Cyber Security in Cloud: Risk Assessment Models

TL;DR

This paper reviews cloud risk assessment models, identifying gaps and proposing enhancements using techno-economic models to improve simplicity, compliance, and applicability across cloud service models.

Contribution

It introduces the UTEM techno-economic model to enhance existing cloud risk assessment frameworks for better usability and compliance.

Findings

Models leveraging CSA STAR show higher compliance.

Current models lack risk economic quantification.

UTEM can simplify risk assessment processes.

Abstract

The present paper shows a proposal of the characteristics Cloud Risk Assessment Models should have and presents the review of the literature considering those characteristics in order to identify current gaps. This work shows a ranking of Cloud RA models and their degree of compliance with the theoretical reference Cloud Risk Assessment model. The review of literature shows that RA approaches leveraging CSA (Cloud Security Alliance) STAR Registry that have into account organizations security requirements present higher degree of compliance, but they still lack risk economic quantification. The myriad of conceptual models, methodologies and frameworks although based on current NIST SP 800:30, ISO 27001, ISO 27005, ISO 30001, ENISA standards could be enhanced by the use of techno-economic models like UTEM, created by the author, in order to conceive more simplified models for effective Risk Assessment and Mitigation closer to the theoretical reference model for Cloud Risk Assessment, available for all cloud models (IaaS, PaaS, SaaS) and easy to use for all stakeholders.