Cloud Computing Strategy and Risk Assessment for VideoDev Ltd

This report analyzes VideoDev Ltd's plan to migrate its infrastructure to a cloud platform. It begins with an introduction to VideoDev, a video production company, and its strategic decision to move to the cloud for increased flexibility and cost savings. The report then details the cloud computing architecture, differentiating between IaaS, PaaS, and SaaS models, and assessing their suitability for VideoDev. It discusses the benefits and issues associated with each model. The core of the report focuses on the risks associated with the adoption of a microservice strategy, including lack of data encryption, poor consent, insufficient security risk assessment, weak security management, poor data redundancy, failure to verify and identify, vulnerable APIs, and denial-of-service attacks. It provides recommendations for mitigating these risks, including the use of VPNs, SSL/TLS encryption, strong SIEM systems, and DDoS mitigation devices. Finally, the report concludes with a summary of the key findings and recommendations for VideoDev Ltd.

Running head: CLOUD COMPUTING
CLOUD COMPUTING
Name of the Student
Name of the University
Author Note:

1CLOUD COMPUTING
Table of Contents
Introduction..........................................................................................................................2
Discussion............................................................................................................................3
Cloud architecture used for deploying it.........................................................................3
Benefits and Issues of deployment of architecture..........................................................4
Risk associated new Micro Service Strategy and possible control..................................6
General Information Security Steps and Control...........................................................11
Recommendation for Video Dev BCP..........................................................................13
Conclusion.........................................................................................................................14
References..........................................................................................................................16

2CLOUD COMPUTING
Introduction
The following report is all about VideoDev Ltd, which is known to be video and
production development organization working in Australia and New Zealand. The organization
is planning to move some of its system infrastructure to the cloud platform. VideoDev Board is
focusing to move away for increasing the flexibility and responsiveness of the organization
(Botta et al., 2016). In addition, it focus on moving to achieving some saving on the overall cost
of maintaining their present infrastructure in the cloud. Video is currently being engaged like a
consultant for advising the use of cloud computing for day to day operation. There are around
100 video production, engineering and support staff which works on a different project for its
clients based in Australia and New Zealand. At present, the organization is completely engaged
in providing re-factoring of their video services by making use of a certain application like
microservice approach. VideoDev has been in the direction for analyzing the possibilities which
open up videoDev in the upcoming days (Hashem et al., 2015). In addition, the organization
have come to a decision of starting to migrate the current web services into on-premises data
centres to a public cloud. The organization has come up with strategic proposal as they have
planned for retaining Sydney data center for storage of data. It ultimately helps in providing
some updates for active directory and infrastructure for data storage. The mere focus is all about
moving the current infrastructure into cloud.
In the coming pages of the report, an overview has been provided for cloud architecture
that is needed for assisting VideoDev for meeting the broad strategy for moving web services. In
addition, the benefits and issues that can result in deployment of each architecture has been

3CLOUD COMPUTING
provided. The next deals with risk associated with the adaptation of new Microservice strategy
has been provided.
Discussion
Cloud architecture used for deploying it
Cloud computing is defined as the growing IT technology for most of the business around
the globe. Cloud is a huge topic which focuses on different kind of online services. Many
organization consider cloud services important for their business (Almorsy, Grundy & Müller,
2016). It is very important to differentiate in between the IaaS, PaaS and SaaS which are core
cloud models. This particular model is completely dependent on the business needs and number
of task which an individual wants to do. There are mainly three model of cloud services. Each of
these comes up with benefits and particular characteristics.
IaaS: It is considered to be much similar to the traditional data center. Cloud
infrastructure providers make use of virtualization technology for providing proper system
resource like server and resources. This particular model is very much beneficial for different
client as they do not need buy any personal hardware and management of components (Chen et
al., 2015). It can be deployed in their platform and application are provided in virtual machine. It
aims to offer same kind of technologies and capabilities for most of the physical data centers.
IaaS provider is completely responsible for whole infrastructure where user can have proper
control over it. User are completely responsible for installing and maintenance of application and
operating system. It can be used for security, middleware and data (Gai et al., 2016). IaaS user
can easily compare the overall cost and performance of various providers. It is needed for
selecting the most suitable option so that user can access by making use of single API.

4CLOUD COMPUTING
PaaS: In cloud computing, it is a well-known framework for creating software so that it
can be delivered on the internet platform. It aims to offer a suitable platform where different
software components and tools can be built easily. It is mainly achieved by which developer can
easily create, test, launch and customize various application (Stergiou et al., 2018). PaaS vendor
aims to manage different kind of server and operating system updates, backups and patches.
Client focus on the application development and data without considering any kind of
infrastructure, maintenance and middleware.
SaaS: By making use of this offering, user can easily get the ability for accessing the
vendor cloud data depended software. User does not need to download and install any SaaS
application on their local system, but in some cases, it requires plug-ins (Ali, Khan & Vasilakos,
2015). SaaS software reside in the remote cloud network can be easily accessed by making use
of web based application. This kind of application can be used by customer for collaborating on
certain projects. SaaS is a well-known category in the domain of cloud computing. It provides
the manager with list of things needed for hardware sustainability to the functioning of
application. Client is not responsible for any kind of thing in this particular model where they
can make use of programs for completing the given task (Xia et al., 2016). Client software aims
to experience certain number of experience based on provider requirement.
Benefits and Issues of deployment of architecture
IaaS comes up with certain number of benefits like
 This particular model is considered to be flexible and dynamic for usage.
 It is found to be cost-effective as user need to pay as per the cost- per go pricing.
 It makes use of automated deployment of hardware which makes it easy to use option.

5CLOUD COMPUTING
 All the given task can be managed virtually so that employees have much more time for
doing other tasks.
IaaS comes up certain number of issues like
 It has issues of data security as a result of multitenant architecture.
 Outages of vendor makes the customer for inability for accessing data for period of time.
 There is proper team for providing training so customer so that they can learn about the
ways of managing the infrastructure (Jalali et al., 2016).
PaaS comes up with certain number of benefits like
 PaaS built software are known to be highly scalable, multi-tenant which cloud is
completely based.
 The complete development process is found to be quickened and much simplified.
 It reduces the overall expenditure for creating testing and launching different application
 Automation of organization policy
 It merely reduces the amount of coding which is needed
 It provides time for easy migration to cloud platform.
PaaS comes up certain number of drawbacks like
 This model has issues with respect to data security
 The current model is compatible with current infrastructure.
 There is dependency on various aspect like speed, support and reliability.
SaaS comes up benefits like
 There is no cost of hardware
 There is no need for initial cost for setup of services

6CLOUD COMPUTING
 Upgrades on automatic basis.
 Compatibility with cross-device
 Easily accessible from any given location.
 It can be easily customized
 It is fully scalable
SaaS comes up certain number of drawbacks like
 There is loss of complete control
 There is need for proper connectivity
 It has limited range of solutions.
For this VideoDev Ltd, the most suitable model is IaaS as it some benefits like
 As IaaS can be used in organization when it is a small firm or even startup which has no
budget for creating its own infrastructure.
Risk associated new Micro Service Strategy and possible control
Microservice is a software architecture and it is growing day by day to fulfil the demands
of the customer. Microservice is not a fully hybrid architecture. This architecture has many
problems in network execution, management, and security protocols (Chang, Kuo &
Ramachandran, 2016). The main problem in the Microservice strategy is not enough risk
assessment, poor data repetition, lack of data encryption and many other threats. The manager of
an organization is not capable to maintain the rule of Microservice strategies. Risk associated
with the microservice strategies are followed:
Lack of data Encryption:

7CLOUD COMPUTING
MitM (Man in the middle) is a network attack that can occur in network transmission.
The manager of an enterprise must encrypt their sensitive information to avoid MitM attacks.
Shield transmission is a valuable process to prevent this kind of attack. To avoid MitM attacks
organizations must use a strong VPN and reliable proxy server (Sen, 2015). They must encrypt
all the data by using SSL or TLS. They must use Secure Shell to unencrypted data in a network.
A secure shell is a tunnelling protocol that can be unencrypted data securely over a heavy traffic
network.
Poor Consent:
Hybrid clouds need activity to work properly. Public cloud provider and private cloud
provider is two types of a cloud provider are available in the market. Maintain cloud consent is
difficult in a hybrid cloud (Varghese & Buyya, 2018). To avoid this problem, public cloud
providers and private cloud providers must be work together. To maintain data security in the
industry this two cloud providers must follow all rules.
Insufficient Security Risk Assessment:
In the IT industry, risk assessment is very important to prevent system failure. When a
company fails to perform risk assessment it is very difficult to avoid data loss. Accurate risk
assessment must be performed all the time to prevent data lose. IDS/IPS system must be scan all
time to detect malicious heavy traffic (Villari et al., 2016). A strong SIEM system is the best way
to handle network organization security.
Weak Security Management:

8CLOUD COMPUTING
Many organization managers failed to identify management and they are also failed to
understand the authorization procedure of cloud providers. Enterprise managers must be
controlled private and the public could security protocol (Gangwar, Date & Ramaswamy, 2015).
It is not appropriate to maintain data storage for the public cloud.
Poor data Redundancy:
A poor data redundancy puts your cloud at risk. This is the true factor if companies do
not have data copies properly distributed in all data centers, organization can lose their sensitive
data (Li et al., 2018).They must use one cloud provider for all data centers to prevent this
problem.
Failure to verify and Identify:
Risk assessment is essential to combine private and public cloud in a hybrid situation. To
prevent this problem every enterprise must be active and careful. They must monitor all activities
and verify every access permissions (Mastelic et al., 2015). By using IMS an organization can be
synchronized their data so they can prevent this problem.
Vulnerable API:
API can expose all sensitive data when malicious attacks occur. Due to malicious attacks
API fails to authentication properly so sensitive data can be exposed. To prevent this problem
always need to verify third party developers and developers securely handle API keys (Etro,
2015). API keys must be maintained as encrypted.
A denial-of-service (DoS) attacks:

9CLOUD COMPUTING
Dos attackers can reach the cloud by using DoS attacks. This is one type of cyberattack.
Dos attackers can access the target system and modify sensitive data. This kind of attack can be
done by sending bad REST request from the organization (Díaz, Martín & Rubio, 2016). To
prevent this attacks organization must use a flow analytics tool. But this tool is very slow in
performance.
Distributed Denial of Service Attacks (DDoS):
DDoS is more dangerous than DoS attacks. DDoS attackers target system or cloud by
exposing trojan. Attackers can access multiple systems by using a DDoS attack. The most
common DDoS attacks are traffic attacks, Bandwidth attacks, and Application attacks. By using
DDoS mitigation device DDoS attack can be prevented (Tong, Li & Gao, 2016). DDoS
mitigation device always checks for all outgoing and incoming traffic.
Bad IP protection:
IP always required protection. IP must have proper encryption and security. IP can
determine risk assessment (Singh, & Chana, 2016). Poor IP protection can make system failure.
To prevent this problem enterprise must secure their internet infrastructure. They must create a
permission matrix.
Absence of data ownership:
Cloud providers must review their security when they are accessing data. If cloud failure
occur enterprise can able to use their own data (Chen et al., 2015). To prevent this problem Data
ownership must be authorized.
Problem to Communicate cloud provider:

10CLOUD COMPUTING
In Risk assessment cloud providers must know all the requirements the company needed.
To prevent communication errors call someone, another cloud provider to prevent data loss.
Architectural design:
A hybrid cloud is a complex architecture. This architecture works with private and public
clouds (Bitam, Mellouk & Zeadally, 2015). To maintain this architecture provider needs expert
IT staff to build an entire application so an experience IT expert needed to build an end to end
infrastructure.
Data Leakage:
Due to incomplete security protocol, data can be corrupted or destroyed. To prevent this
problem the provider must focus on security protocol.
Management Strategies:
When everyone knows what strategies need to do then a hybrid cloud management
system will be accomplished. Cloud providers must know what cross-platform is and how it can
manage a hybrid cloud system.
Risk Name Descriptions
Lack of data
Encryption
Enterprise must encrypt all the data by using SSL or TLS to prevent data
loss.
Insufficient
Security Risk
Assessment
Accurate risk assessment must be performed to prevent data loss.
Poor Consent To maintain data security private and public cloud providers must follow

11CLOUD COMPUTING
all rules.
Data Leakage To prevent data leakage providers must focus on security protocol.
Architectural
design
To maintain this architecture providers need expert IT staff to build an
entire application.
Management
Strategies
Cloud providers must know what cross-platform is and how it can
manage a hybrid cloud system.
Weak Security
Management
Enterprise managers must be controlled private and public could security
protocol.
Failure to verify
and Identify
Every enterprise must be active and careful to prevent identification
failure.
IP protection Enterprise must secure their internet infrastructure.
Vulnerable API API keys must be maintained as encrypted.
DoS By using DDoS mitigation device DDoS attack can be prevented
General Information Security Steps and Control
Big enterprises have large Microservices infrastructures. It is very important to
understand the concept of Microservices to secure the service and prevent breaches. Application
security is a very important attribute in Microservice because a single failure can cost millions.
But many big organizations ignore security methods (Jonas et al., 2017). They can easily secure
their applications by using a vulnerability scanner, and a passive threat model can detect threats
easily. But these two steps are not sufficient to protect an enterprise application. In the IT
industry every day new threats are being discovered.