# ERMOCTAVE: A Risk Management Framework for IT Systems Which Adopt Cloud Computing
## 4 Case Study with Microsoft Azure Cloud
### Applying ERMOCTAVE Phase 1
Each transport partner receives orders from a subscription in any of cloud data centers, and posts response messages back to the queue in the data center [24]. * Synchronization of data across cloud and on-premises locations is provided using Azure SQL data sync. It is a data synchronization service between data centers and services. Azure SQL data sync provides a lot of options such as unidirectional and bi-directional synchronization. * Maximization of scalability and control of elasticity in the orders application is implemented using Azure autoscaling application block, which is a service that automatically scales Microsoft Azure applications based on defined rules [24]. We can choose a host location for a block between in Azure and on premises application. After that, Azure autoscaling application block provides the capabilities required. * Maximization of performance in orders application requires efficient management of network latency and maximizing connectivity to the orders application. The ability is provided by Azure traffic manager which routes customer's requests. Azure traffic manager allows setting up request routing and loads based on predefined policies and rules. It provides a way of routing requests to multiple deployments of Azure applications and services regardless of the cloud data center location. Azure caching service improves response time and contributes to the application performance. * Maximization of availability in order applications is done by Azure autoscaling application block too. * Identify current organizational vulnerabilities
* Unclear service-level agreement (SLA): A SLA is a standardized contract between a service provider and an end user where a service is formally defined [27]. In our scenario, SLA has not been documented and described against Azure cloud services. It is important to specify that in cloud computing, because SLA gathers information on all the contracted services and their agreed expected reliability in one document. It clearly specifies expectations, metrics and responsibilities so if there is any issue with the service, neither party can ignore it. SLA ensures that both sides have a common understanding of the requirements. Therefore, lacking an established SLA creates a huge vulnerability in our Azure cloud. * User's authentication and authorization requests in the cloud: the orders application authenticates and authorizes visitors. Traditionally, authentication is carried out in local. Progressively users expect services to be enabled using universal credentials like Windows live, Google, or Facebook. It is called federated authentication, and it provides the opportunity to support single sign-on (SSO) function. With SSO, users sign in to one application using unique credentials (Windows Live ID for example) and can visit other sites that support the credential without authenticating again [28]. However, SSO has some weaknesses: lack of stronger authentication such as using smart cards. If the SSO fails out, users would lose access to all sites as single point of failure, or an intruder can access assets through a crack point. * Unsafe on-premise assets: cloud storage remotely maintains, manages, and backs up data [29]. This service enables the users to save files online, so that they can access them from any location. However, for data stored on premises, if the premise catches on fire or the computer server gets stolen, we will not be able to retrieve data since there is no activated backup system. There is lack of backup processes and disaster recovery plan. * Identify critical assets Which assets will largely impact the organization if they are confidentiality disclosed to unauthorized people? * Server on premises: if the local server is disclosed to unauthorized people, information for monitoring services, logging activity of the orders application, and reporting service would be wrongly exploited and be used for bad purposes. The audit log data which has sensitive information against public would be hijacked and may pollute reputation of the company.