A. Governance, Risk, and Compliance
1.
From governance perspective, in order to ensure that all cloud-related
investments (including time, manpower, funds, equipment, etc.,) are consistent
with the overall strategy, have continuous mechanism for regulation, can lower
enterprise risk in cloud environment, and can create concrete value out of
cloud computing, the selection of a proper cloud service environment via a
good overall cloud service assessment mechanism is needed.
2.
From risk management perspective: Service lifecycle needs to be assessed
and potential risks at every stage needs to be analyzed to get the overall risk
level. Attention needs to be paid also for the potential comprise of confidential
information due to cloud interoperability and portability before changing data or
cloud environment.
3.
From legal compliance perspective: Since the nature of cloud services can
cross country and locations, the review and inspection of the potential violation
to the compliance requirements of each of the countries and locations can help
to avoid the compliance violation which can result in damaging business
reputation.
B. Operation, Infrastructure, and Virtualization
1.
From operations perspective: Since there are numerous players in the cloud
service supply chain, it will be necessary to strengthen the mechanism for
security, ongoing operation, and disaster recovery; and incorporate the service
disruptions of each of the players in the cloud supply chain into the process of
disaster recovery. For example, the system becomes vulnerable when using
“
Snapshot” to backup data. Thus, in operations, it is best to turn off the
Snapshot function during operation.
2.
From the infrastructure perspective: Insightful assessments are important for
data center operation, security of applications, encryption and key mechanism,
identity and access management. Take identity and access management as
an example, the access mechanism for all roles in the cloud services
environment should be clearly established to avoid internal security leakage. It
should be noted that institutions or organizations using public cloud services,
when establishing internal and external network links, should consider using
the professional CA certification services or CA services that can confirm the
reliability of cloud service provider.
3.
From virtualization perspective: In a cloud services environment, Virtualization
Hypervisor performs the access control for the user's operating system to the
cloud server. However, this procedure proved to still having weakness that
