Harmonized Monitoring for High Assurance Clouds

Abstract

Due to a lack of transparency in cloud based services well-defined security levels cannot be assured within current cloud infrastructures. Hence sectors with stringent security requirements hesitate to migrate their services to the cloud. This applies especially when considering services where high security requirements are combined with legal constraints. To tackle this challenge this paper presents an extension to our existing work on assurance methodologies in cloud based environments by investigating how current state of the art monitoring solutions can be used to support assurance throughout the entire infrastructure. A case study is used in which monitoring information representing a set of relevant security properties is being collected. As result, we propose that a combination of existing tools should be used to harmonize existing monitoring artifacts. We describe and evaluate an Evidence Gathering Mechanism (EGM) that provides this harmonization and show how this can support assurance. This can also underpin legal proceedings from an evidence law perspective.

Monitoring Industry 4.0 applications for security and safety standard compliance

“…The monitoring and standard compliance framework, built on our previous work [7], uses an Evidence Gathering Mechanism (EGM) to collect evidence from a number of components in the target system based on a set of measurable indicator points (MIPs). The MIPs, categorized in measurable security indicators (MSI), measurable safety indicators (MSFI) and other organizational indicators related to legal (MSLI), are extracted from existing standards and guidelines to address target system specific requirements (e.g.…”

Towards trustworthy end-to-end communication in industry 4.0

“…In order to provide adequate security and safety levels for such a framework to function properly, services such as, authorization, authentication, certificate distribution, security logging and service intrusion are considered as well. Even though the focus of the project is to provide interoperability between devices using the ARROWHEAD framework and to integrate automation systems in these devices, security and safety aspects are also 6 www.arrowhead.eu considered. However legal (e.g., SLAs) aspects are not in the focus of the project.…”

“…The goal of this work is to provide an approach towards CPPS transparency and trustworthiness by considering the cloud and the edge devices as highly networked systems, incorporating a large number of IT systems and automation components. We consider security as not independent from other issues such as legal and safety and we will enhance our previous work [6] to address security in the CPPS with a special focus on secure end-to-end communication in Industry 4.0.…”

“…To make sure that the system is secured and the information can be trusted, measurable and automated dependabilities are needed to monitor security. By monitoring the MIPs we will extend our previous work [6] to address security in CPPS with a special focus on trustworthy end-toend communication in Industry 4.0. Our main contributions and preliminary results in this position paper are:…”

On the cost of cyber security in smart business

“…The following list describes the proposed process steps in detail: 1) Define: the process starts by identifying and defining security risks for a cloud service. This can be achieved either by implementing a monitoring system [25] or by using any other method to identify security issues. In our use case the OWASP top 10 cloud security risks list was used and categorized by relevance and severity of consequences.…”