Strikt konfidentiell data i en molntjänst : Informationssäkerhetsutmaningar och möjligheter

Sammanfattning

This study aims towards analyzing how an organization within the Nordic financial industry handles strictly confidential data in an outsourced cloud service, as well as what information security challenges occur and what opportunities may arise. A case study was performed where qualitative semi-structured interviews were conducted and analyzed by using a content analysis in order to draw a conclusion based on our empirical data. Our results show that certain types of data lose all of its value as soon as it becomes public, this indicates that organizations must take precautions when handling such data. By classifying the different types of data the organization encounters around confidentiality, integrity and availability, as well as the business impact that it contains. Guidelines for how a certain class of data should be handled and protected can be established. For example, encryption, access control or other information security measures. Our results also show that controls are being used in order to ensure that the handling of strictly confidential data is performed in a secure way. Strictly confidential data is the highest level of confidentiality a certain type of data can possess, which indicates that it also has the highest amount of security. However, when protecting a specific type of data, the return on investment is an aspect that needs to be accounted for, in other terms a balance between the cost and the value of the data. Established frameworks such as NIST Cybersecurity framework, ISO 27001 and CIS 8 are also helpful when identiying, preventing and eliminating information security threats. Our results show that the organization strives to be CIS version 8 “level 2” compatible, which is good for the information security behind the handling of strictly confidential data.