Risk Assessment for Cloud Computing

Abstract

Abstract—The broad implementation of cloud computing has brought a dramatic change to multiple industries, which derives from the development of the Internet-related technologies. Cloud service providers have untangled a lot of issues to maintain a robust quality of service. Despite the utilization of proficient techniques in resource management that has made optimal planning possible, as one resource is allocated to multiple users the risk of resources unavailability in cloud computing is still present. The level of risk is evaluated based on the probability of an incident occurring, which is mapped against the estimated negative impact. The probability of an incident occurring can be determined by the threat exploiting the vulnerability. All though a zero-risk scenario is impractical, effective risk assessment strategies equipped with efficient mitigation mechanisms can decrease the negative impact. As of now there are three types of cloud computing systems public, private and hybrid each with different levels of security. Most In this paper, we examine the various risk assessment models with regards to a Cloud Computing and touching upon Information Assets and Risk, Privacy and Confidentiality Concerns, Data Governance.
 IndexTerms—Cloud Computing,Risk Assessment,Risk Impact. Risk Management

CSCCRA: A Novel Quantitative Risk Assessment Model for SaaS Cloud Service Providers

“…Also, with 1.8 billion vulnerable open source components downloaded in 2015 and at least 26% of the most common open-source component having high-risk vulnerabilities, the risks of multicloud systems would seem to be on an ever-increasing trajectory. In an attempt to address the challenges of assessing cloud risks, numerous scholars have developed conceptual models [7][8][9][10][11]. While some of these studies have concentrated on cloud adoption risk assessment, others have followed the traditional route to security risk assessment, adapting the traditional risk frameworks, for example, ISO/IEC 27005, ISO/IEC 31000 and NIST 800-30v1.…”

Cyber risk assessment in cloud provider environments: Current models and future needs

“…QUIRC defines risk as a product of the Probability (P e) of a security compromise, i.e. a threat event, e, occurring, and its potential Impact Ie, where Ie is assigned a value on a numerical scale based on the Federal Information Processing Standards (FIPS) model [73] of Low (1-5), Moderate (6-10) or High (11)(12)(13)(14)(15). The calculation of the risk of an application based on a single security objective is represented by Rs, which is the average over the cumulative weighted sum of n threats which map to a particular SO category.…”

“…The work of Fito et al [43] stands out as another suitable alternative, except for their concentration on business level objectives and the lack of emphasis on security risks in the application of the SEmi-quantitative BLO-driven Cloud Risk Assessment (SEBCRA) model in a CSP environment. Some of the excluded papers did not give a practical example of the model's application [50,51], while others did not explicitly consider the supply chain [10,11] in their risk assessment process.…”

“…In multicloud systems (MCS), where cloud architectures use services from more than one cloud service provider (CSP), the challenge of risk assessment is evident. While many of the recent research efforts (e.g., Busby et al [7], Cayirci et al [8], and Islam et al [9]) have concentrated on cloud adoption risk assessment, others (e.g., Sendi & Cheriet [10] and Sivasubramanian et al [11]) have followed the traditional route to security risk assessment, concentrating on the focal organisation, their critical assets, threats, and likelihood of impact, without paying attention to the supplier network nor fully understanding its interrelated consequences. This problem has also been highlighted and evidenced in the works of Johnson [12], Bartol [13], Boyens et al [14], Lewis et al [15] and Motta et al [16].…”

Assessing the Security Risks of Multicloud SaaS Applications: A Real-World Case Study

“…Numerous scholars have developed conceptual models [6], [7], [17] to assess cloud risk. While some of these have concentrated on cloud adoption risk assessment, others have followed the traditional route to security assessment, adapting the traditional frameworks, e.g.…”