CSCCRA: A Novel Quantitative Risk Assessment Model for Cloud Service Providers

Abstract

Assessing and managing cloud risks can be a challenge, even for the cloud service providers (CSPs), due to the increased numbers of parties, devices and applications involved in cloud service delivery. The limited visibility of security controls down the supply chain, further exacerbates this risk assessment challenge. As such, we propose the Cloud Supply Chain Cyber Risk Assessment (CSCCRA) model, a quantitative risk assessment model which is supported by cloud supplier security assessment (CSSA) and cloud supply chain mapping (CSCM). Using the CSCCRA model, we assess the risk of a Customer Relationship Management (CRM) application, mapping its supply chain to identify weak links, evaluating its security risks and presenting the risk value in dollar terms, with this, promoting cost-effective risk mitigation and optimal risk prioritisation.

Assessing the Security Risks of Multicloud SaaS Applications: A Real-World Case Study

“…We developed the CSCCRA model [11] to address the gap in cloud supply chain transparency, particularly how the lack of visibility of supplier's security controls has contributed to the inadequate level of cloud risk assessment. It aims to present the CSP's cloud risk in a format that is consistent, repeatable, traceable and understandable, allowing for the proactive mitigation of cloud risks.…”

“…This approach requires us to analyse the interdependencies of a cloud service while making use of modelling and simulation techniques to draw the result of the assessment [24]. The CSCCRA model is made up of three components and builds on existing risk standards and guidance documents such as ISO 27005:2011, ISO 31000:2009, NIST 800-30v1 and FAIR risk assessment [11]. The components are:…”

“…The CSC-CRA model is a supply chain-inclusive risk assessment model that aims to structurally analyse the interdependence between the components of a cloud service, assess the cybersecurity posture of its suppliers, and comprehensively identify and analyse cloud risks. It presents CSP's cloud risk in a format that is consistent, repeatable, traceable and understandable, one which encourages proactive mitigation of cloud risks [11].…”

Cyber risk assessment in cloud provider environments: Current models and future needs

“…Our decision to address security risk assessment from a cloud provider perspective was influenced by the scarcity of studies in this area, and on the practical need for cloud providers to assess security risks to assure secure cloud delivery to customers. As such, we also describe our novel quantitative model for cloud providers: Cyber Supply Chain Cloud Risk Assessment (CSCCRA) [17]. Here we highlight its strengths, which include its systematic analysis of cloud risks, the visual representation of the cloud supply chain, and the assessment of the cybersecurity posture of cloud suppliers.…”

“…The contributions of this paper are the identification of gaps in cloud risk assessment, an analysis of current models, and a more detailed presentation of the proposed CSCCRA model we introduced in [17] which is meant to address some of the identified gaps. Furthermore, we present directions for future research by outlining areas where the theory and practice of cloud provisioning risk assessment can be improved including the application of dynamic modelling based on defined boundaries and the development of automated models for the proactive mitigation of cloud risks.…”