How to Manage Cloud Risks Based on the BMIS Model
2
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
Information always comes with security and risk problems. There is thesaying that, “The tall tree catches much wind,” and the risks from cloud services willabsolutely be more varied and more severe. Nowadays, handling these risks is nolonger just a technology problem. So far, a good deal of literature that focuses on riskor security management and frameworks in information systems has already beensubmitted. This paper analyzes the causal risk factors in cloud environments throughcritical success factors, from a business perspective. We then integrated these criticalsuccess factors into a business model for information security by mapping out 10principles related to cloud risks. Thus, we were able to figure out which aspects shouldbe given more consideration in the actual transactions of cloud services, and were ableto make a business-level and general-risk control model for cloud computing.
Abstract
Information always comes with security and risk problems. There is thesaying that, “The tall tree catches much wind,” and the risks from cloud services willabsolutely be more varied and more severe. Nowadays, handling these risks is nolonger just a technology problem. So far, a good deal of literature that focuses on riskor security management and frameworks in information systems has already beensubmitted. This paper analyzes the causal risk factors in cloud environments throughcritical success factors, from a business perspective. We then integrated these criticalsuccess factors into a business model for information security by mapping out 10principles related to cloud risks. Thus, we were able to figure out which aspects shouldbe given more consideration in the actual transactions of cloud services, and were ableto make a business-level and general-risk control model for cloud computing.
참고문헌 (27)
- Antonio Colella, "Security Paradigm in Ubiquitous Computing", 2012 Sixth International Conference on Innovative Mobile and Internet Services in Ubiquitous Computing, pp.634~638 (2012)
- "Management Information Systems" (1995)[URL]
- Mohammed Alhamad, "Conceptual SLA Framework for Cloud Computing", 4th IEEE International Conference on Digital Ecosystems and Technologies, pp.606~610 (2010)
- Zhitao Huang, "An Efficient Framework for IT Controls of Bill 198(Canada Sarbanes-Oxley) Compliance by Aligning COBIT 4.1, ITIL v3 and ISO", IEC 27002, 2009, 386~391
- Shamsul Sahibudin, "Combining ITIL, COBIT and ISO", IEC 27002 in Order to Design a Comprehensive IT Framework in Organizations, 2008, 749~753
- Gang Zhao, "Holistic Framework of Security Management for Cloud Service Providers", 10th IEEE International Conference, pp.852~856 (2012)
- Zhiyun Guo, "A Governance Model for Cloud Computing", Management and Service Science (MASS), 2010 International Conference (2010)
- Jing-Jang Hwang, "A Business Model for Cloud Computing Based on a Separate Encryption and Decryption Service", Information Science and Applications (ICISA), 2011 International Conference (2011)
- "Information Security and Its Impact on Business" (2006)[URL]
- "The Management of Security in Cloud Computing" (2010)[URL]
- "An Introduction to the Business Model for Information Security"[URL]
- "Top Threats to Cloud Computing V1.0" (2010)[URL]
- Daniel, "Management Information Crisis" (1961), Harvard Business Review
- "Chief Executives Define their Own Data Needs" (1979)[URL]
- "A Primer on Critical Success Factors" (1981)[URL]
- "The Critical Success Factor Method: Establishing a Foundation for Enterprise Security Management" (2004)[URL]
- JenSheng Wang, "How to Manage Information Security in Cloud Computing", Systems, Man, and Cybernetics (SMC), 2011 IEEE International Conference, pp.1405~1410 (2011)
- David Vohradsky, "Cloud Risk—10 Principles and a Framework for Assessment", ISACA JOURNAL, 5, pp.31~41 (2012)
- Iliana Iankoulova, "Computing Security Requirements:a Systematic Review", Research Challenges in Information Science (RCIS), 2012 Sixth International Conference (2012)
- Donald Firesmith, "Specifying Reusable Security Requirements", JOURNAL OF OBJECT TECHNOLOGY, 3(1), pp.61~75 (2004)
- Rolf Von Rössing, "Applying BMIS to Cloud Security", ISSE 2010 Securing Electronic Business Processes, pp.101~112 (2011)
- "2010 Global state of information security"[URL]
- Prasad Saripalli, "QUIRC: A Quantitative Impact and Risk Assessment Framework for Cloud Security", 2010 IEEE 3rd International Conference on Cloud Computing, pp.280~288 (2010)