Comparative Analysis of Threat Modeling Methods for Cloud Computing towards Healthcare Security Practice

Abstract

Healthcare organizations consist of unique activities including collaborating on patients care and emergency care. The sector also accumulates high sensitive multifaceted patients' data such as text reports, radiology images and pathological slides. The large volume of the data is often stored as Electronic Health Records (EHR) which must be frequently updated while ensuring higher percentage up-time for constant availability of patients' records. Healthcare as a critical infrastructure also needs highly skilled IT personnel, Information and Communication Technology (ICT) and infrastructure with regular maintenance culture. Fortunately, cloud computing can provide these necessary services at a lower cost. But with all thees enormous benefits of cloud computing, it is characterized with various information security issues which is not enticing to healthcare. Amid many threat modelling methods, which of them is suitable for identifying cloud related threats towards the adoption of cloud computing for healthcare? This paper compared threat modelling methods to determine their suitability for identifying and managing healthcare related threats in cloud computing. Threat modelling in pervasive computing (TMP) was identified to be suitable and can be combined with Attack Tree (AT), Attack Graph (AG) and Practical Threat Analysis (PTA) or STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege). Also Attack Tree (AT) could be complemented with TMP, AG and STRIDE or PTA. Healthcare IT security professionals can hence rely on these methods in their security practices, to identify cloud related threats for healthcare. Essentially, privacy related threat modeling methods such as LINDDUN framework, need to be included in these synergy of cloud related threat modelling methods towards enhancing security and privacy for healthcare needs.

Characterization and Risk Assessment of Cyber Security Threats in Cloud Computing: A Comparative Evaluation of Mitigation Techniques

“…The STRIDE is the best technique for mitigating threats in cybersecurity, with a value of 59, followed by QTMM (57), CVSS (51), PASTA (50) and PnG (47). This corroborates the findings by Yeng et al [37], which show that STRIDE gathers high-level security requirements for cloud computing. However, Attack Tree and HTMM have the same value of 46, followed by LINDDUN (45), OCTAVE (44) and Trike (43).…”

A Comparative Analysis of Cybersecurity Threat Taxonomies for Healthcare Organizations

“…These models can mitigate healthcare information systems (HIS) risks and protect protected health information (PHI). While many papers about Threat Modeling in Healthcare specialize in domains like Mobile Health Systems, Electronic Health Systems [2], Medical Cyber-Physical Systems, and Cloud Computing, very few papers have information about threat taxonomies within the healthcare industry [3]. STRIDE is a well-known threat modeling system that is useful for identifying many kinds of security risks.…”

ACC-PH: a Comprehensive Framework for Adopting Cloud Computing in Private Hospitals

“…The lock-in effect poses additional hazards that result in cloud users becoming dependent on the services offered by the cloud service provider, so limiting customers' flexibility in their choices [21]. In addition, the adoption of cloud computing has the potential to amplify the risk of data loss and exacerbate system downtime when utilising an inadequate cloud provider [22]. Moreover, cloud adoption could cause compliance problems if the cloud provider violates data protection and healthcare sector requirements [23], [24].…”