Modelo de gestión de riesgos de Infraestructura como Servicios (IaaS) de Cloud Computing para empresas del sector publico ecuatoriano

Abstract

This paper aims to develop a Model of High Risk Management Infrastructure as a Service (IaaS) cloud computing for companies in the Ecuadorian Public Sector, based on COBIT frameworks, OCTAVE and ISO27000, to serve as support Directive on the identification, collection and enforcement of organizational requirements, regulatory and information security as a prerequisite to moving towards Cloud requirement; Once the feasibility of implementing a cloud solution set, the methodology proposes a strategy for the identification, assessment and treatment of the potential risks of cloud service. The proposed methodology is structured in three phases, each interconnected together to allow iteratively incorporate variables not considered or not known which ensures continuous improvement. In the government of the need for cloud Cloud and / or acceptance of residual risk is established, objectives and organizational structure are identified. Phase two or considerations Cloud collects a number of international initiatives to regulate or govern Cloud services and propose mitigation measures to potential risks that threaten the security, integrity, confidentiality, privacy and availability of information. Finally, in phase Cloud Risk Management are identified, analyzed and assessed potential risks of cloud services, the likelihood of an incident from the impact is high. Of which they must be mitigated by the implementation of a set of cost-effective countermeasures that do not exceed the expected benefits.