Risk perception and risk management in cloud computing: Results from a case study of Swiss companies

Abstract

In today's economic turmoil, the pay-per-use pricing model of cloud computing, its flexibility and scalability and the potential for better security and availability levels are alluring to both SMEs and large enterprises. However, cloud computing is fraught with security risks which need to be carefully evaluated before any engagement in this area. This article elaborates on the most important risks inherent to the cloud such as information security, regulatory compliance, data location, investigative support, provider lock-in and disaster recovery. We focus on risk and control analysis in relation to a sample of Swiss companies with regard to their prospective adoption of public cloud services. We observe a sufficient degree of risk awareness with a focus on those risks that are relevant to the IT function to be migrated to the cloud. Moreover, the recommendations as to the adoption of cloud services depend on the company's size with larger and more technologically advanced companies being better prepared for the cloud. As an exploratory first step, the results of this study would allow us to design and implement broader research into cloud computing risk management in Switzerland.

Determinant Factors of Cloud-Sourcing Decisions: Reflecting on the IT Outsourcing Literature in the Era of Cloud Computing

“…The on-demand pricing model of CC bears the risk of unpredicted costs or economic denial of service attacks (Brender and Markov, 2013). However, flat-rate pricing models or pricing models based on the number of registered users do not carry such risks (Koehler et al, 2010).…”

A Risk Management Approach for a Sustainable Cloud Migration

“…In relation to cloud risk assessment, ENISA in (ENISA 2009) provides guidance on the assessment of cloud risks and benefits for potential and existing users of cloud computing which include audit and SLA assessment. Basically, the role of risk management in cloud migration is performed in order to identify the most important risks associated to a specific organisation, to provide information to a decision maker and as a strategy to highlight the implication of cloud migration to organisation in terms of change in procedures, process and resources due to cloud computing (Khajeh-Hosseini et al 2011;Brender and Markov 2013). From the organisational perspective, risk factors on cloud migration are derived from four key areas; enterprise, technical, legal and common risk.…”

“…From the organisational perspective, risk factors on cloud migration are derived from four key areas; enterprise, technical, legal and common risk. In relation to these four areas, the organisation needs to consider several aspects such as business economic, security, availability, quality of services, uncertainty with implemented new technologies and outsourcing (Brender and Markov 2013). Cloud migration decisions involve alternative of buying or leasing resources in long term.…”

“…The distribution of cost and resources to several locations generates potential sustainability risks related to system performance, security and privacy in cloud computing. These include falsification of messages, hardware interception, information leaks, traffic redirection (Brender and Markov 2013).…”

“…Using the D-S theory of belief functions, risk can be modelled by applying the notion of the plausibility (i.e., risk) of a negative outcome (Dempster 1967). The plausibility function is also representing material errors that exist in the evidence and can be applied to measure a risk (Brender and Markov 2013). So the estimation of probability value of risk follows either equation 5 or 6 and probability scales are shown in Table 4.…”