The momentum behind Cloud Computing has revolutionized how ICT services are provided, adopted and delivered. Features such as high scalability, fast provisioning, on demand resource availability makes it an attractive proposition for deploying complex and demanding systems. Clouds are also very suitable for deploying systems with unpredictable load patterns including Critical infrastructure services. Though, the major obstacle in hosting Critical infrastructures is often a lack of assurance. The transparency and flexibility offered by the Cloud, abstracts per definition over e.g. data placement, hardware, service migration. This makes it very hard to assure security properties. We present an investigation of assurance approaches, an analysis of their suitability for Critical Infrastructure Services being deployed in the Cloud and presents our approach.

Abstract:An analysis of new technologies can yield insight into the way these technologies will be used. Inevitably, new technologies and their uses are likely to result in new security issues regarding threats, vulnerabilities and attack vectors. In this paper, we investigate and analyse technological and security trends and their potential to become future threats by systematically examining industry reports on existing technologies. Using a cloud computing use case we identify potential resilience metrics that can shed light on the security properties of the system.

The promise of low costs, adaptation to customer load, and fast service roll-out has made cloud infrastructures a primary choice for many service providers. So far, this has been largely for end-user and enterprise services. Recently, the cloud paradigm is being considered by service providers of critical infrastructures. A prominent example of this is ETSI's Industry Specification Group (ISG) on Network Function Virtualization, which provides guidelines on how to move telecommunications services to the cloud. But other critical infrastructure providers are following closely. Common characteristics of critical infrastructure services, such as network functions, are their high requirements for service dependability and security. In this paper, we present a risk assessment method for assessing the risks of moving critical infrastructure services to the cloud. To achieve this, we have extended a well-established information security risk assessment process and developed an extensive cloud-specific fault and challenge catalogue.

No abstract