Cloud Security Alliance Research Articles

The Only Constant Is Change

IEEE Software editor-in-chief Forrest Shull discusses the magazine's recent editorial board meeting and some of the discussions the group had about where software development is headed, including refactoring and reengineering, technical debt, measurement, cloud computing, user experiences, and effective project management. In addition, he describes the recent Software Experts Summit 2013, which focused on smart data science and the International Conference on Software Engineering's Software Engineering in Practice award, selected by IEEE Software. The first Web extra at http://youtu.be/BRioqQenavA is a video interview in which John Howie of the Cloud Security Alliance expands on his talk at Software Experts Summit 2013 "Big Data: Answering Questions and Solving Society's Problems, but at What Cost?" The second Web extra at http://youtu.be/6jm8mZTQsnw is a video interview in which Microsoft's James Whittaker expands on his talk at Software Experts Summit 2013 (SES13) about the future of the Web and search. The third Web extra at http://youtu.be/aCypdSuCDQs is a video interview in which IEEE Software editor in chief Forrest Shull speaks with Jane Cleland-Huang of DePaul University about the Software Engineering in Practice Award at the International Conference on Software Engineering 2013, presented by IEEE Software.

Towards a trust management system for cloud computing marketplaces: using CAIQ as a trust information source

ABSTRACTCloud computing enables information technology related services in a more dynamic and scalable way than before—more cost‐effective than before due to the economy of scale and of sharing resources. Usually, cloud providers describe their promised behaviour—regarding functional and non‐functional aspects of the service provision—by way of service level agreements (SLAs). For different providers offering similar functionality, SLAs are often insufficiently claimable and inconsistent with the aspects considered important by customers. Therefore, customers face problems identifying a trustworthy cloud provider solely on the basis of its SLA. To support customers in reliably identifying trustworthy cloud providers, we propose a multi‐faceted trust management system architecture for cloud computing marketplaces and related approaches. This system provides the means for identifying trustworthy cloud providers in terms of different attributes, for example, compliance, data governance and information security. In this article, we present the first realization of our proposed trust management system using the Consensus Assessment Initiative Questionnaire, initiated by the Cloud Security Alliance, as one of the sources of trust information. In particular, our proposed approach contributes to the challenge of extracting trust information from Consensus Assessment Initiative Questionnaires completed by cloud providers. Finally, our implemented system and related approaches are experimented using real datasets. Copyright © 2013 John Wiley & Sons, Ltd.

Cloud computing – A question of trust

Both the Jericho Forum and the newly-established Cloud Security Alliance (CSA) have grabbed many a headline lately in their respective attempts to assuage some of the widespread information security concerns around cloud computing. The question is, are such initiatives enough?