Abstract
Cloud computing services bring new capabilities for hosting and offering complex collaborative business operations. However, these advances might bring undesirable side-effects, e.g., introducing new vulnerabilities and threats caused by collaboration and data exchange over the Internet. Hence, users have become more concerned about security and privacy aspects. For secure provisioning of a cloud computing service, security and privacy issues must be addressed by using a risk assessment method. To perform a risk assessment, it is necessary to obtain all relevant information about the context of the considered cloud computing service. The context analysis of a cloud computing service and its underlying system is a difficult task because of the variety of different types of information that have to be considered. This context information includes (i) legal, regulatory and/or contractual requirements that are relevant for a cloud computing service (indirect stakeholders); (ii) relations to other involved cloud computing services; (iii) high-level cloud system components that support the involved cloud computing services; (iv) data that is processed by the cloud computing services; and (v) stakeholders that interact directly with the cloud computing services and/or the underlying cloud system components. We present a pattern for the contextual analysis of cloud computing services and demonstrate the instantiation of our proposed pattern with real-life application examples. Our pattern contains elements that represent the above-mentioned types of contextual information. The elements of our pattern conform to the General Data Protection Regulation. Besides the context analysis, our pattern supports the identification of high-level assets. Additionally, our proposed pattern supports the documentation of the scope and boundaries of a cloud computing service conforming to the requirements of the ISO 27005 standard (information security risk management). The results of our context analysis contribute to the transparency of the achieved security and privacy level of a cloud computing service. This transparency can increase the trust of users in a cloud computing service. We present results of the RestAssured project related to the context analysis regarding cloud computing services and their underlying cloud computing systems. The context analysis is the prerequisite to threat and control identification that are performed later in the risk management process. The focus of this paper is the use of a pattern at the time of design systematic context analysis and scope definition for risk management methods.
Highlights
Information and communication technology trends such as cloud computing and Future Internet facilitate the growth of information systems and their integration in our daily life
This paper presents a pattern for analyzing the context of cloud computing services
If the name of an instantiated ReAs-Cloud System Analysis Patterns (CSAP)-element is equal to its instance type, the element is relevant for subsequent risk analysis, but the context analyzer does not consider a concrete implementation of the element
Summary
Information and communication technology trends such as cloud computing and Future Internet facilitate the growth of information systems and their integration in our daily life. The standard states that “the scope of the information risk management process needs to be defined to ensure that all relevant assets are taken into account in the risk assessment” [7] The importance of this information becomes obvious because the steps of the ISO 27005 depend upon them, e.g., the identification of threats and controls for the identified assets of an organization. It supports the identification of legal, regulatory and/or contractual requirements that are relevant for cloud computing services For this purpose, the pattern provides different types of indirect stakeholders. For the identification of parties that directly interact with the cloud computing service or its used resources, the pattern contains specific types of direct stakeholders In this context, the stakeholders that represent different types of roles as defined in the GDPR are of great importance.
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.