CSCCRA: A Novel Quantitative Risk Assessment Model for SaaS Cloud Service Providers

Abstract

Security and privacy concerns represent a significant hindrance to the widespread adoption of cloud computing services. While cloud adoption mitigates some of the existing information technology (IT) risks, research shows that it introduces a new set of security risks linked to multi-tenancy, supply chain and system complexity. Assessing and managing cloud risks can be a challenge, even for cloud service providers (CSPs), due to the increased numbers of parties, devices and applications involved in cloud service delivery. The limited visibility of security controls down the supply chain, further exacerbates this risk assessment challenge. As such, we propose the Cloud Supply Chain Cyber Risk Assessment (CSCCRA) model, a quantitative risk assessment model which is supported by supplier security posture assessment and supply chain mapping. Using the CSCCRA model, we assess the risk of a SaaS application, mapping its supply chain, identifying weak links in the chain, evaluating its security risks and presenting the risk value in monetary terms (£), with this, promoting cost-effective risk mitigation and optimal risk prioritisation. We later apply the Core Unified Risk Framework (CURF) in comparing the CSCCRA model with already established methods, as part of evaluating its completeness.

From rationale to lessons learned in the cloud information security risk assessment: a study of organizations in Sweden

“…Second, ISRA approaches are not static, which is contrary to the pre-supposition of most cloud ISRA approaches. The extent of development in cloud risk assessment models and frameworks (Akinrolabu et al, 2019;Albakri et al, 2014;Djemame et al, 2016;Islam et al, 2017) assume that the process is static and changes to the approach are not recognized, which is contrary to the results of the current paper. An implication for future research is to investigate whether the changes made by practitioners are effective or counter-effective.…”

“…Within ISRM resides the information security risk assessment (ISRA), which is a process that is integral to ISRM and its task is to identify, analyze, categorize and evaluate cloud security risks (Shameli-Sendi et al , 2016). While plenty of ISRA frameworks exist for the cloud (Akinrolabu et al , 2019; Djemame et al , 2016; Islam et al , 2017), extant research has tended to investigate the technical and operational issues (Venters and Whitley, 2012). Moreover, there is a lack of organizational perspective into cloud security issues (Trigueros-Preciado et al , 2013), and previous research has called for more empirical studies that investigate the practice of ISRA in the cloud (Ali et al , 2020).…”

A Comprehensive Study of Security and Cyber-Security Risk Management within e-Health Systems: Synthesis, Analysis and a Novel Quantified Approach

“…In [ 47 ], the authors focused on a transformation roadmap for standardizing IoT risk impact assessment (based on functional dependency) and calculating the economic impact of cyber risk (based on a goal oriented approach). Authors in [ 48 ], proposed the CSCCRA (Cloud Supply Chain Cyber Risk Assessment) model, as a quantitative risk assessment model to assess the risk of a SaaS application and its supply chain mapping.…”

A Resilience Engineering Approach for the Risk Assessment of IT Services

“…In the IT context, on the one hand, in recent years numerous efforts have been carried out to augment risk assessment approaches that can guarantee cloud security, as reported, for example, by the MEDINA project financed by the European Union [34]. On the other hand, most risk assessment tools in this domain rely on a reactive approach, while only a few of them take into account supply chain risks [35] and the elicitation of software requirements for complex systems [36]. Hence, a "Safety II" approach is needed to explain performance variability in such a context, and FRAM appears to be the proper tool for systemic safety assessment in this complex and dynamic domain [37].…”