Cybersecurity compliance analysis as a service: Requirements specification and application scenarios

Abstract

Summary Cybersecurity compliance analysis is the process of assessing whether the behavior of an IT system or application conforms to the cybersecurity rules and regulations in force. This assessment can be offered as a service by exploiting available cloud technologies, and, indeed, it is one of the services classified by the Cloud Security Alliance (CSA) as part of the security information and event management (SIEM) category of the SecaaS (security as a service) domain. The definition and implementation of this typology of cloud services are challenging activities due to the complexity of both the reference business domain and the compliance analysis services to be provided themselves. The paper exploits a recently proposed requirements methodology, called GOReM (goal‐oriented requirements methodology), to support the conceptualization and subsequent implementation of cybersecurity compliance analysis services. In particular, two different application scenarios regarding compliance analysis of an existing or under development IT system/application are presented and discussed. In both the scenarios, GOReM allows to grasp and understand the many and complex issues to address for providing secure cloud services to worldwide customers, also due to the numerous, different and ever changing legal aspects, which have to be taken into account by service providers.

Cybersecurity Policy Compliance in Higher Education: A Theoretical Framework

“…Unlike cybersecurity compliance analysis, which is methodologically structured (Furfaro et al, 2018), human compliance of cybersecurity polices is cognitive-based and depend on a range of behavioural factors. Vulnerabilities are multiplying too, thanks to increasingly interconnected people and businesses, as well as the expanding "Internet of Things" (Susskind, 2014).…”

Cloud computing and big data: Technologies and applications

“…Privacy and security in cloud computing are among the most important issues that still need to be addressed especially for emerging IoT and big data applications. As a contribution in this field, Furfaro et al, in their article “ Cybersecurity Compliance Analysis as a Service: Requirements Specification and Application Scenarios ,” highlighted some specific requirements, which have to be taken into account when modeling a cloud service for cybersecurity compliance analysis (CCA). They have mainly adopted recently proposed requirements methodology, called GOReM (goal‐oriented requirements methodology), to support the conceptualization and subsequent implementation of CCA services.…”