Impact of Critical Infrastructure Requirements on Service Migration Guidelines to the Cloud

Abstract

Abstract-A high level of information security in critical infrastructure IT systems and services has to be preserved when migrating their IT services to the cloud. Often various legislative and security constraints have to be met in line with best practice guidelines and international standards to perform the migration. To support the critical infrastructure providers in migrating their services to the cloud we are developing a process based migration guideline for critical infrastructure providers focusing on information security. First of all we investigate, via questionnaires, how the importance of individual security topics covered in such guidelines differentiates between industry stakeholders and critical infrastructure providers. This supports the selection of relevant security topics and the considered guidelines and standards, which we survey in search for common relevant security topics. Subsequently we present the analysis of the above-mentioned security requirements and how they affect a here developed taxonomy for a process-based security guideline. Furthermore we present potential service migration use cases and how our methodology would affect the migration of secure critical infrastructure services.

A Resilience Engineering Approach for the Risk Assessment of IT Services

“…To deal with them, as stressed by Aven [24], further research is needed to develop risk assessment procedures tailored for the management of "critical infrastructures", whose vulnerability is related to threats due to human actions that cannot be properly managed using traditional risk assessment approaches, as in the case of security infrastructures and the reliability of IT services [25,26]. It must be noted that also in the latter context, recent cases of failures and malfunctioning have caused significant problems: for example, the fire that seriously damaged Europe's largest cloud services firm, OVHcloud, in 2021 [27], or the outage that occurred in 2021, which involved one of the major Content Delivery Network (CDN) providers [28].…”