Abstract:The cloud model allows many enterprises able to outsource computing resources at an affordable price without having to commit the expense upfront. Although the cloud providers are responsible for the security of the cloud, there are still many security concerns due to inherently complex model the cloud providers operate on (e.g.,multi-tenancy). In addition, the enterprises whose services have migrated into the cloud have a preference for their own cybersecurity situation awareness capability on top of the security mechanisms provided by the cloud providers. In this way, the enterprises can monitor the performance of the security offerings of the cloud and have a choice to decide and select potential response strategies more appropriate to the enterprise in the presence of the attack where the defense provided by the cloud doesn't work for them. However, some response strategies, such as Moving Target Defense (MTD) techniques shown to be effective to secure cloud, cannot be deployed by the enterprise themselves. In this paper, we propose a framework that enables better collaboration between enterprises and cloud providers. Our proposed framework, which offers more in-depth security analysis based on the set of most advanced security metrics, allows the security experts of the enterprise to obtain better situational awareness in the cloud. With better and more effective situation awareness of cloud security, our framework can support better decision-making and further allows to deploy more appropriate threat responses to protect the outsourced resources. We also propose a secure protocol which can facilitate more secure communication between the enterprises and cloud provider. Using our proposed secure protocol, which is based on authentication and key exchange mechanism, the enterprises can send a secure request to the cloud provider to perform a selected defensive strategy.

A Risk Assessment Framework and Software Toolkit for Cloud Service Ecosystems

Towards a Service Lifecycle Based Methodology for Risk Assessment in Cloud Computing

Legal issues in clouds: towards a risk inventory.

A Framework for Cloud Security Risk Management Based on the Business Objectives of Organizations

ERMOCTAVE: A Risk Management Framework for IT Systems Which Adopt Cloud Computing

Use Trust Management Module to Achieve Effective Security Mechanisms in Cloud Environment

Agile Risk Management for Multi-Cloud Software Development

Information Security Risk Management Framework for the Cloud Computing Environments

Risk-Driven Proactive Fault-Tolerant Operation of IaaS Providers

Security risks and their management in cloud computing

Automated Cyber and Privacy Risk Management Toolkit

Risk-Driven Compliant Access Controls for Clouds

Cyber Situation Awareness Monitoring and Proactive Response for Enterprises on the Cloud

An Automated Security Analysis Framework and Implementation for Cloud

Collaboration-Based Cloud Computing Security Management Framework

A Cloud Security Framework Based on Trust Model and Mobile Agent

VMRaS: A Novel Virtual Machine Risk Assessment Scheme in the Cloud Environment

Cloud computing adoption framework: A security framework for business clouds

CloudSafe: A Tool for an Automated Security Analysis for Cloud Computing

Risk Driven Smart Home Resource Management Using Cloud Services

An Evolutionary Cultural Algorithm Based Risk-aware Virtual Machine Scheduling Optimisation in Infrastructure As a Service (iaas) Cloud