WIXLIB

- UTH ihltliOffice of Auditing & Advisory ServicesThe University of TexasHealth Science Center at HoustonDecember 11, 2014Report on Institutional Use of Cloud Computing #14-204We have completed our review of the institutional use of cloud computing. This audit wasperformed at the request of the UTHealth Audit Committee and was conducted in accordancewith the International Standards for the Professional Practice of Internal Auditing.BACKGROUNDDefinitionThe most commonly accepted definition for cloud computing comes from the National Instituteof Standards and Technology (NIST), who defines cloud computing as:"A model for enabling convenient, on-demand network access to a sharedpool of configurable computing resources (e.g., networks, servers, storage,applications and services) that can be rapidly implemented with minimalmanagement effort or service provider interaction."Simply stated, cloud computing is the practice of using a network of remote servers hosted on theInternet to store, manage, and process data, rather than a local server or personal computer.HistoryIn 1999, Salesforce.com became one of the pioneers in cloud computing by delivering enterpriseapplications via a simple website. The applications could be accessed by any customer withInternet access and companies were able to purchase the service on a cost-effective on-demandbasis.In 2002, Amazon introduced Amazon Web Services, which gave users the ability to accessstorage, computing solutions, and other applications through the Internet. In 2006, Amazonintroduced Elastic Compute Cloud (EC2), which allowed developers to rent space on theircomputers to store and run their own applications.By 2009, other companies like Microsoft and Google began delivering applications to theconsumers as well as businesses in the form of simple, accessible services. Today, someinstitutions have deployed their own private or hybrid clouds, rather than rely on public cloudsoffered by third parties, which allows institutions to maintain more control over their data. Bythe end of 2015, it is estimated that spending on cloud computing services could be more than 180 billion. More than 60% of businesses are currently utilizing cloud computing for performingIT-related operations.713.500 .3160 phonePO . Box 20036Housrn n, Texas 77225www.urhousrnn.edu713 .500 .3170 fax

Report on Institutional Use of Cloud Computing2BenefitsCloud computing offers significant computing capabilities and economies of scale that mightotherwise require substantial investments in IT resources. Institutions can lower capital costs byusing large-scale computing resources and adding or removing capacity to meet fluctuatingservice demands, while only paying for actual capacity used. Cloud computing provides quickaccess to computing services without additional hardware, software, maintenance or space,which, depending on the complexity, could potentially lower IT operating costs.RisksThe use of cloud computing involves the very same risks found in the traditional IT world;however, they may be increased due to the lack of physical visibility and the perceived loss ofconh·ol over assets and information. Some of these risks include data security, privacy, access,availability, ownership, and monitoring. Internal authorization of cloud computing services isalso essential in reducing the associated risks.Service Delivery ModelsCloud computing is typically implemented in three service delivery models:ClSoftware - applications are hosted by avendor or service provider and madeavailable to customers over a network,typically the Internet. An example would bethe Fusion Talent Management application(Fusion), which is hosted on Oracle's servers.Storage - equipment owned by a third partyis used for storage and/ or backup of filesand data. An example would be Box usedby SBMI.Computing - equipment owned by a thirdparty is used for the execution of a computerprogram. An example would be the rental ofAmazon Web Services for computationalpower needed as part of a large researchstudy. ServersDesktops(Fusion)STORAGE(Box)Lapto psCOMPUTINGPhonesTa bletsDeployment ModelsThe three service delivery models are offered to cloud customers in four deployment models:Public - Made available to the general public regardless of affiliation. All users share the sameresources.Community - Infrastructure is provisioned for use by organizations with similar interests.Private - Services and resources are supplied by and/ or to only a select group like a privatecompany, University, etc.

Report on Institutional Use of Cloud Computing3Hybrid - Using a public cloud provider to build a private cloud. This may include connectionsfrom cloud resources to the local or other remote resources.UsersCloud services are used by both consumers and businesses, as defined below:Consumer Cloud - Allows consumers to access storage or software remotely from a device viathe internet. The consumer agrees to terms of service online and usage is typically free up to acertain level. Payment, if required, is made via personal credit card. Examples include Dropboxand Google Drive.Business Cloud - Service level agreements are formalized and installations can be morecustomized. Billing is more static and not based upon usage. Typically purchased via traditionalcontracts and payment methods. Examples include UTH-Secure Share and Google Apps forEducation (UTH-Share).Assurance & StandardsBoth consumer and business clouds face a multitude of requirements and standards such as PCI,the US Sarbanes-Oxley Act, privacy protections laws, and ISO certification. With the rapidlychanging environment and the number of cloud computing options, the Information SystemsAudit and Control Association (ISACA) has tated that there is still a need for a suitableassurance framework that broadly meets the needs of every type of Cloud Service Provider (CSP)and client. The existing assurance frameworks can be classified into two broad categories:1. Existing widely accepted frameworks customizable for the cloud (i.e., COBIT, ISO 2700x)2. Frameworks built for the cloud (i.e., CSA Security Matrix, Jericho Forum Self-AssessmentScheme).While UTHealth does not currently have a cloud computing policy or related procedures, ITPOL029 Data Classification Policy does address minimum protection requirements to reduce the risk ofa high risk data (PHI, confidential information, etc.) loss: Provide protection from unauthorized access, disclosure, modification, theft, and dataloss Risk assessment (performed annually) Strong password requirements Logging and monitoring Access control and monitoring Incident handling-breaches/ unauthorized access/ use or abuse Test backups/DR plans/ contingency plans Change management Data encryption when applicableCloud Computing at UTHealthRecently, UTHealth implemented two local solutions for data sharing and collaboration: NovellFilr ("UTH-Secure Share") and Google Apps for Education ("UTH-Share"). UTH-Secure Share isapproved for HIPAA data, while UTH-Share is approved for all data classifications excludingHIPAA data. Family Educational Rights and Privacy Act (FERPA) data may be stored andshared in either UTH-Secure Share or UTH-Share.

Report on Institutional Use of Ooud Computing4OBJECTIVESThe objective of this audit was to provide management with an understanding of the use andrisks associated with cloud computing at UTHealth.SCOPE AND METHODOLOGYThrough a review of authoritative information on cloud computing, interviews with users and ITpersonnel, and a review of contracts and other agreements, Auditing and Advisory Services(A&AS) performed an audit of the current institutional uses of cloud computing.AUDIT RESULTSCloud Computing RisksRisks associated with consumer and business cloud products are similar, though the severity ofthe risk varies greatly depending on the cloud services model. Controls in the UTHealthenvironment focus on the business cloud uses and few controls are in place governing the typesof data uploaded to consumer cloud sites. Data shared in one of the business clouds (UTHSecure Share) resides on internal servers and is protected by firewalls, access controls, and otherinformation security protocols. A&AS ranked the risks for the consumer cloud and the businesscloud separately.Top Cloud Computing RisksAn independent third-party assessment of the CSP toassess control procedures may not be conducted orreviewed by UTHealth.Data stored in the cloud could be lost, stolen, orimproperly accessed.Data stored in the cloud could be stored in unsafelocations or countries.Risk ecurityHighModerateUTHealth may not be aware of sensitive/proprietaryinformation stored or shared without proper controls.SecurityHighLowPassword complexity and expiration controls may notbe enforced through cloud hLowHighHighHighModerateData may stay with the CSP after the agreement Ownershipexpires or an employee has been terminated.AccessAccess to cloud applications may not be properly2!"anted or revoked.UTHealth may not have appropriate backup of cloud Availabilitydata.MonitoringAdequate policies and procedures for using cloudservices may not exist.Ooud services could be procured or initiated without Authorizationthe involvement of Procurement, IT, or ITS.BusinessCloudHigh

Report on Institutional Use of Cloud Computing5CSPs could be utilizing downstream cloud serviceswithout the knowledge of UTHealth.AuthorizationHighModerateProper agreements may not exist between UTHealthand the CSP.AuthorizationHighLowCloud Usage/Institutional ControlsA&AS obtained a consumer cloud storage activity report for two months (8/7 /14 - 10/7/14)during the audit period. The report indicated a total of 161 gigabytes of data was uploaded byapproximately 219 users. We selected a judgmental sample of 20 users and conducted interviewsto determine the reason for using the consumer cloud service, the type of data (sensitive vs.nonsensitive) stored in the cloud, whether the data is shared with anyone, and why internalsolutions such as UTH-Secure Share and UTH-Share are not being utilized. Of the 20 users in oursample, four were removed due to unverifiable IP addresses or employees being on leave.A&AS interviewed key individuals within IT and the schools in order to develop an inventory(see Appendix A) of business cloud computing services at UTHealth. We documented how eachservice is used, including the types of data stored in the cloud and the common users.Cloud UsageBusiness CloudConsumer CloudOf the 16 users interviewed by A&AS, More than 25 areas use the business cloud forapproximately 88 % reported uploading some aspect of their business function, such as:business information (including de-identified Storage of research dataresearch data) to consumer cloud sites: Computational power for simulationstudies Storage of healthcare data including PHI Disaster recovery and backupPersonal Managing Digital IDsUse Only12%Personal&BusinessUseBusinessUse Only44%A&AS selected four business cloud computingservices utilized by UTHealth for further testing: UTH-Secure Share (Novell Filr)UTH-Share (Google Apps for Education)Amazon Web ServicesBox (utilized by SBMI)For each service, we obtained a copy of the cloudservices contract, inquired about any educationthat the data owner and users have received, andobtained and reviewed the Service LevelWith the exception of photos (which are Agreement and Business Associate Agreement, ifstored with prior consent/release forms), applicable. No issues were noted.users stated that they did not store otherprotected health information (PHI) inconsumer cloud sites. A&AS did not observe