Risk assessment for cloud-based IT systems

International Journal of Grid and High Performance Computing

Volumn 3, Issue 2, 2011, Pages 1-13

  Chou, Yuyu ^a   Oetting, Jan ^b  

^a TECHNISCHE UNIVERSITÄT BERLIN   (Germany)

^b Consileon Business Consultancy GmbH ^*  (Germany)

Author keywords

Cloud Computing; Google App Engine; ISO IEC 2700x; OWASP; Risk management

Indexed keywords

COMPUTING SERVICES; COMPUTING SOLUTIONS; ECONOMIC BENEFITS; ISO/IEC; IT SYSTEM; OWASP; STUDY CASE;

INDUSTRY; INFORMATION TECHNOLOGY; RISK ASSESSMENT; RISK MANAGEMENT;

CLOUD COMPUTING;

EID: 80052901106     PISSN: 19380259     EISSN: 19380267     Source Type: Journal    
DOI: 10.4018/jghpc.2011040101     Document Type: Article

References (27)

1. Bain, S. A., Read, I., Thomas, J. J., & Merchant, F. (2009). Advantages of a dynamic infrastructure: A closer look at Private Cloud TCO, from IBM Rep. Retrieved from http://ftp://public.dhe.ibm.com/common/ssi/ecm/en/ zsw03126usen/ZSW03126U-SEN.PDF
2. Buyya, R., Yeo, C. H., Venugopal, S., Broberg, J., & Brandic, I. (2009). Future generation computer system. Amsterdam, The Netherlands: Elsevier.
3. Catteddu, D., & Hogben, G. (2009). Cloud computing, benefits, risks and recommendations for information security. Retrieved from http://www.net-security.org/secworld.php?id=8531
4. Cloud Security Alliance. (2010). Top threats to cloud computing. Retrieved from http://www.cloudsecurityalliance.org/topthreats/csathreats.v1.0. pdf
5. Google Inc. (2009). App engine. Retrieved from http://code.google.com/ status/appengine
6. Google Inc. (2010). Security whitepaper Google Apps messaging and collaboration products. Retrieved from http://static.googleusercontent.com/ external-content/untrusted-dlcp/www.google.com/zh-TW//a/help/intl/en/admins/pdf/ ds-gsa-apps-whitepaper-0207.pdf
7. Google Inc. (2011a). Securityand privacy. Retrieved from http://www.google.com/support/a/bin/answer py?answer=60762
8. Google Inc. (2011b). The JRE class white list. Retrieved from http://code.google.com/appengine/docs/java/jrewhitelist.html
9. Hevner, A. R., March, S. T., Park, J., & Ram, S. (2004). Design science in information systems research. Management Information Systems Quarterly, 28(1), 75-105.
10. International Organization for Standardization. (2005). ISO/IEC 27001: Information technology - Security techniques - Information security management systems - Requirements. Retrieved from http://www.iso27001 security.com/html/ 27001.html
11. International Organization for Standardization. (2007). ISO/IEC 27002: Information technology - Security techniques-Code of practice for information security management. Retrieved from http://www.iso.org/iso/catalogue-detail? csnumber=50297
12. International Organization for Standardization. (2008). ISO/IEC 27005: Information technology - Security techniques - Information security risk management. Retrieved from http://www.27001. com/products/155
13. Jaeger, T., & Schiffman, J. (2010). Outlook: Cloudy with a chance of security challenges and improvements. IEEE Security & Privacy, 8(1), 77-80. doi:10.1109/MSP.2010.45
14. Kinyanjui, K. (2009 August 13). High speed Internet exposes Kenya to cybercrime. Retrieved from http://www.businessdailyafrica.com
15. Koppe, N. (n. d.). Ektosym. Retrieved from http://www.ektosym.com
16. Kshetri, N. (2010). Cloud computing in developing economies. IEEE Computer, 43(10), 47-55.
17. Mather, T., Kumaraswamy, S., & Latif, S. (2009). Cloud security andprivacy. Sebastopol, CA: O'Reilly Media.
18. Mell, P., & Granc, T. (2009 Oct. 7). The NIST definition of cloud computing v15. Retrieved from http://www.nist.gov/itl/cloud/upload/cloud-def- v15.pdf
19. Microsoft. (2010). Information security management system for Microsoft cloud infrastructure-online services security and compliance. Retrieved from http://www.globalfoundationservices.com/security/documents/ InformationSecurityMangSysforMS-CloudInfrastructure.pdf
20. Miller, K. W., Voas, J., & Laplante, P. (2010). In trust we trust. IEEE Computer, 43(10), 85-87.
21. OWASP (2010) Top (Madrid), 10, Retrieved from http://www.owasp.org/index. php/Top-10-2010-Main.
22. Parikh, T. S. (2009). Engineering rural development. Communications of the ACM, 52(1), 54-63. doi:10.1145/1435417.1435433
23. th ACM Conference on Computer and Communication Security, Chicago, IL (pp. 199-212).
24. Sun Microsystems Inc. (2009). Introduction to cloud computing architecture. Retrieved from http://webobjects.cdw.com/webobjects/media/pdf/Sun- CloudComputing.pdf
25. T-Systems. (2010). White paper security inthe cloud. Frankfurt, Germany: T-Sy stems International GmbH.
26. Tanenbaum, A. S., & van Steen, M. (2001). Distributed systems: Principles and paradigms. Upper Saddle River, NJ: Prentice Hall.
27. The National Institute of Standards and Technology. (2008). NIST 800-39: Managing risk from information systems, an organization perspective. Retrieved from http://www.nist.gov/index.html