No abstract

Federated cloud systems increase the reliability and reduce the cost of computational support to an organization. However, the resulting combination of secure private clouds and less secure public clouds impacts on the overall security of the system as applications need to be located within different clouds. In this paper, the entities of a federated cloud system as well as the clouds are assigned security levels of a given security lattice. Then a dynamic flow sensitive security model for a federated cloud system is introduced within which the Bell-LaPadula rules and cloud security rule can be captured. The rest of the paper demonstrates how Petri nets and the associated verification techniques could be used to analyze the security of information flow in federated cloud systems.

No abstract

By providing effective access control mechanisms, enterprise information security technologies have been proven successful in protecting the sensitive information in business organizations. However, such security mechanisms typically reduce the work productivity of the staff, by making them spend time working on non-project related tasks. Therefore, organizations have to invest a signification amount of capital in the information security technologies, and then to continue incurring additional costs. In this study, we investigate the non-productive time (NPT) in an organization, resulting from the implementation of information security technologies. An approximate analytical solution is discussed first, and the loss of staff member productivity is quantified using non-productive time. Stochastic Petri nets are then used to provide simulation results. Moreover, sensitivity analysis is applied to develop a cost-effective strategy for mitigating the negative impact of implementing information security technologies. The presented study can help information security managers to make investment decisions, and to take actions toward reducing the cost of information security technologies, so that a balance is kept between information security expense, resource drain and effectiveness of security technologies.

Internet of Things (IoT) with Cloud Computing (CC) is a new paradigm incorporating a pervasive presence of a wide range of things/objects which can interact with each other and cooperate, creating new services and reaching common goals. This will lead to more intelligent smart environments in a wide range of applications. In this context, protecting the Internet of Things with Cloud Computing (IoTwCC) against interference, including service attacks and viruses, becomes paramount. In this paper, we introduce a transition system representation to capture the information flow in IoTwCCs, and then investigate the opacity of the information flow model. In addition, we introduce a threat model to describe the actions of the system, and propose entropy as a security metrics to quantify the amount of information related to a service that might be exposed to other users or adversaries. It turns out that the opacity of the system is affected by the availability of the services. As a result, the trade-off between opacity and service availability can be analyzed.