ethics - The Institute of Internal Auditors South Africa

AUDITING THE THUNDERS IN THE CLOUD
Figure.1 shows a cluster of cloud service providers (CSP). Amazon leads the pack. The trend
in Africa may be slow but cloud is an undeniable reality. Like any other IT enabled investment
the strategic objectives of cloud implementation remain business IT strategy alignment,
value creation (value delivery), risk management (value preservation) and resource management
(optimum utilisation of resources).
SERVICE MODELS:
Cloud computing service models are
broadly divided into three categories:
Software-as-a-Service (SaaS), Platform-asa-Service
(PaaS) and Infrastructure-as-a-
Service (IaaS) also known as Utility Computing.
Collectively all the service models
Figure.2
Broad
Network Access
Software as a
Service (SaaS)
26 | IA ADVISER September 2011
Rapid Elasticity Measured Service
Resource Pooling
Platform as a
Service (PaaS)
can be referred to as IT as a service (ITaaS)
or the SPI Model.
DEPLOYMENT MODELS:
As illustrated in Figure. 2 there are four deployment
models for cloud services namely
private, community, public and hybrid.
On-Demand
Self-Service
Infrastructure as a
Service (IaaS)
Public Private Hybrid Community
Essential
Characteristics
Service
Models
Deployment
Models
PRIVATE CLOUD
A private cloud is a proprietary network or
a data center that supplies hosted services
to a limited number of people. The cloud
infrastructure is operated solely for a single
organization. It may be managed by the
organization or a third party, and may exist
on-premises or off premises. When a service
provider uses public cloud resources to create
their private cloud, the result is called
a virtual private cloud. The private cloud
deployment method has minimum risk as
identity management and corporate, legal
and regulatory audits are easy to perform.
Scalability and agility options may be limited
in a private model.
COMMUNITY CLOUD
Community cloud infrastructure is shared
by several organizations and supports a
specifi c community that has shared concerns
(e.g., mission, security requirements,
policy, or compliance considerations). It
may be managed by the organizations or a
third party and may be hosted on-premises
or off -premises. Community model may be
a cloud provided for insurance companies
or fi nancial institutions. The disadvantage
of a community model is that data of competitors
may be stored together for example
clients for Hollard and Federal Mutual
Insurance companies may be hosted on
the same database; subject to the contractual
and service agreement with the CSP.
PUBLIC CLOUD
The cloud infrastructure is made available
to the general public or a large industry
group and is owned by an organization
selling cloud services. Public CSPs off er
relatively undiff erentiated services. They
sell services to anyone on the Internet. Currently,
Amazon Web Services is the largest
public cloud provider.