The use of Cloud Computing services is an attractive option to improve IT systems to achieve rapidly and elastically provisioned capability, and also to offer economic benefits. However, companies see security as a major concern in migrating to the Cloud. To bring clarity in Cloud security, this paper presents a systematic approach to manage the risks and analyzes the full range of risk in Cloud Computing solutions. Furthermore, as a study case, Google App Engine Platform is assessed based on ISO/IEC 27002 and OWASP Top 10 Risk List in this paper. Knowing the risks of Cloud solutions, companies can execute well-informed decisions on going into the Cloud and build their Cloud solutions in a secure way, relying on a robust e-trust relationship.
TopRisk Management
Though an IT system can be evaluated in terms of functionality, completeness, consistency, accuracy, performance, reliability, usability, fit with the organization, and other relevant quality attributes (Hevner, March, Park, & Ram, 2004), if the system is not secure enough, the whole enterprise will be exposed to the high risk of getting into vulnerable situations. Despite the promising business model, security is a major concern that could limit the Cloud Computing paradigm’s impact (Jaeger & Schiffman, 2010). Owing to the fact that customers must perform their applications, or store their data on the Internet, moving application servers to Clouds means a considerable risk for enterprises. How to build up the trust in the remote execution becomes the biggest challenge. Identifying threats and vulnerabilities plays a crucial role in securing the system. Consequently, we need a systematic approach to identify the appropriated security requirements on Clouds which can fulfill the Business Strategy and reduce risks to create an effective and efficient IT system.
Security Risk management analyses what can happen and what the possible consequences can be, before deciding what should be done and when, to reduce the risk to an acceptable level (International Organization for Standardization, 2008). Risk should be identified, assessed, and monitored regularly.
The level of risk should be estimated by the likelihood of incident scenario, mapped against the estimated negative impact (Catteddu & Hogben, 2009). After assessing the risks, priority order for the risks and treatments should be also established before hosting the system on the Cloud. The risk executive function does not make authorization decision; rather, the intent is to provide visibility into the decisions of authorizing officials and a holistic view of risk to the organization beyond that risk associated with the operation and use of individual information systems (The National Institute of Standards and Technology, 2008). Companies can follow the process that suggest by ISO/ IEC 27005, as Figure 1 shows.
Figure 1. Information security risk management process (Source: International Organization for Standardization, 2008)