entity's IT resources, servers,

and related hardware such as firewalls and routers, is restricted to authorized individuals by card key systems and monitored by video surveillance.

Physical access cards are managed by building security staff. Access card usage is logged. Logs are maintained and reviewed by building security staff.

Requests for physical access privileges to the entity's computer facilities require the approval of the manager of computer operations.

Documented procedures exist for the identification and escalation of potential physical security breaches.

Offsite media are stored in locked containers in secured facilities. Physical access to these containers is restricted to facilities personnel and employees authorized by the manager of computer operations.



Example Criteria and Illustrative Controls

Security Principle - Criteria 3.4 Procedures exist to protect against unauthorized access to system resources.

Illustrative Controls: Login sessions are terminated after three unsuccessful login attempts. Virtual private

networking (VPN) software is used to permit remote access by authorized users. Users are authenticated by the VPN server through specific "client" software and user ID and passwords.

Firewalls are used and configured to prevent unauthorized access. Firewall events are logged and reviewed daily by the security administrator.

Unneeded network services (for example, telnet, ftp, and http) are deactivated on the entity's servers. A listing of the required and authorized services is maintained by the IT department. This list is reviewed by entity management on a routine basis for its appropriateness for the current operating conditions.

Intrusion detection systems are used to provide continuous monitoring of the entity's network and early identification of potential security breaches.

The entity contracts with third parties to conduct periodic security reviews and vulnerability assessments. Results and recommendations for improvement are reported to management.



SOC Report Sections

SOC 2 Report Sections

Service Auditor’s Opinion

Management’s Assertion

Description of Systems

Test Results

Complementary Controls

Other Information



Cloud Control Matrix (CCM) Developed by the Cloud Security Alliance (CSA) Establishes a controls framework for cloud providers to follow Based on industry accepted control frameworks such as ISO 27001/27002, ISACA COBIT

and NIST Provides guidance in the following domains:

1. Application and Interface Security2. Audit Assurance and Compliance3. Business Continuity Management & Operational Resilience4. Change Control & Configuration Management5. Data Security & Information Lifecycle Management6. Datacenter Security7. Encryption and Key Management8. Governance and Risk Management9. Human Resources10. Identify and Access Management11. Infrastructure & Virtualization Security12. Interoperability & Portability13. Mobile Security 14. Security Incident Management, E-Discovery & Cloud Forensics15. Supply Chain Management, Transparency and Accountability16. Threat and Vulnerability Management



CCM Controls Map to SOC 2 Criteria

CCM - Change Control and Configuration Management

Control Specification: Policies and procedures shall be established, and supporting business processes and

technical measures implemented, to ensure the development and/or acquisition of new data, physical or virtual applications, infrastructure network and systems components, or any corporate, operations and/or datacenter facilities have been pre-authorized by the organization's business leadership or other accountable business role or function.

SOC 2 TSP Criteria: (S3.10.0) Design, acquisition, implementation, configuration, modification, and

management of infrastructure and software are consistent with defined system security policies.

(S3.12.0) Procedures exist to maintain system components, including configurations consistent with the defined system security policies.

(S3.13.0) Procedures exist to provide that only authorized, tested, and documented changes are made to the system.



CCM Controls Map to SOC 2 Criteria

CCM – Datacenter Security

Control Specification: Physical access to information assets and functions by users and support personnel

shall be restricted.

SOC 2 TSP Criteria: (S3.4.0) Procedures exist to restrict physical access to the defined system including, but

not limited to, facilities, backup media, and other system components such as firewalls, routers, and servers.



SOC Report Review

Organizations should obtain and formally review SOC reports.

The review should focus on the following: Report Type

Type 1 or Type 2 Areas of Coverage/Scope Opinion

Unqualified or Qualified Subservice Organizations

Description of Systems Content Test Results/Impact of Exceptions Noted Evaluation of User Control Considerations



Summary and Conclusion



Questions



Crowe Horwath LLP is an independent member of Crowe Horwath International, a Swiss verein. Each member firm of Crowe Horwath International is a separate and independent legal entity. Crowe Horwath LLP and its affiliates are not responsible or liable for any acts or omissions of Crowe Horwath International or any other member of Crowe Horwath International and specifically disclaim any and all responsibility or liability for acts or omissions of Crowe Horwath International or any other Crowe Horwath International member. Accountancy services in Kansas and North Carolina are rendered by Crowe Chizek LLP, which is not a member of Crowe Horwath International. © 2014 Crowe Horwath LLP

For more information, contact:

Jeff Palgon

Direct 404.442.1623

[email protected]

Documents

The Unique Alternative to the Big Four ® SOC 2 Reports – A Third Party Risk Management Tool for Cloud Providers August 2014