# A Framework for Cloud Based E-Government from the Perspective of Developing Countries
## 4 Case Study
### Cloud Feasibility Analysis
To better address the government concern of their data and information is handled securely we have divided the security measures in two categories. * Physical security: Physical security would assure the government that the data and information are held in a secure location where only authorized people have permission to get access. The data centre of the Data \begin{table}
\begin{tabular}{c c c} \hline \hline
**Category of Risk** & **Risk Type** & **Impact on the Governance** \\ \hline \multirow{4}{*}{Organizational} & Supply chain failure & The supply chain failure could lead to the interruption of the service as the CSP might have been procuring some of their service through third party. \\ \cline{2-3}  & \multirow{4}{*}{Service termination} & Since there are very few companies in Nepal those offer the cloud computing services and their client-tale is not significant there is always a risk of service termination. \\ \cline{2-3}  & & Lock in & The data lock in situation could likely occur in the absence of an alternative service provider. \\ \hline \multirow{4}{*}{Technological} & Security and privacy & Security and privacy is the one of the main risk associated with the cloud computing. The CSP has certain control over the systems hosted in the cloud, therefore their potential impact on the confidentiality and the integrity of the data could not be denied. \\ \cline{2-3}  & Isolation failure & The shared resources in the cloud computing can expose the confidential data to the other tenants. Failure of the isolation of the resources could make the government system vulnerable to attack. \\ \cline{2-3}  & Availability & The government official shows concern in relation to the availability of the service. \\ \cline{2-3}  & Unauthorized access to premise & Since the data and information not in held in the government premise the official have concern over the unauthorized access to the physical location of the data centre. \\ \hline \multirow{4}{*}{Business} & Data protection & The measures applied in relation to the data protection by the CSP which is difficult to check, therefore lack of the mechanism to check whether the CSP is complying with the data protection policies, could lead to legal challenges. \\ \cline{2-3}  & Licensing & The department yet to decide whether the software and application they are using at present might violate the terms and condition by migrating them to the cloud. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Risk assessment for cloud service adoption. Hub & Network Ltd has been visited to see whether they have an appropriate mechanism in place to secure the data and information. The following observation has been made. * 24*7 CCTV monitoring of the premise
* Biometric authentication system in place to enter into the premise
* 24*7 electricity backup
* Second data centre is located outside the valley for disaster management
* 24*7 technical support staff is available to address any issues in system
* ISO 27001:2013 certified data centre  
Logical security:  
Logical security would assure the government that the data and information within the cloud environment is secure from the logical threat i.e., hacker, intruder and virus. The following but not limited to measure have been put in place. * Virtual private cloud  
Since we were using public cloud we have decided to acquire a virtual private cloud within the public cloud environment to minimize isolation failure issues. A virtual private cloud (VPC) is a logically isolated cloud within the public cloud that provides certain level of isolation among the uses. Therefore, the virtual private cloud would reduce the risk of interference and unauthorized access by the intruder. The Data Hub & Network Ltd. has confirmed in the SLA that the government virtual machine will be isolated and networked using virtual local area network (VLAN) using virtual switches. The VLAN allow only specific preconfigured traffic to access the VM through virtual switch port that would add extra layer of security to the data.