# ERMOCTAVE: A Risk Management Framework for IT Systems Which Adopt Cloud Computing
## 4 Case Study with Microsoft Azure Cloud
### Applying ERMOCTAVE Phase 1  
* Objective setting
* Objectives: In our scenario, the business of the company is to manufacture specialist electronic components for online sale. It aims to maximize capacity to process customer orders, which results in increased company profit. At the same time, its security capability should prevent any problem occuring from network security pitfalls. * Internal environment
* Risk management philosophy: migration of existing on-premises applications to Azure cloud is not direct and it requires considerable effort and redesign to maintain reliability, performance, and security. Cloud services are relatively safe. Therefore, connection between cloud and the applications should be closely observed. * Internal people: there are developers who know about various Microsoft products and technologies including Microsoft SQL Server, Microsoft Visual Studio, and Microsoft Azure cloud technology. The developers hope to use any of the available features that can help to ease their tasks. The security manager decides how the tasks are accomplished by assigning the tasks to the proper people. The transport and delivery functions are performed by separate transport partners which use their own IT services, but this has no impact on applications of the company's cloud infrastructure. * Identify assets Assets to protect
* Information: orders table, audit log, customers data, and product data. * Systems: orders application, SQL reporting service, Azure SQL, compliance application, and monitoring and management application. * Hardware: server on premise. * People: developers and security manager. * External: transport partners, external access to reports, and social identity providers. * Orders table: orders table is an important asset because it is only located in the cloud data center, close to the orders application and it stores all details of orders made by customers. * Customers table: customers table is an important asset because it is needed in order to authenticate visitors and to accept orders from them. Also, customer data is used by a bidirectional synchronization mechanism to replicate information between on-premises network and all cloud data centers hosting the order's application. * Orders application: it is an important asset because it receives all customer's orders. * Azure SQL: Azure SQL is an important asset because it provides data synchronization across cloud and on-premises databases using Azure data sync function. * Server on premises: server is an important asset because it monitors all data (orders, customers, products, and audit log) on premises and maintains all on-premises capabilities efficiently. * Transport partners: through an automated monitoring, they proactively manage the life cycle of orders and shipments. * Social identity providers: they provide authentication mechanism enabling users to access the order application. * (Identify current security practices) it deals with actual actions taken to protect important assets. * Authentication for accessing the orders application uses Azure Access Control Service (ACS) which is a way of authenticating access to web applications and services (Microsoft owned cloud-based service) [24]. ACS can be configured to act as both the token issuer (STS) and the identity provider. * Reliable messaging and communications are required when orders are passed to various transport partners for shipping and are stored for audit and compliance purposes. Such messaging and communication are implemented using Azure service bus, which is a cloud messaging system that connects everything (applications, devices, and services), wherever they are located on cloud, on-premises, or both. * In order to make order processes by customers reliable and scalable, it must be stored and not be lost. Azure service bus topics and queues are provided in order to achieve the needs [26]. The orders applications run in more than one cloud data center. Each orders application owns its set of subscriptions with Azure service bus topics and queues.