ITC561 Cloud Computing: Risk, Security, and Management

Desklib provides solved assignments and past papers to help students succeed.

ITC561 - CLOUD COMPUTING
RISK, SECURITY AND
MANAGEMENT
ASSESSMENT ITEM 4

Contents
Introduction......................................................................................................................................3
TASK 1(Architectures)....................................................................................................................4
TASK 2(Risk Assessment)..............................................................................................................8
TASK 3(Information security)......................................................................................................15
TASK 4(Changes to BCP).............................................................................................................17
TASK 5(Micro Service Management)...........................................................................................20
TASK 6(Forum Interaction)..........................................................................................................24
Conclusion.....................................................................................................................................27
References......................................................................................................................................28
List of Figures
Figure 1: Three-tier architecture......................................................................................................5
Figure 2: Baseline architecture........................................................................................................6
Figure 3: Auto-scale architecture.....................................................................................................7
Figure 4 : Micro services...............................................................................................................13
Figure 5: Threats during the implementation of Plan....................................................................17
Figure 6: BCP and DRP.................................................................................................................18

Introduction
The present report is all about a company VideoDev which is a video and production
development company which operates their business and fulfils the demand of Australia and
New Zealand clients. The company has decided to move towards the cloud services and adopt
the various strategies of risk, security and management. This assessment is all about the security,
risk and the management. The firm has decided to retain their data into the data centre of Sydney
to store the data of their organisation. The firm is moving towards the cloud services just to
enhance the customer demand and the responsiveness towards their demand. By implementing
the cloud services the firm will able to get the high availability in supplying the data to their
clients and the employees. Along with this they has also planned to change their software
architecture just to attain the benefit of scalability and flexibility and this can be possible by
moving towards the micro services model. The company is considering the strategy of risk and
security to enhance the flexibility and responsiveness. The present is categorised into the six
sections, the first is going to describe about the proposed architecture of VideoDev in which
various cloud architecture is going to be describe along with their benefits and issues. The
second section is going to describe about the various risks. The third section will define about the
information security and the fourth will evaluate about the changes held to BCP. In addition with
this, the management towards the micro services are defined along with the individual interaction
on forum. Thus, the entire report has included the description of the risk, security and
management.

TASK 1(Architectures)
Proposed architecture
The architecture is VideoDev is proposed to many components which consist of database,
applications and the software capabilities. The architecture of the cloud defines the components
as well as the relationship between them (Aderaldo, et.al. 2017, May). The architecture of the
cloud includes the various architecture such as Three-tier architecture, Baseline architecture, auto
scale architecture.
Three-tier architecture
This is the architecture which is defined as the design patter of software and well-structured
software architecture. This is also said as the client server architecture in which the client sends
the request to the server and the server is the only one who accepts and fulfils the request of the
client by responding them back (Adler, et.al. 2018). In this architecture the data access, user
interface, functional process and the data storage of the computer is developed and maintained
on the individual or single basis at the separate platform. This is thearchitecture which helps to
save the money and expenses. This architecture accepts the threat and this is used for the
expansion of the growth of the business or the organisation. The main advantage of this
architecture is that when any of the user is not having the permission to access the database then
till then the data is secure, similarly on the other hand the major drawback of this architecture is
that this is very complex in nature and it is very difficult to maintain and set up this architecture.
Also the separation of the three tier can affect the performance of the three tiers in this
architecture (Al-Debagy & Martinek, 2019). Another main benefit of this architecture is that this
is upgraded or updated and can be replaced independently.

Figure 1: Three-tier architecture
Baseline Architecture
This is also the cloud architecture which defines as the single server at this architecture. This
architecture includes the single site and this single server is divided into a physical or virtual
server which together involves the web server. The main issue which this architecture is that this
is having the security issue, the one can adjust anything but each of the individual or company
needs the security of their data. These types of the architecture are used in the job of production
and are also use for the design purpose and enable the designers to form the elements quickly
without handling the issues related with the communication and the lining between the various
servers mainly in separate places. The baseline architecture is also said as the single site
architecture and this is designed with the help of various computer properties which are
positioned at the similar places (Bakshi, 2017, March). The main advantage of this architecture is
that this handle the basic requirement s along with the useful components.

Figure 2: Baseline architecture
Auto-scale architecture
High availability and the scalability has become the buzz word from the last five years of the
software industry and this is because of a very strong reason behind that. Auto-scaling and the
AWS load balancing helps to form and self-healing architecture along with the elastic with very
few efforts. Some of the company members are not satisfied with the cost of the load balancer
and they started argue about that and making as a discussion instead of resolving that issue. The
best thing is to use the DNS point instead of the IP because this makes the design easy and
simple with low cost. The main advantage of cloud computing is that this define that what is
required and when it is required and make the capacity according to them. Thebasic advantage of
auto-scaling architecture is that this uses the scaling features in better way. This can allow the
VideoDev organisation can scale up and scale down their resources with the help of this
architecture (Balalaie, et.al. 2016). Along with this, the main advantage of this architecture is
that this does not provide the failover and the redundancy of the data.

Figure 3: Auto-scale architecture
Thus, with the evaluation of all the architectures of cloud computing, this is to conclude that the
baseline architecture is the best for the VideoDev Company because this is suitable for the
proposed strategy selected by the company. In the context with the company, as they are
deciding to move towards the cloud services just to enhance the flexibility and responsiveness
than for this the three tier architecture is going to best as theyprovide them the protection from
the failover and redundancy in the data (Choi & Readshaw, 2017). Along with this the baseline
architecture is going to support the micro services as this will helps them to increase the
scalability and high availability. This architecture will be the best for the VideoDev Company as
they will allow the software developers to create such functions which will resolve all the issue
related to the increment of the flexibility and the communication gap between the employees and
the customers of the organisation.

TASK 2(Risk Assessment)
Risk report related to the micro services
Public cloud Risks
VideoDev Company has decided to choose the public cloud for the data storage as they want to
store their data in the data centre of Sydney as per the strategies made by them. There are various
risks which are to be generated while storing the data ate the public cloud and all of these risks
are outlined below -
Name of the Risk Description about the Risk Control over the Risk
Shared Access This is the risk which defines
that the users who have the
access to use the data can only
prefer to enter in the data
storage. The individual shares
the access and by this the
other unauthorized peoples are
also able to use the data stored
in the database whichcomes
with the risk of loss of the data
and might this can be hacked.
Also the users are taking the
wrong use of cloud services as
the users are using the SaaS
which is termed as software as
a service in which the users
shares the similar data with
number of clients which
means that the information is
recorded in the shared
database system and also all
this results in the leak of the
private information with the
other personnel’s.
The control over this risk can
be done by giving the
permission to only one user to
do the modifications and set
the limit for the other people’s
so that no one can get the
access to use the data which is
stored in the database. The
user can also use the services
of the cloud such as Iaas
which is known as
infrastructure as a service win
which the information is limit
to only one hardware and can
be used at the single platform
(Dragoni, et.al. 2017, June).
Limited control In this risk, most of the users
are using the same data at the
public cloud and all of them
having the permission to
access the data. Thus this
shows that this risk can be
To control this type of risk
SLA can be used as this helps
to avoid the clashes and
provide the security. Along
with this to keep the data
secure and to protect the data

generated as this is having the
limited control as anyone can
share and access the personal
information also of anybody
and this is wrong that no one
can keep their data secure on
the public cloud.
the organisation must use the
cloud service provider which
is used to protect the file
sharing.
Security As this is known by everyone
that the public cloud is having
the multiple users and this
possess their own threats of
security as on flaw of
infrastructure can make the
entire environment weak
(Eriksson, 2017). The
multitenancy can allow the on
hacker to view and access the
data and can assume the
identity of the other user or
client.
The public cloud can control
this risk by limit the data as
this will make difficult to
enforce e the policies of the
security and also limits all the
control to authorize and
authenticate to the data. All
this will create the security
over this risk.
Ownership About this risk many of the
users are unaware that the
public clouds are using their
own data. Along with this
many of the users are having
many issues with this risk that
many of the service providers
are stating that the customer’s
data is their own data (Fan &
Ma, 2017, June). This is the
loss of customers that their
data is used by the service
providers as they are one who
are owner of that data. Many
of the organisations have the
contact with their client that
they will going to keep their
data private.
To control over this type of
risk, this is best to read the
SLA and ensure to the
company to hold the right
data. This will protects them
legally and ensures that this
will going to maintain their
data on the safe basis and
allow them to create the
revenue stream by selling the
data.
Risk related to the data storage
VideoDev has decided to own the data centre of Sydney for storing their data as the data storage.
This is having very delicate data and information in the active directory and this requires the
strong infrastructure for storing their data as the database (Erl, 2016). The major risk related to
the data storage are stated as below -

Name of the Risk Description about the Risk Control over the Risk
Natural Hazards This is the major risk which
can be occurs at any time and
this risk is volatile in nature
and cause to huge loss. The
natural hazard includes the
occurrence of the earthquake,
floods, fire, etc. All of these
incidents can cause the high
loss of the data which is stored
in the ware house along with
the loss of property.
This risk can be control if the
company can take the backup
of all the data and have the
capability to handle such risks
and have the courage to
handle and maintain these type
of situations.
Malware There are various malware
which can cause to many of
the data loss such as the
malware are of many types
like worms, Bots, Trojan,
spyware, etc. All these can
occur anytime and results in
the loss of the file or program
in any of the computer system.
Malware are refers to as the
malicious software and this
software can be able to
perform the various operations
such as deleting, altering, and
hacking the data. Along with
this, they can also be able to
maintain and operates the
user’s activity without the
permission of the authorized
users.
This type of risks can be
resolved by the installation of
the anti-malware system as
this can protects the entire
system. Along with this
various or different firewalls
can be used to enhance the
level of the security.
Backup and Scalability The main advantage of this
risk is that the services
providers of the public cloud
are providing huge number of
resources. These resources can
able to enhance the scalability
which cannot be achieved by
the data storage. The other risk
with the data storage is that
they does not provide any
back-up of the data which is
stored in the database. This
can result in the unavailability
and VideoDev is trying to
To control these types of risks
the backup must be taken with
the time for the safety of the
data. The system must contain
the backup as well as the
recovery plan just to secure
the whole data which is stored
in the database.

enhance their high availability.
Thus this risk must be
controlled by the company
else this will result in huge
loss of the data without any
backup.
Unauthorized Access This risk defines that any of
the user can be able to modify
and access the data andthe
public cloud is the physical
and multitenant environment
for them and this can be very
common risk which can be
occur anytime. The user can
also hack the confidential data
and the private information of
any user.
To control this risk the
appropriate
authorizationssettings must be
set in the system of the
organisation. The effective
system to authorize. The
organisation can also use the
biometric system for the
proper authorization of any
person to access the data with
the full permission.
Risk related to cloud computing
The company has decided to switch their web services to the cloud platform just to attain the
high rate of availability and responsiveness. The risk which might occur at the cloud computing
platform are stated as below -
Name of the Risk Description about the Risk Control over the Risk
Outflow of the data This is the risk which is
related with the leakage of the
data, the data which is used by
the internal persons of the
VideoDev can be access by
them is secure as the data is
accessed by the owners only
but the other section which is
used by the outsiders of the
organisation is not safe. Thus,
the leakage of the data can be
occurs by the outsiders of the
organisations. The company
has the potential to protect the
data from the outsiders but
then also the service providers
of the cloud can accidently
To control this type of risk the
protocols related to the secure
communication can be
adopted by the organisation.
In addition with this, the
authorization and
authentication techniques and
the policies along with the
encryption technologies must
be adopted by the
organisation.

expose the organisation data to
the illegal and unauthorized
persons.
Online Risks Most of the cloud services are
attached and linked with the
internet, and by this the
occurrence of the online risk
can be occur and can result in
the huge loss of the data. The
attacks which are related to
the internet can be occur by
the phishing, spoofing, etc.
This risk can be control by the
implementation of the various
security tools such as
firewalls, detection system can
protect the company’s data
from the various online
attacks.
Insecure API As VideoDev company is
adopting the services of the
cloud then the application
programming interfaces can
lead to the occurrence of the
safety issues.
To control such type of risk
this is very necessary that the
organisation must ensure and
use the appropriate API
security.
Account Hacked The account of the
organisation can also be
hacked by the various hackers.
The hackers can hacked and
steal the credentials of the user
of VideoDev company.
This risk can be handled by
the implementation of the
proper mechanism of the
authentication and
authorization.
Virtual exploits This risk is related to the
virtual behaviour of the cloud
in which if the hardware is lost
or the system get crashed then
the data get lost and this can
result in the unsecure of the
data. This risk arises when the
issue is arises with the relation
of the physical machines in
the physical environment.
This risk can be controlled
with the use of the secured
connection just to prevent
from such type of risk. Secure
connections prevent the data
from the outsiders and
unauthorized persons.
Risk related to micro services
The VideoDev Company has decided to implement the micro services model in their
organisation just to make the changes in the present structure of the web software. Thus this
results in the occurrence of the risk with the implementation of the micro services. The risk are
defined as below –