SECURITY ANALYSIS WHEN HIRING CLOUD SERVICES: Comparison United States and Brazil - de Carli, Marcio (Revista Interface Tecnológica, 2020)
This work aims to describe and evaluate current information security assessment practices in the adoption of cloud computing services. It discusses the effort employed in carrying out these practices and lists the necessary improvements to increase efficiency in the execution of the security assessment process risks and implementation of controls in Brazil. The article reviews two government approaches used in risk management for the adoption of cloud computing services: The Federal Risk and Authorization Management Program or FedRAMP and the Brazilian government's processes for risk management in information security. The regulatory framework of each country is the base for both processes.  Finally, the study lists actions such as the maintenance of predefined sets of controls, the reuse of the analyzes carried out to qualify the systems, the categorization of information regarding secrecy in large blocks as ways to improve this evaluation process in Brazil. The ways of carrying out this evaluation directly impact the design of solutions, the development of services, and the contracting models.
Keywords: Information Security; Cloud Computing; Risk Management