Managing Risk and Security in Outsourcing IT Services: Onshore, Offshore and the Cloud

232 Pages·2013·4.328 MB·English

by  Frank Siepmann

Information Technology / Security & Auditing S Managing Risk
i
e
p
m
The information on the different countries ... provides a great perspective as
a
to what is going on in the world and why it is so important to know who and n
n and Security in
what country you are dealing with.
M
—Todd Fitzgerald, Global Information Security Director,
Grant Thornton International, Ltd. a
n Outsourcing
a
With cloud computing quickly becoming a standard in today’s IT environments,
g
many security experts are raising concerns regarding security and privacy in
i
n
outsourced cloud environments—requiring a change in how we evaluate risk IT Services
g
and protect information, processes, and people.

R
i
Managing Risk and Security in Outsourcing IT Services: Onshore, Offshore s
k
and the Cloud explains how to address the security risks that can arise from
Onshore, Offshore and the Cloud
a
outsourcing or adopting cloud technology. Providing you with an understanding
n
of the fundamentals, it supplies authoritative guidance and examples on how to
d
tailor the right risk approach for your organization.

S
e
Covering onshore, offshore, and cloud services, it provides concrete examples c
and illustrative case studies that describe the specifics of what to do and u
r
what not to do across a variety of implementation scenarios. This book will
i
t
be especially helpful to managers challenged with an outsourcing situation— y
whether preparing for it, living it day to day, or being tasked to safely bring back
i
n
information systems to their organization.

O
Many factors can play into the success or failure of an outsourcing initiative. u
t
This book not only provides the technical background required, but also the s
practical information about outsourcing and its mechanics. o
u
r
By describing and analyzing outsourcing industry processes and technologies, c
i
along with their security and privacy impacts, this book provides the fundamental n
understanding and guidance you need to keep your information, processes, and g
people secure when IT services are outsourced. I
T

S
e
r
v
K13704
i
c
6Su0i0te0 3B0ro0k, eBno cSao uRnadto Pna, rFkLw 3a3y,4 N87W ISBN: 978-1-4398-7909-2 e
90000
711 Third Avenue s
New York, NY 10017
an informa business Frank Siepmann,
2 Park Square, Milton Park
www.crcpress.com Abingdon, Oxon OX14 4RN, UK
9 781439 879092
CISM, CISSP, ISSAP, NSA-IAM, NSA-IEM
www.auerbach-publications.com
K13704 cover mech.indd 1 10/30/13 10:35 AM
Managing Risk
and Security in
Outsourcing
IT Services
Onshore, Offshore and the Cloud
OTHER INFORMATION SECURITY BOOKS FROM AUERBACH
Asset Protection through Security Awareness Guide to the De-Identification of Personal
Tyler Justin Speed Health Information
ISBN 978-1-4398-0982-2 Khaled El Emam
ISBN 978-1-4665-7906-4
Automatic Defense Against Zero-day
Polymorphic Worms in Communication Information Security Governance Simplified:
Networks From the Boardroom to the Keyboard
Mohssen Mohammed and Al-Sakib Khan Pathan Todd Fitzgerald
ISBN 978-1-4665-5727-7 ISBN 978-1-4398-1163-4
The Complete Book of Data Anonymization: Information Security Policy Development for
From Planning to Implementation Compliance: ISO/IEC 27001, NIST SP 800-53,
Balaji Raghunathan HIPAA Standard, PCI DSS V2.0, and AUP V5.0
ISBN 978-1-4398-7730-2 Barry L. Williams
ISBN 978-1-4665-8058-9
The Complete Guide to Physical Security
Paul R. Baker and Daniel J. Benny Information Technology Control and Audit,
ISBN 978-1-4200-9963-8 Fourth Edition
Sandra Senft, Frederick Gallegos, and Aleksandra Davis
Conflict and Cooperation in Cyberspace:
ISBN 978-1-4398-9320-3
The Challenge to National Security
Panayotis A. Yannakogeorgos and Iris Biometric Model for Secured Network Access
Adam B. Lowther (Editors) Franjieh El Khoury
ISBN 978-1-4665-9201-8 ISBN 978-1-4665-0213-0
Cybersecurity: Public Sector Threats Managing the Insider Threat: No Dark Corners
and Responses Nick Catrantzos
Kim J. Andreasson ISBN 978-1-4398-7292-5
ISBN 978-1-4398-4663-6 Network Attacks and Defenses: A Hands-on
The Definitive Guide to Complying with the Approach
HIPAA/HITECH Privacy and Security Rules Zouheir Trabelsi, Kadhim Hayawi, Arwa Al Braiki,
John J. Trinckes, Jr. and Sujith Samuel Mathew
ISBN 978-1-4665-0767-8 ISBN 978-1-4665-1794-3
Digital Forensics Explained Noiseless Steganography: The Key to Covert
Greg Gogolin Communications
ISBN 978-1-4398-7495-0 Abdelrahman Desoky
ISBN 978-1-4398-4621-6
Digital Forensics for Handheld Devices
Eamon P. Doherty PRAGMATIC Security Metrics: Applying
ISBN 978-1-4398-9877-2 Metametrics to Information Security
W. Krag Brotby and Gary Hinson
Effective Surveillance for Homeland Security:
ISBN 978-1-4398-8152-1
Balancing Technology and Social Issues
Francesco Flammini, Roberto Setola, Securing Cloud and Mobility: A Practitioner’s Guide
and Giorgio Franceschetti (Editors) Ian Lim, E. Coleen Coolidge, and Paul Hourani
ISBN 978-1-4398-8324-2 ISBN 978-1-4398-5055-8
Electronically Stored Information: Security and Privacy in Smart Grids
The Complete Guide to Management, Yang Xiao (Editor)
Understanding, Acquisition, Storage, ISBN 978-1-4398-7783-8
Search, and Retrieval Security for Wireless Sensor Networks using
David R. Matthews Identity-Based Cryptography
ISBN 978-1-4398-7726-5 Harsh Kupwade Patil and Stephen A. Szygenda
Enterprise Architecture and Information ISBN 978-1-4398-6901-7
Assurance: Developing a Secure Foundation The 7 Qualities of Highly Secure Software
James A. Scholz Mano Paul
ISBN 978-1-4398-4159-4 ISBN 978-1-4398-1446-8
AUERBACH PUBLICATIONS
www.auerbach-publications.com • To Order Call: 1-800-272-7737 • E-mail: [email protected]
Managing Risk
and Security in
Outsourcing
IT Services
Onshore, Offshore and the Cloud
Frank Siepmann,
CISM, CISSP, ISSAP, NSA-IAM, NSA-IEM
CRC Press
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742
© 2014 by Taylor & Francis Group, LLC
CRC Press is an imprint of Taylor & Francis Group, an Informa business
No claim to original U.S. Government works
Version Date: 20131023
International Standard Book Number-13: 978-1-4398-7910-8 (eBook - PDF)
This book contains information obtained from authentic and highly regarded sources. Reasonable
efforts have been made to publish reliable data and information, but the author and publisher cannot
assume responsibility for the validity of all materials or the consequences of their use. The authors and
publishers have attempted to trace the copyright holders of all material reproduced in this publication
and apologize to copyright holders if permission to publish in this form has not been obtained. If any
copyright material has not been acknowledged please write and let us know so we may rectify in any
future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced,
transmitted, or utilized in any form by any electronic, mechanical, or other means, now known or
hereafter invented, including photocopying, microfilming, and recording, or in any information stor-
age or retrieval system, without written permission from the publishers.
For permission to photocopy or use material electronically from this work, please access www.copy-
right.com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222
Rosewood Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that pro-
vides licenses and registration for a variety of users. For organizations that have been granted a pho-
tocopy license by the CCC, a separate system of payment has been arranged.
Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are
used only for identification and explanation without intent to infringe.
Visit the Taylor & Francis Web site at
http://www.taylorandfrancis.com
and the CRC Press Web site at
http://www.crcpress.com
Contents
Foreword xi
PreFace xiii
acknowledgments xvii
chaPter 1 outsourcing 1
History of Outsourcing 1
Early Days of Outsourcing 2
Current State 3
Delivery Models 3
Onshoring 3
Nearshoring 3
Offshoring 3
Outsourcing Types 4
Technology Outsourcing 4
Business Process Outsourcing 4
Business Transformation Outsourcing 5
Knowledge Process Outsourcing 5
Internals of Outsourcing 5
Phases 5
Typical Financial Outsourcing Model 6
Geographical Regions 7
Top Outsourcing Countries 8
India 9
Indonesia 14
Estonia 16
Singapore 17
China 20
© 2010 Taylor & Francis Group, LLC v
vi Contents
Bulgaria 26
Philippines 31
Thailand 35
Lithuania 40
Malaysia 43
Outsourcing Personnel 46
Consulting Personnel 46
Former Employees of Clients 47
Internal Resources 47
Third-Party Personnel 47
Hired Personnel 48
Teams 49
Salaries 52
Growth Strategies 53
chaPter 2 the cloud 55
Software as a Service (SaaS) 55
Platform as a Service (PaaS) 56
Infrastructure as a Service (IaaS) 57
Private Cloud 57
Community Cloud 58
Public Cloud 58
Hybrid Clouds 60
What the Cloud Is and Is Not 61
Beyond the Cloud 62
Virtual Private Cloud 64
Standardization between CSPs 64
Compliance in the Cloud 65
Security and Privacy Issues with Cloud Computing 65
Scalability versus Elasticity 65
On-Demand Self-Service 66
Rapid Elasticity 66
Resource Pooling 67
Outages 68
Denial of Service 68
Virtualization Security 68
Metering 69
Hypervisor Security 69
Virtual Networks 70
Memory Allocation/Wiping 70
Cloud Network Configuration 71
Firewalls in the Cloud 73
Self-Service 75
Malicious Insiders 77
Availability and Service Level Agreements 77
Authentication, Authorization, Accounting 80
Tenant Credibility 81
© 2010 Taylor & Francis Group, LLC
Contents vii
Address the Cloud Security/Privacy Dilemma 82
SAS-70, SOC 1, and SOC 2 Audits 82
Cryptography and the Cloud 83
Encryption Keys and the Cloud 84
Third-Party Cloud Security Providers 85
FedRAMP and the Federal Cloud 86
How to Securely Move to the Cloud 86
chaPter 3 BeFore You decide to outsource 89
Security and Privacy Impacts 89
Secure Communication 90
Telephones 91
e-Mail 93
Mobile/Cell Phones 94
Smartphones 95
BlackBerrys 96
Instant Messenger 96
Letters and Parcels 98
Organizational Impacts 99
Legal Aspects 99
Personnel Issues 99
Technical Challenges 100
Network Address Translation (NAT) Issues 100
Single Sign-On and Federation (SAML/XACML) 100
Backup Technologies 101
Remote Desktop Support 101
Trouble Ticket Systems 101
Business Continuity 102
chaPter 4 readY to outsource 105
Perfect Outsourcing Company 105
Doing Your Homework 105
Understand What Is Offered 110
Audit Reports 110
Is Business Transformation Outsourcing the Right Choice? 114
Ask the Right Questions 115
Dedicated Resources or Not? 115
Talking with Existing Clients 116
What Matters for the Outsourcing Company? 117
Challenges Outsourcing Companies Face 118
Which Security Controls—Ours or Theirs? 119
Staff Augmentation 119
Complete Outsourced Operation 119
Cost Savings 120
Security Controls 121
Next Step—Clean House 126
Maturity Level 126
© 2010 Taylor & Francis Group, LLC
viii Contents
Alignment of Strategies 127
Transforming 127
Outsourcing Preparation 128
Information Security Policy 128
Organization of Information Security 129
External Parties’ Security 130
Information Classification Security 131
Prior to Employment Security 131
During Employment Security 132
Termination or Change-of-Employment Security 132
Secure Areas Security 133
Equipment Security 134
Operational Procedures and Responsibility Security 137
Third-Party Service Delivery Management Security 137
System Planning and Acceptance Security 138
Protection against Malicious and Mobile Code Security 139
Information Backup Security 140
Network Security Management Security 140
Media-Handling Security 141
Exchange of Information Security 142
Electronic Commerce Services Security 144
Monitoring Security 145
Business Requirement for Access Control Security 148
User Access Management Security 148
User Responsibilities Security 150
Network Access Control Security 151
Operating System Access Control Security 154
Application and Information Access Control Security 156
Mobile Computing and Teleworking Security 158
Security Requirements of Information Systems 159
Correct Processing in Applications Security 161
Cryptographic Controls Security 162
Security of System Files 163
Security in Development and Support Services 164
Technical Vulnerability Management Security 166
Reporting Information Security Events and Weaknesses
Security 167
Management of Information Security Incidents and
Improvements Security 169
Information Security Aspects of Business Continuity
Management 171
Compliance with Legal Requirements Security 173
Information Systems Audit Considerations Security 178
Outsourcing Security Readiness Assessment 180
Tactical Goals—Now or Later? 182
Strategic Objectives—When? 182
© 2010 Taylor & Francis Group, LLC
Contents ix
chaPter 5 daY one and BeYond 185
Enabling the Outsourcing Company 188
Access to Required Information 188
Documentation 189
Personnel 189
Transition Phase 190
The Stable Years 191
Security Incidents 191
Outsourcing Personnel Turnover 192
Regular Activities 193
Reporting 195
chaPter 6 when we Part 199
How to Prepare 200
The Contract 200
Analysis of What Needs to Be Done 201
Exit Plan 201
When the Day Comes 202
Taking Control 203
chaPter 7 outsourcing anecdotes 205
British Health Records 205
Transportation Strike in Bangalore 206
Submarine Cable Cuts 206
Cloud Outages 207
T-Mobile: Sidekick in Danger of the Microsoft Cloud 207
Outages at Amazon Are Sometimes due to “Gossip” 207
Google Services Impacted by Cloud Outages 208
Microsoft’s Azure and Hotmail 208
Salesforce.com’s Cloud Goes Down 208
CloudFlare DDoS 208
Background Investigation Lacking 209
Privacy Laws—Not Here 209
Can You Hear Me Now? CDMA Limitations 209
Overlooked 210
Premature Transformation 210
Public Instant Messenger—Share the Joy 210
© 2010 Taylor & Francis Group, LLC