Cloud Security Risk Management: A Critical Review

Abstract

Cloud computing has created a remarkable paradigm shift in the IT industry and brought several advantages such as on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. These advantages enabled cloud to have significant impact on different sectors of smart cites. However, cloud adoption has increased the sophistication of the ever changing security risks which frustrate enterprises on expanding their on-premises infrastructure towards cloud horizons. These risks have the potential of being a major concern for smart cities due to the increasing impact of cloud on them. Managing these security risks requires adopting effective risk management method which involve both the cloud service provider and the customer. The risk management frameworks currently applied to manage enterprise IT risks do not readily fit the cloud environment and the dynamic nature of clouds, which are characterized by on demand self-service and rapid elasticity. Therefore, researchers have proposed different cloud security risk management methods and frameworks. This paper critically reviews these risk management methods and frameworks. In addition, it conducts critical analysis on two of them using qualitative content analysis technique, and evaluates their effectiveness for assessing and mitigating cloud security risks. Keywords-cloud security risk management; cloud security risk assessment; security risk management; cloud security riskI.

Agent Based Information Security Framework for Hybrid Cloud Computing

“…Risks in context to Information Security are always uncertain and its mitigation process cannot be fully achieved until the objectives and strategies of the business are clear. Context establishment means to define the scope of all processes involved in the risk management and also sets the criteria to assess the tasks for the mitigation of risks [23]. The scope of risk management must be within limit of the organizational goals and objectives.…”

Challenges of cloud computing use: A systematic literature review

“…The attacker (or attackers, as is the case in distributed denial-of service (DDoS) attacks) attacks typically flood servers, systems or networks with traffic by way of obliging the prevents legitimate users to consume inordinate quantities of finite system resources like memory, processor power, disk space or network bandwidth [20,21,23]. Consequently, this produces an intolerable system slowdown and leaves all of the victim cloud service perplexed and furious as to why the service isn't responding [9,12,19,42,43,73,77].…”

Technology of computing risks visualization for distributed production infrastructures

“…Cloud Risks Classification. Cloud risks classification is not a well-defined scientific problem [2,21,22]. In [21] authors distinguish the following groups of risks: information security, operations management, change management, disaster recovery, service level management, interface management, regulations and legislation.…”

“…ENISA's list of risk scenarios and their categories include the following [1,22]: policy & organizational, technical, legal, etc. According to the information presented in [2], most of cloud security risks can be categorized using application and network levels, data storage risks, etc. We propose to use the following groups of risks: information, resource, organizational, financial, social, operational, reputation, legal.…”

“…The tuple (1) is given. For (2) it is needed to create and implement the optimal visualization technique, denoted as vrt and defined in (3) and (4).…”