A Structured Method for Security Requirements Elicitation concerning the Cloud Computing Domain

Abstract

Cloud computing systems offer an attractive alternative to traditional IT-systems, because of economic benefits that arise from the cloud's scalable and flexible IT-resources. The benefits are of particular interest for SME's. The reason is that using Cloud Resources allows an SME to focus on its core business rather than on IT-resources. However, numerous concerns about the security of cloud computing services exist. Potential cloud customers have to be confident that the cloud services they acquire are secure for them to use. Therefore, they have to have a clear set of security requirements covering their security needs. Eliciting these requirements is a difficult task, because of the amount of stakeholders and technical components to consider in a cloud environment. Therefore, the authors propose a structured, pattern-based method supporting eliciting security requirements and selecting security measures. The method guides potential cloud customers to model the application of their business case in a cloud computing context using a pattern-based approach. Thus, a potential cloud customer can instantiate our so-called Cloud System Analysis Pattern. Then, the information of the instantiated pattern can be used to fill-out our textual security requirements patterns and individual defined security requirement patterns, as well. The presented method is tool-supported. Our tool supports the instantiation of the cloud system analysis pattern and automatically transfers the information from the instance to the security requirements patterns. In addition, they have validation conditions that check e.g., if a security requirement refers to at least one element in the cloud. The authors illustrate their method using an online-banking system as running example.

Context Analysis of Cloud Computing Systems Using a Pattern-Based Approach

“…The ReAs-CSAP expands the CSAP from reference [8] with new types of context information that allow the representation of (1) particular information that is relevant for data protection, and (2) information regarding the compliance to laws and regulations for security and privacy information.…”

“…By extending the original CSAP [8] (see In cases starting with an empty CSAP, designers can create their own CSAP by adding appropriate types of indirect stakeholders, direct stakeholders and cloud elements. Furthermore, associations between direct stakeholders and cloud elements as well as among direct stakeholders themselves can be created.…”

“…Beckers et al [45] provided a cloud system analysis pattern for establishing the context of cloud computing systems, expressed in a UML-like notation. In another work, Beckers et al [8] presented a method for eliciting security requirements for cloud computing systems. They defined a terminology for the Cloud System Analysis Pattern (CSAP) from reference [45] with a meta-model.…”

“…We built our approach upon this work and presented more specific pattern elements for addressing data protection goals in the context of cloud computing services. For this purpose, our pattern extends the CSAP from reference [8] by adding elements that represent roles as well as concepts and technical components regarding privacy concerns. The added roles conform to the GDPR.…”

“…Therefore, inappropriate context establishment can lead to an incomplete asset identification that, in turn, can result in great loss regarding information security. However, due to the sparse description in the standard, executing the specified steps for defining the scope and boundaries is not a trivial task [8].…”