A new methodology for security evaluation in cloud computing

MIPRO 2012 - 35th International Convention on Information and Communication Technology, Electronics and Microelectronics - Proceedings

Volumn , Issue , 2012, Pages 1484-1489

  Ristov, Sasko ^a   Gusev, Marjan ^a   Kostoska, Magdalena ^a  

^a SS CYRIL AND METHODIUS UNIVERSITY   (Macedonia)

Author keywords

Information Security Management; Security Assessment; Security Standards; Virtualization

Indexed keywords

BUSINESS CONTINUITY; CLOUD SERVICES; CLOUD SYSTEMS; COMPUTING SECURITY; CONTROL OBJECTIVES; CUSTOMER SERVICES; DATA OUTSOURCING; INDUSTRIAL STANDARDS; INFORMATION SECURITY MANAGEMENTS; NEW SOLUTIONS; QUANTITATIVE METRIC; SECURITY ASSESSMENT; SECURITY EVALUATION; SECURITY RISKS; SECURITY STANDARDS; VIRTUALIZATIONS;

COMMUNICATION; INFORMATION TECHNOLOGY; MICROELECTRONICS; SECURITY OF DATA; STANDARDS; VIRTUAL REALITY;

CLOUD COMPUTING;

EID: 84865104045     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (30)

1. S. Ristov, M. Gusev, M. Kostoska, and K. Kiroski, "Business continuity challenges in cloud computing," in ICT Innovations 2011, Web Proceedings, Skopje, Macedonia, 2011.
2. S. Ristov, M. Gusev, and M. Kostoska, "Cloud computing security in business information systems," 2012, to be published in International Journal of Network Security & Its Applications (IJNSA).
3. B. S. Kaliski, JR. and W. Pauley, "Toward risk assessment as a service in cloud environments," in Proc. of the 2nd conf. HotCloud'10. USENIX Ass., USA, 2010, pp. 13-13.
4. (2011, Sep.) CSA security as a service v1.0. [Online]. Available: https://cloudsecurityalliance.org/research/working-groups/secaas/
5. (2011, Sep.) NIST SP800-53 revision 3. [Online]. Available: http://csrc.nist.gov/publications/PubsSPs.html
6. (2011, Sep.) FIPS 200 minimum security requirements for federal information and information systems. [Online]. Available: http://csrc.nist.gov/ publications/PubsFIPS.html
7. (2011, Sep.) NIST SP800-39 managing information security risk. [Online]. Available: http://csrc.nist.gov/publications/PubsSPs.html
8. ISO/IEC 27001:2005, Information Security Management Systems - Requirements. [Online]. Available: http://www.iso.org/iso/iso-catalogue/ catalogue-tc/catalogue-detail.htm?csnumber=42103
9. (2010) Microsoft information security management system for microsoft cloud infrastructure. [Online]. Available: http://www.globalfoundationservices. com/security/documents/InformationSecurityMangSysfor/MSCloudInfrastructure.pdf
10. (2011, Sep.) ISO/IEC 27002:2005, Code of Practice for Information Security Management. [Online]. Available: http://www.iso.org/iso/iso-catalogue/ catalogue-tc/catalogue detail.htm?csnumber=50297
11. ISO/IEC 27005:2011, Information Security Risk Management. [Online]. Available: http://www.iso.org/iso/iso-catalogue/catalogue-tc/catalogue-detail. htm?csnumber=56742
12. (2011, Sep.) ISACA cobit 4.1. [Online]. Available: http://www.isaca.org/ Knowledge-Center/COBIT/Pages/Overview.aspx
13. (2011, Sep.) AICPA SSAE 16. [Online]. Available: http://www.aicpa.org/ Research/Standards/AuditAttest/Pages/SSAE.aspx
14. (2011, Sep.) HIPAA. [Online]. Available: https://www.cms.gov/ HIPAAGenInfo/
15. (2011, Sep.) PCI DSS v2.0. [Online]. Available: https://www. pcisecuritystandards.org/security-standards/
16. (2011, Sep.) CSA top threats to cloud computing. [Online]. Available: http://www.cloudsecurityalliance.org/topthreats/csathreats.v1.0.pdf
17. D. Catteddu and G. Hogben. (2009) Cloud computing risk assessment. [Online]. Available: http://www.enisa.europa.eu/publications/position-papers/ position-papers-at-enisa/act/rm/files/deliverables/cloud-computing-risk- assessment
18. (2011, Sep.) NIST SP800-144 draft guidelines on security and privacy in public cloud computing. [Online]. Available: http://csrc.nist.gov/publications/ PubsSPs.html
19. (2011, Sep.) CSA security guidance for critical areas of focus in cloud computing v2.1. [Online]. Available: https://cloudsecurityalliance.org/research/ initiatives/security-guidance/
20. (2011, Sep.) Cloud security alliance group CSA-GRC stack. [Online]. Available: http://www.cloudsecurityalliance.org/grcstack.html
21. (2011, Sep.) CSA cloud security alliance cloud controls matrix (CCM), v1.2. [Online]. Available: https://cloudsecurityalliance.org/research/ initiatives/cloud-controls-matrix/
22. C. Clayton. (2011, Sep.) Standard cloud taxonomies and windows azure. [Online]. Available: http://blogs.msdn.com/b/cclayton/archive/2011/06/07/ standard-cloud-taxonomies-and-windows-azure.aspx
23. R. Glott, E. Husmann, A. Sadeghi, and M. Schunter, "Trustworthy clouds underpinning the future internet," in The future internet, J. D. et al, Ed. Springer-Verlag, Berlin, Heidelberg, pp. 209-221.
24. A. S. Ibrahim, J. Hamlyn-Harris, and J. Grundy, "Emerging security challenges of cloud virtual infrastructure," in Proc. of the Asia Pacific Cloud Workshop 2010 (co-located with APSEC2010), Sydney, 2010.
25. Z. Afoulki, A. Bousquet, and J. Rouzaud-Cornabas, "A security-aware scheduler for virtual machines on iaas clouds," Tech. Rep. RR-2011-08. [Online]. Available: http://www.univ-orleans.fr/lifo/rapports.php?lang= en&sub=sub3
26. M. Taylor and C. J. Guo. (2012, Jan.) Data integration and composite business services, part 3: Build a multi-tenant data tier with access control and security. [Online]. Available: http://www.ibm.com/developerworks/data/ library/techarticle/dm-0712taylor/
27. F. Hao, T. V. Lakshman, S. Mukherjee, and H. Song, "Secure cloud computing with a virtualized network infrastructure," in Proc. of the 2nd conf. HotCloud'10. USENIX Ass., USA, 2010, pp. 16-16.
28. A. S. Ibrahim, J. Hamlyn-Harris, J. Grundy, and M. Almorsy, "Cloudsec: A security monitoring appliance for virtual machines in the iaas cloud model," in Proceedings of 5th International Conference on Network and System Security (NSS 2011), Milan, Italy, 2011.
29. H. Takabi, J. B. D. Joshi, and G. Ahn, "Security and privacy challenges in cloud computing environments," IEEE J. of Security & Privacy, vol. 8, no. 6, pp. 24-31, 2010.
30. K. Hwang and D. Li, "Trusted cloud computing with secure resources and data coloring," IEEE Internet Computing, pp. 14-22, 2010.