Cloud computing opportunities, risks and challenges

with regard to Information Security in the context of

developing countries
 Data Analysis, Results and Discussion

This section is concerned with the analysis of empirical data obtained from the field work carried
out during this research. Upon successful completion of interviews and surveys, data from
companies was first edited to make sure that potentially invalid or inaccurate questionnaires are
eliminated by looking at respondent’s pattern of answers and completion. Data analysis and
interpretation will now be carried out for subsequent recommendations made with regards to the
research objectives.

The empirical part of this thesis work was concentrated on exploring Cloud computing
opportunities, risks and challenges with regard to Information Security in the context of SMEs.
The choice of the three cloud service providers used in this research was largely governed by
type of cloud computing service offered by these organizations. These service models as
illustrated in the theoretical framework which include SaaS, PaaS and SaaS. Because security is
a sensitive subject for chosen organizations, they were assured of their anonymity in order to
encourage interviewees to give information freely. The first two organizations are
Telecommunications and Data communications Companies with diverse products and services
and have recently added cloud services (SaaS and Paas) to their rich portfolio. The researcher
will subsequently refer to them as Service Provider 1(SP1) and SP2 respectively. The third
organization which is also a data communication company is a new entrant into the Ghanaian
ICT market which offers SaaS, PaaS and IaaS will be referred to as SP3.

About SP1
SP1 is a world leader in providing a wide range of communications services, including voice
calls, internet access, text, picture and video messaging, and other data services. The company’s
product and services are used by customers in both public and the private sector. SP1 customers
can use a range of devices to access products and services, including handsets, fixed-line
telephones, laptops and desktop computers etc. The company’s clients include private and
corporate customers such the government of Ghana, large multi-national companies, small and
medium size enterprises and private individuals. These clients operate is different sectors such as
finance, manufacturing, transportation, hospitality, ICT, mining and oil, education, hospitality,
healthcare, the service sector and many more.

About SP2

SP2 has a wide range of telecommunication product and services and has been one of the key
players in Ghanaian ICT industry. The company’s Cloud Service Brokerage model involves the
delivery of hosted services over the Internet and enables users to access services remotely,
anywhere, at any time. The Cloud Service Brokerage model centralizes remote access to data and
application services. It improves efficiencies and eases the administrative burden for companies,
where instead of dealing with multiple service providers, they can deal with one provider. SP2
has identified the high cost of IT software and hardware as a challenge for small- and medium-
sized enterprises (SMEs) in Ghana. Like their larger corporate counterparts, SMEs would benefit
from the increased productivity and optimization of business operations, but is constrained by
capital limitations and limited IT expertise. SP2 Cloud service will provide cost-effective and
easy-to-use solutions that will enable SMEs to minimize costs and improve productivity and
efficiency. Companies will enjoy enormous benefits from SP2 Cloud services, including the
flexibility provided by the ability of staff to access files and data anywhere, even when they're
working remotely or outside office hours.

About SP3

SP3 is a technology company providing cloud services including cloud based applications. It
provides consulting and expertise in core Internet technologies including implementation of
domain name registry and registrar infrastructure services. The company also provides a robust
scalable cloud platform that allows users to decouple applications from physical assets,
alleviating the need to equip a device with every application, and reduce traditional end user
licensing agreements (EULA’s) and ongoing software maintenance, operation patches and
support complexity. SP3 cloud platform provides users with a portfolio of key business
applications and the capability to securely archive and manage multi-media data. The key tenets
of the company’s Value Proposition is to have Software and storage reside on SP3 servers and
not on the user organization’s premises; and its pay-per-use model avoids acquisition,
installation, deployment and maintenance costs. SP3 is perfectly positioned to capitalize on the
paradigm shift with a flexible platform that scales services efficiently and lowers startup capital
expense

Interviews

This research attempts to highlight the security benefits, challenges and risk of moving data into
the cloud from providers and users perspective. Information security managers, IT directors, IT
managers and users of cloud services were interviewed. The following areas have been covered
during the interview:

 cloud computing benefits,

 security challenges within the cloud

 Data ownership

 Cloud Service provider security responsibilities

 Cloud Users security responsibilities.

Cloud computing Benefits

The main objective of this study was to explore the opportunities that cloud computing offer to
SMEs and also identify the security benefits and associated risk and challenges it presents. As
discussed in the theoretical framework, essential characteristics of cloud computing model
(broad Network Access, rapid elasticity, measured service, on-demand self- service) offer cloud
users with enormous possibilities. The influx of cloud service providers in the country within the
last few years prompted the researcher to enquire about how they thought cloud services could
enhance the operations of SMEs.
During the interview, it was evidently clear that cloud service providers in Ghana understood the
needs of SMEs in the local context and the benefits that SMEs stand to gain by adapting cloud
computing services. All three service providers (SP1, SP2, SP3) were of the view that SMEs will
benefit in many areas by adapting cloud computing.

One of the most cited benefits is reduced cost since cloud services are deployed in the service
provider’s infrastructure and user consume services on a pay per use basis. SMEs have become
increasingly IT-driven but have found it difficult to sustain their IT infrastructure. The lack of
credit facilities for SMEs has been one of the barriers to expansion and growth.

In the economic sense, SMEs will gain a lot in the sense that they do not have to be burdened
with the initial cost for obtaining IT infrastructure.

IT manager of SP2 noted that cost of operation of these SMEs are critical to their businesses and
all avenues must be exploited to cut cost and raise the level of the services provided. Cloud
solutions allow companies to avoid upfront infrastructure costs, and focus instead on their core
businesses.

It was also indicated by SP3 IT director that when cost is efficiently managed, the benefits
transcends to all areas in the company’s operations. In effect, this helps to achieve economies of
scale and thereby having a positive impact on products product and services. Cloud computing
offer companies the competitive edge irrespective of their size and their financial situation as a
result of its pay-per-use nature.”

Another benefit as cited by the service providers is improved accessibility. Since cloud service
are deploy over the internet, users have access anytime at anywhere provided they have internet
connectivity. This increased mobility means employees can access information anywhere they
are.

“Cloud computing brings about increased availability and independence of specific hardware,
software and maintenance for the clients”….SP1 CIO
The redundancy offered by cloud service providers is much better than what individual SME’s
can offer. Thus data is much safer in the cloud in terms of hardware and software availability.

Security Benefits

With reference to the theoretical framework and the literature review on cloud computing
security, interviews were structured to cover the following areas (1) information security
challenges within the cloud; (2) Data ownership (3) Cloud Service provider security
responsibilities and (4) Cloud Users security responsibilities. During the interviews sections, the
researcher has enquired about expert opinions on the research topic.

The risk of losing sensitive data as a result of losing network element on which they are stored is
highly prevalent in the traditional SME environment as a result of lack of redundancy and
backups. The issue of hardware failure which could result in loss of data is somehow taken care
off in the cloud environment. Cloud services are provided by utilizing multiple servers at
different location. In an unlikely event that a server on which client data is stored taken offline
for whatever reason, users can still go about their work without realizing the downtime.

“Clouds services are provisioned from multiple data centres. Even if an entire data centres have
technical difficulties, cloud services can still be rendered without the customer noticing any
change to their service. This gives the assurance that user data will not be lost and also
downtime is unnoticed by cloud users”…CIO SP2

As indicated by the cloud security architecture, the issue of keeping data safe in the cloud relies
on efforts of both cloud service providers as well as users. There is the general believe that once
data enters the cloud, control over who access that data lies with the service provider. Service
providers were of the views that once the right security measures are put in place by users, they
have the technical expertise to keep it safe to prevent any catastrophic data loss and unauthorized
access.
“….as long as the correct security is put in place files will be safe, both from loss and from
unauthorized persons gaining access”…. Security Manager SP1.

Most SMEs managers interviewed revealed they do not have in-house IT Personnel. On the other
hand, providers have the technical knowhow to implement security policies safeguard cloud
services. Providers of cloud computing services have dedicated employees for various security
tasks such as software updates and backups. Therefore, customers of these services, particularly
software offerings, will benefit.

“We have the technical expertise than what in-house IT could provide……Security updates will
be included here, giving cloud based software and up to date packages to take care of any
vulnerability, this a security benefits over other package solder to consumers which will require
license before update can be concluded ” Security analyst SP3.

One of the major advantages of any type of cloud computing service is scalability. With infinite
computing resource available it means that additional resource can be utilized if necessary. If an
organization, for example, finds that they require more resource to support their needs then it is
not a problem. The best thing about this is that resource that may not be required does not have
to be paid for upfront; it is instead paid for on a usage basis. When more resource is utilized it is
paid for at this stage and if it later becomes un-required again, then it is no longer paid for.

Security Challenges

Notwithstanding the above mentioned benefits, cloud computing like any other technology has
its own challenges. From the cloud security reference model discussed in the theoretical
framework, data security in the cloud is a shared responsibility for both users and service
providers. The fundamental issue is the loss of hands-on control of system, application, and data
security. Researches have shown that one of the greatest concerns of enterprises about moving
into the cloud is security. As more enterprises adapt cloud computing, huge amount of data is
committed into the cloud and cloud environment over years have become fertile grounds for
malicious attackers to exploit.
Secure data transfer; The internet has been the main medium through which users of the cloud
access services. The main problem is establishing trust in remote execution because a user
program runs on a remote host in a data center, which a customer must make sure that his
program is executed in its base system instance providing integrity and secrecy. Since all traffic
through the internet is in the public domain;

Cloud users are encouraged to make sure your data is always travelling on a secure channel.
This could be achieved through data encryption and authenticating authorized user using
industry standard protocols, such as Internet Protocol Security (IPsec), that have been
developed specifically for protecting Internet traffic.

Secure software interfaces; Application Program Interfaces (APIs) are basically used to
interact with cloud services in the service provider’s network. This can be attacked if the
necessary precautions are not taken since data is transmitted over the internet which is a public
domain.

The Cloud Security Alliance (CSA) recommends users are aware of the software interfaces, or
APIs, that are used to interact with cloud services… CSA 2010

Secure stored data; Data in the cloud should be protected while at rest and when in motion.
Since cloud is a shared medium, there exist threats from within and outside the cloud.

Whiles cloud service providers take precaution to safeguard their own operations and protect
users from the danger they pose to each other, users are advised to have their own encryption
mechanism for their data to prevent unauthorized access since the cloud environments is shared.

User access control; Because of the shared nature of the cloud environment, the tradition
method of application centric access control does not work effectively. It is of great importance
for user to enquire about where their data is kept and who has access to it. User centric access
controls enable user to choose their own access control models to protect their privacy.
It is recommended that users be aware of Cloud service provider’s choice of authentication,
authorization, and access control mechanisms in order to put the right access control
mechanism in place to prevent data from tampering.

Apart from the fact that security issues discussed that affect cloud service consummation in
Ghana; there are peculiar risks that affect cloud users in Ghana. Firstly, the unreliable and low
speed internet connection is of concern t cloud users. The second major threat to the use of the
cloud is the inadequate power supply which is a major concern to both service providers and
user. Notwithstanding these facts, there exist a huge potential for cloud computing for SMEs

The Survey

Being well informed about the potential of cloud computing and how cloud services are offered
and consumed is a step in insuring data security, integrity and availability in the cloud. Both
cloud providers and users are accountable for cloud services and applications security. The
purpose of the survey is to enquire about the knowledge of SMEs about cloud computing in
general and ascertain whether these companies are aware of the security implications of moving
their data into the cloud. This will help in establishing the facts about current cloud users and
prospective users knowledge of cloud services and make recommendation where applicable to
meet the objectives of the study. Descriptive statistics have been used as a means of analyzing
data collected through questionnaire administration.

Background of Participants

In all, fifty SMEs were surveyed. The survey respondents consisted of eighty employees from
the fifty SMEs selected for the study. These comprised of SMEs from different sectors which
includes the following;

 Finance
  Consumer goods

 Technology

 Telecommunications

 Manufacturing

 Hospitality

Table 2: Distribution of Interviewees in different Operating fields

SME Sector TC

Micro finance 10

Consumer goods 15

Technology 15

Telecommunications 15

Manufacturing 15

Hospitality 10

Total 80
 Survey coverage and objectives

 View on cloud computing: The objective here is to find out whether SMEs are well
informed about the possibilities of cloud computing and find out about their perception
about cloud computing.

 The current state of cloud computing: How SMEs are dealing with their present IT needs
and their plans for the future. Again how they plan mitigating the numerous information
security threat that comes with the territory.

 Drivers of cloud computing: The aim is to find out the about the motivating factors
that shape employee compliance with information security and areas of improvement.

 Obstacles of cloud computing: The factors that are hindering the large scale adoption of
cloud computing

Demography of Respondents

The survey respondents were chosen from companies in the sector mentioned above.
Respondents included business owners, managers of IT and non-IT and other staff who
constitute ordinary users of information systems. In all 80 respondents took part in this research.
Among the participants, 20 of them were owners of their business, 30 were managers (IT and
Non-IT) and 30 are users of information systems. The figure below indicates the breakdown of
respondents:

Figure 8: Distribution of Respondents

 The State of Cloud computing in Ghana
Given the benefits that ICT can bring to SMEs, the researcher attempted to know whether SMEs
have indeed adopted some form of ICT to enhance their service delivery and thereby increase
their chances of know about cloud computing. It was interesting to know that majority of these
SMEs are somehow informed but still rely on traditional communication technology such as
fixed phone lines and fax.

The table 2 below indicates that majority of the respondents, are using some form ICT in their
service delivery process.

”Does your company use any form of information communication Technology (ICT) in
its operations”

Table 3: SMEs usage of ICT

Knowledge of ICT
RESPONSE FREQUENCY PERCENTAGE
YES 74 94.87%
NO 4 5.13%
TOTAL 78 100%
From the table, 94% of respondent use some form of ICT. This is good because consumer
awareness of the existence of the ICT is high. The finding in this study promises some prospects
for the service providers/adopters in Ghana. However, when respondents were asked about their
knowledge on cloud computing, 68% (not knowledgeable + don’t know) of respondents had no
knowledge of it. SMEs knowledge about cloud computing in Ghana is very discouraging. These
findings suggest that not much has been done in the area by way of awareness to encourage
SMEs to move into the cloud. 32% of the sampled population had some knowledge about cloud
whiles 68% constituted SMEs with no knowledge or did not know about cloud at all. This calls
for more education to create the awareness to enhance broader adoption of cloud services.

”How would you rate your knowledge about cloud computing”

Figure 9: SMEs knowledge of cloud computing

As gathered in interviews discussed above, SMEs have become increasingly IT-driven but have
found it difficult to sustain their IT infrastructural needs. Cloud computing promises to be the
answer to the plight SMEs. From benefits of cloud services, Small and medium enterprises can
speed up business growth by adopting cloud services to transform their operations. Respondents
were asked the following questions to ascertain the likelihood of moving into the cloud;

”Do you think adopting cloud computing service will enhance your service delivery and thereby
increase your market share”

Figure 10: Growth of SMEs by adopting cloud computing

95% (Strongly agree + Agree) of received reponses were of the view that cloud computing
would go a long way to enhance their service delivery and expedite growth.

When it comes to the reason for possible migration in the cloud respondents cited reduced cost as
highest motivating factor. The majority of the respondents expect three main drivers of cloud
computing: cost savings (54%) followed by more flexibility (24%), and better scalability (12%).
This is achieved through increasing profitability by lowering operational and capital costs and
increasing productivity through better scalability and increased flexibility cloud offers. The
findings from the research are in accordance with this. Whiles 54% of respondents were of the
view that cost is the main driver 36% attributed their decisions to flexibility and scalability.
”What benefits do you expect to get from cloud computing”

Figure 11: Reasons for cloud adoption by SMEs

Even though various benefits have been cited for using the cloud, concerns were raised as to the
reason for not fully buying into the idea of using cloud services. The following question has been
asked to ascertain users concerns when it comes to using cloud services;

”Rate the concerns below in terms of the influence they would have on your business
NOT adopting cloud computing?”

As indicated in figure 12 below, an overwhelming majority of respondents (62%) considers data

privacy and security issues to be their main concern regarding the use of cloud computing. In
addition, connectivity (15%) and data recovery (10%) are also ranked high among others
indicating users have a varied range of concerns.
Figure 12: Cloud usage concerns

The most challenging issue in cloud computing is security and privacy. The multi-tenancy
characteristic of cloud comes with its own associated risk such as unauthorized access to
sensitive data. Multi-tenancy allows customers, organizations, and consumers to share the same
cloud based infrastructure and databases in order to gain price and performance advantages.
Storing of data in cloud therefore becomes less secure because users do not know what their
neighbor in the cloud is up to. IT is therefore necessary for service providers to make sure that
the necessary security measures are taken to protect users of these services from the risks they
pose to one another. Again the amount of data been committed to the cloud is so huge that
intruders find it very profitable to attack. In order to counteract the activities of intruders, it is
incumbent on both providers and user to ensure that data in the cloud is safe by taking the
necessary precautions.

Bandwidth connectivity and downtime are also ranked high among the concerns of cloud users
and service providers especially in the Africa where the cost of attaining high speed internet
connectivity is high. However, in Ghana, cost of bandwidth is on the decreasing trend with
introduction of more internet service providers (ISPs) into the market. The customer stands to
gain because of the completion among service providers. The issue of power stability is rather
alarming as it has affected businesses in different ways over the last few years. The power
company, which owned by government has promised to deal with the situation.

Recommendations and Conclusion

Recommendations made here are base on the key findings of this study especially for SMEs who
are already use cloud services or have future plans to adopt cloud computing. The main objective of
this study is to explore the prospects of cloud computing for SMEs in Ghana and identify the security
benefits and challenges of moving corporate data into the cloud in the developing world.

Benefits

 The major benefits of cloud computing as has been enumerated as cost savings, high
availability, resource maximization, scalability and capacity, Collaboration,
Customization, resiliency and improve security. From the interview and survey data
collected, two main points have been established;

95% of survey population agree that cloud computing is the way to go by SMEs. SMEs in Ghana
are better off with the adoption of cloud computing. The lack of capital and inadequate technical
expertise has prevented SMEs for reaching their potential. Adopting cloud computing will have a
significant positive impact on SMEs. However, the study outcome also revealed that the
awareness level of SMEs on the availability and accessibility of services cloud service provider
can offer is rather low. During the interview, service providers felt that there is insufficient
knowledge/expertise on cloud computing within SME’s establishment, especially on security.
This study therefore recommends that more awareness needs to be created by all stakeholders for
SMEs to know the benefits that they can derive from adopting cloud computing.

Security

 Security in the cloud is considered as a benefit and also a challenge. Security in the cloud
is one of the greatest challenges that confront service providers and users. 62% of cloud
users ranked security to be their number one concern within the cloud. It is evidently
clear that the issue of security within the cloud cannot be over emphasized due to threats
 from within and outside of the cloud environments. Privacy and data Security
responsibilities within the cloud should be a collaborative effort between both service
providers and users. These responsibilities differ by the kind of cloud services been
consumed.

 Cloud service providers owe it to cloud users to have the latest and best approaches as
available options to ensure maximum protection. Service providers have the
responsibility to ensure that the proper security and isolation protections are put in place
to mitigate the risks users pose to one another in terms of data loss, misuse, or privacy
violation within the cloud.

 Again from the cloud service provider’s perspective, there should be an active monitoring
mechanism in place to allow for effective planning and implementation of services. This
also serves as a means to respond to events quickly and more efficiently.

 Cloud users on the other hand must ask and be clear about their responsibility for their

security. By this, it is recommended to SMEs to ask question about their security when

engaging a service providers. Questions about; what information is stored on a system,

where is the information stored, who can access the system, what they can access and

appropriate access mechanism are good to clear any doubt about services providers.

Identifying controls that address the lack of direct access to data and information is the

foundation of SME’s strategy for entering the cloud and allows the organization to

consistently approach security needs based on the workloads and granular data

represented in their cloud efforts. This also facilitates the implementation of resiliency

and audit capabilities in the cloud, allowing organizations to extend their security

philosophy into the cloud.

 SMEs must also take the initiative to educate their employees about the threats to security
in the cloud. Research has shown that people who manage and use technologies have
 become the weakest link and poses the greatest threat to information security. Whiles the
technological controls put in place, it is important to educate ordinary users of
information systems about the threats they pose to information security.

5.2. Conclusions

Cloud computing offers numerous advantages that Small and Medium scale enterprises can
benefit from. These benefits are achieved through cloud’s economies of scale and flexibility. The
prevailing situation in Ghana in terms resource availability and IT needs of SMEs makes cloud
computing the obvious choice for SMEs. The key conclusions of this research is that, SMEs
adopting cloud computing services will see improved service delivery and increased efficiency
and productivity. This will eventually translate into good returns on investments. However, there
is the need for massive awareness to be created by service providers to enable SMEs take
advantage of the benefits that cloud computing offers.

The flexibility offered by cloud computing has its own associated risks and challenges. This
study has explored the benefits of cloud computing and the various security challenges
associated with it. The main concern of users in the cloud environment is data security and
privacy. The huge amount of data and resources available in the cloud makes it a more fertile
ground for attackers exploit. However, cloud-based defenses can be more robust, scalable and
cost-effective for SMEs. The onuses lie on both cloud service providers and users to ensure
effective security within and outside the cloud. This paper allows for cloud users to make
informed decision before moving organization’s data into the cloud by know the risks involved
and taking the necessary precautions.
References

Turner, Daniel W, III, 2010 Qualitative Interview Design: A Practical Guide for Novice
Investigators. The Qualitative Report Volume 15 Number 3 May 2010 754-760
http://www.nova.edu/ssss/QR/QR15-3/qid.pdf

Plummer, D. C., T. J. Bittman, T. Austin, D. W. Cearley and D. M. Smith (2008). Cloud

computing: Defining and describing an emerging phenomenon. Research(Ed, Gartner), p. 1-9.

Peter Mell Timothy Grance, Computer Security Division Information Technology Laboratory
National Institute of Standards and Technology Gaithersburg, MD 20899-8930 September 2011

Rizzo Frank (2012),The business case for cloud computing in Technology

Rezgui, Yacine Marks, A Information Security Awareness in Higher Education: An

Exploratory Study

Stark Christopher 2012, The History of Cloud Computing. Available at

http://www.cetrom.net/blog/the-history-of-cloud-computing/

Security Consideration for Cloud Ready Data-Centres,Juniper Networks, Oct. 2009.

http://www.juniper.net/us/en/local/pdf/whitepapers/2000332-en.pdf.

Storey, D.J. (1994). Understanding the small business sector. London: International Thomson
Business Press.