A Review of Security Risk Assessment Methods in Cloud Computing

Abstract

Abstract. The Cloud computing is a major technological trend that continues to evolve and flourish. It has potential benefits in achieving rapid and scalable resource provisioning capabilities as well as resource sharing. However, a number of security risk are emerging in association with cloud usage that need to be assessed before cloud computing is adopted. This paper presents a review of the security risk assessment methods in cloud computing. The paper aims to summarize, organize and classify the information available in the literature to identify any gaps in current research then suggest areas for further investigation. At the end, the paper suggests to have a collaborative security risk assessment method that will add great assistance to both service providers and consumers.

Cloud Security Risk Management: A Critical Review

“…However, the cloud computing environment is different from the traditional enterprise environment and the characteristics of the cloud model invalidate this assumption making the traditional methods unfit for cloud environment [6]. In addition, these methods do not readily fit the dynamic nature of clouds, which are characterized by on demand self-service and rapid elasticity [9].…”

“…Security assessment in cloud is a challenging domain and identifying security risks that may face the cloud customer is a complex task [9]. The cloud customer is not allowed to assess the security risks of the CSP since hackers who claimed to be customers may use the result of the risk assessment to exploit the vulnerability of the CSP [6].…”

“…The cloud customer is not allowed to assess the security risks of the CSP since hackers who claimed to be customers may use the result of the risk assessment to exploit the vulnerability of the CSP [6]. In addition, revealing the risks will likely lead to reduced confidence of customers on the cloud services and uncertainties on the quality and level of security implemented [9]. On the other hand, the CSP can't exactly calculate the risk since it does not know the real value of the data assets of the customer [6].…”

“…On the other hand, the CSP can't exactly calculate the risk since it does not know the real value of the data assets of the customer [6]. Lack of cloud security standard also created a challenge in cloud risk assessment [9]. Therefore, an effective cloud security risk management methodology is necessary to adequately assess and mitigate cloud security risks.…”

“…As a result, researchers proposed different security risk management methods and frameworks. Alturkistani and Emam [9] reviewed cloud risk assessment methods by classifying them into five categories as: assessment as a service, qualitative and quantitative, hierarchical, graph analysis and security matrix assessment [9]. They identified the main processes and components of the methods but they didn't assess the effectiveness of those methods.…”