# ERMOCTAVE: A Risk Management Framework for IT Systems Which Adopt Cloud Computing
## 4 Case Study with Microsoft Azure Cloud
### Applying ERMOCTAVE Phase 3  
Identify risks to critical assets  
We link each critical asset to a specific identified risk. Database Server on-premise (Risk 3: \"Data loss on-premises\"). Orders Application (Risk 2: \"Azure cloud intrusion\"). SQL Azure, order's table/data, and transport partners (Risk 1: \"Impossibility of outsourcing and contracting with transport partners\"). Which critical assets are targets of human threat actors? Database server on-premise. What are the motives for each human threat actor that might use physical access to violate the security requirements of this critical asset? To see logging activity, customers sensitive information, and reporting service. Create risk evaluation criteria and evaluate risks  
Risk evaluation criteria: we review the risk evaluation criteria and focus on how to define high, medium, and low impact. We borrow the following impact areas from OCTAVE; reputation, customer confidence, productivity, and fines/legal penalties (the number of areas \(I=4\)) [30]. The ranking of the value \(r_{i}\) and impact value \(v_{i}\) of each impact area is decided by the security manager. The notes in Table 1 explain the reason of imposing impact degree on each impact area. In the case study, impact values are assigned quantitative values as follows; High (3), Medium (2), and Low (1). Ranking of each impact area is decided by the security manager and is listed in the ranking column of Table 2. Risk scores calculated using Equation (1) are listed in the risk score row of Table 2. We total the score column, which is the relative risk score. Risk evaluation: Tables 1 and 2 show risk evaluation criteria and risk score calculation for risks 1-3. * Create risk response and protection strategy Risk response
* For risk 1 (impossibility of outsourcing and contracting with transport partners), the risk response is \"Avoidance\" and \"Shared\" because it has the highest risk score value 29. We consider it as top priority risk and must be immediately and fully mitigated. * For risk 2 (Azure cloud intrusion), the risk response is \"Reduction\" and \"Shared\" because we already have an existing authentication mechanism in which we will just improve the mechanism. * For risk 3 (data loss on premises), the risk response is \"Reduction\". Although risk 3 has a low risk score value 14, there are many methods to reduce the risk. For example, backup could be used to reduce the risk. Protection strategy
* What training innovation could help an organization adopting cloud computing used to improve its security posture? * We update security specialist with latest technologies through specific courses on Azure cloud computing. * How to ensure that all staff in organization using cloud understand their security roles and responsibilities? * We include an important example in the security awareness documentation. The example consists of severe consequences if policies are not respected (for example, access to database is temporary blocked or suspended from work). * What can be done to improve resource protection of an organization when dealing with external partners? * We include all procedures in SLA and outsourcing contracts in the content security policy (CSP) [31]. * How to ensure that staff is aware of business continuity and disaster recovery plans? * We include the business continuity and disaster recovery plans for the on-premises policies and procedures. * (Create risk mitigation plans) Which risks will be immediately mitigated? * Risk 1 (impossibility of outsourcing and contracting with transport partners) Which risks will be mitigated later? * Risk 2 (Azure cloud intrusion)
* Risk 3 (data loss on-premises) What actions could be taken to make the mitigation plan? * For risk 1 (impossibility of outsourcing and contracting with transport partners), the service-level agreement must be made, although it is not specified at the contract at the first time. In the case of SLA with cloud computing, QoS is specified.