Find out more about the best practices and Observations regarding cloud and the enterprise risk profile.

1. John Enoch (johnenoc@amazon.com
23 May 2017
Cloud and the Enterprise Risk Profile
Observations and best practices

2. Does direct control =
lower inherent risk?

3. What does AWS Cloud Deliver? Perspectives…
Make moneySave money
Mitigate risks

4. Cloud & Risk

5. Risk Attitude
vs.
Risk Perception

6. On-Premise vs. Cloud Differences in Cost & Risk
Unable to
Serve
Customers
Infrastructure
Cost $
Time
Large
Capital
Expenditure
Opportunity
Cost
Predicted
Demand
Traditional
Hardware
Actual
Demand
Automated
Virtualization
Quantifying:
• Cost Efficiency
• TCO
• Optimisation
• Trade-offs
• Risk
• Reward

7. Why cloud decisions impact risk profiles
?

8. Risk assessments determine business outcomes
“ It's a very sobering feeling
to be up in space and
realize that one's safety
factor was determined by
the lowest bidder on a
government contract.”
Alan Shepard,
Apollo 14 Astronaut

9. Objectives Setting & Value at Risk
Finance
• Capex ↓↓
• Opex ↓↓
• Opportunity cost ↓↓
• Risk premium ↓↓
• Revenues ↑↑
Productivity
Quality &
Risk
• Cycle Times ↓↓
• POC Delivery ↓↓
• Innovation ↑↑
• Speed to Market ↑↑
• Complexity ↓↓
• Defects ↓↓
• Outages ↓↓
• Support overhead ↓↓
• Compliance ↑↑
• User satisfaction ↑↑
• BI quality ↑↑

10. Cloud: Many Choices… Risk Impact, Likelihood?
Status Quo Limited change Transformation
Risk?

11. Cloud adoption and change
TCO Modeling
Staff Productivity
Business Benefit
Typical One-time activities that
increase cost for the migration
duration.
• Planning and Assessment
• Duplicate Environments
• Staff Training
• Migration Consulting
• 3rd Party Tooling
• Lease Penalties
Cost$
Time
Current
Operating
Cost
Target
Operating
Cost
Benefit Realization
• Infrastructure Savings
• Staff Productivity
• Business Value
5% 10% 30% 60% 80% 100%
Migration Cost Bubble
Benefit Realization Schedule

12. Case study outcomes

13. A reduced risk approach to change
Context
Cost & Benefit
Analysis
Consensus
(written)
Communication
Executive Oversight
Define vision
List Stakeholders
Assess Readiness
Define Objectives
List Alternatives
ERM Framework
Accountability
Knowledge gaps
Risks / Reward
Value Drivers
The Problem
Ownership
Success Factors
TCO
Risk Assessment
Value Comparison
Productivity
Market Entry
As-is Benchmarks
Business Plan
Risk Register
Project Case File
- REPEAT -

14. Performance metrics, outcomes, risks mitigated
OPERATIONALCOSTS
WORKFORCE
PRODUCTIVITY
COST AVOIDANCE
OPERATIONAL
RESILIENCE
BUSINESS AGILITY
98% reduction in
P1/P0’s
77% faster to
deliver business
applications
52% average TCO
savings
15 automated bots
developed
80% cloud first
adoption
15 cloud services
created
8 cloud migration
parties
Improved security
postureRapid
experimentation
Reduced technical
debt
14M YOY Savings
Improved
Performance
Streamlined M&A
Activity
DevOps in Practice
$20M
Investment
18
Months
Focus
300+Apps
Migrated
$21M YOY
Savings&
Shift to self-service
culture
35% reduction in compute
assets (792)
50 Apps decomissioned

15. Cloud and Risk Mitigation

16. Risk Impact - Cyber
• 18% of UK organisations don’t know how many cyber attacks they
suffered last year
• Nearly eight in 10 experienced down-time due to security incidents
• Average number of security incidents faced by UK companies
increased by 23% to 5,792
• Incidents now cost an average of £2.6million, up 53% from last year
• Current employees continue to be top insider risk but increasingly
business partners as well
Source: The Global State of Information Security® Survey 2017

17. Some challenges faced by GRC professionals
• Fragmentation
• Cyber-Security
• Data silos
• Compliance
• Org. Change
• Third Parties

18. Typical risk questions
1. What risks are we facing by placing data, applications and other
technology services in the Cloud?
2. What responsibilities would we retain, and which would be passed to the
Cloud provider?
3. What are the risks and mitigations over a period of transition?
4. Do we have the skills, experience and capabilities to manage the risks
associated with adoption of the Cloud?
5. How does the overall risk profile of the Cloud compare to our current on
premise data centers?

19. Similarities: Cloud & Technology Risks
Typical Cloud Technology Risks
Market Disruption
Changing Dependencies
Scope of Control
“Locked-in” vs “skilled-up”
Org. Transformation
Cyber-Security
Avoid?
Reduce?
Share?
Accept?

20. Thinking ahead…

21. Cloud & risk mitigation
What if?

22. ERM & Improving outcomes
• Need for a clearer risk framework for change via cloud
• More GRC involvement in decision support needed
• Due diligence is key to success
“By failing to prepare,
you are preparing to fail”
Benjamin
Franklin

23. johnenoc@amazon.com