Complying with Security Requirements in Cloud Storage Systems

Román, Rodrigo; Felipe, Miguel Rodel; Gene, Phua Eu; Zhou, Jianying

doi:10.17706/jcp.11.3.201-206

Cited by 1 publication

(1 citation statement)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Bessani et al [] discuss a similar use of multiple clouds, rather than a single cloud, to manage the risk of an insider attack. Roman et al [] conduct a comparative security analysis of several cloud systems, including OpenStack; the focus of this study is only on storage systems, such as Amazon's S3 service, rather than on the more general case of combined processing and storage services. Kim et al [] discuss some OpenStack security issues; their focus is mostly on denial of service attacks, rather than on attacks on confidentiality or integrity, but they do provide some insight into a SQL injection attack.…”

Section: Introductionmentioning

confidence: 99%

Assessing Systemic Risk to Cloud‐Computing Technology as Complex Interconnected Systems of Systems

Haimes

Horowitz

Guo

et al. 2015

Systems Engineering

View full text Add to dashboard Cite

This paper presents a methodology for modeling cloud-computing technology (CCT), its users, and, most important, would-be malicious intruders as complex interdependent and interconnected systems of systems (S-o-S). The paper posits and demonstrates that due to the inherent structure of CCT as S-o-S, users of public CCT are at a higher risk of unlawful intrusion than users of non-CCT systems. At the same time, the flexibility and the agility of CCT S-o-S provide advantages relative to most non-CCT S-o-S. The need is for the CCT community to employ these advantages as an integral part of its cyber security strategy. Our analysis builds on the following theory and methodology: we consider CCT and its users as complex interconnected hardware and software subsystems that interact as S-o-S through shared states, resources, and subsystems, which are connected in series (rather than in parallel, as is the case for most non-CCT systems); exploiting the serial connectivity of CCT S-o-S, we use fault-tree analysis to demonstrate the resulting unreliability of CCT S-o-S; building on the published literature, we incorporate Pareto-optimal frontiers to compare the risks faced by security-conscious users of CCT (e.g., large corporations) versus those faced by cost-conscious users (e.g., small or startup companies); and we show that users of CCT as S-o-S are at a higher risk than users of non-CCT systems for certain assumptions and types of cyber attacks. The paper is structured as follows: Part A outlines the characteristics of CCT S-o-S, addresses the inherent vulnerability of CCT S-o-S to cyber intrusion and attack, and provides a brief literature review; Part B offers a rationale for modeling CCT as interconnected and interdependent S-o-S; Part C demonstrates, through the use of fault-tree analysis, the higher risk faced by CCT and its users as complex S-o-S; Part D presents an economic analysis of the security of CCT as S-o-S; and Part E offers conclusions and lessons learned. C⃝ 2015 Wiley Periodicals, Inc. Syst Eng 18: 284-299, 2015

show abstract

Section: Introductionmentioning

confidence: 99%