SecAgreement: Advancing Security Risk Calculations in Cloud Services

Abstract

Abstract-By choosing to use cloud services, organizations seek to reduce costs and maximize efficiency. For mission critical systems that must satisfy security constraints, this push to the cloud introduces risks associated with cloud service providers not implementing organizationally selected security controls or policies. As internal system details are abstracted away as part of the cloud architecture, the organization must rely on contractual obligations embedded in service level agreements (SLAs) to assess service offerings. Current SLAs focus on quality of service metrics and lack the semantics needed to express security constraints that could be used to measure risk. We create a framework, called SecAgreement (SecAg), that extends the current SLA negotiation standard, WS-Agreement, to allow security metrics to be expressed on service description terms and service level objectives. The framework enables cloud service providers to include security in their SLA offerings, increasing the likelihood that their services will be used. We define and exemplify a cloud service matchmaking algorithm to assess and rank SecAg enhanced WS-Agreements by their risk, allowing organizations to quantify risk, identify any policy compliance gaps that might exist, and as a result select the cloud services that best meet their security needs.

Building a Compliance Vocabulary to Embed Security Controls in Cloud SLAs

“…which vocabulary terms) are being offered by the CSP. Our approach is demonstrably compatible with existing SLA frameworks including WS-Agreement [9,14,19] and WSLA [13,14,20,21].…”

“…Cloud service compliance research has focused on SLAs [9,14,15,22] and service matchmaking [9,14], security requirement assessment of CSPs [15], and the automation and validation of service configurations [22]. These approaches underscore the importance of service compliance with sets of security requirements, which may be expressed as security controls or formal statements.…”

“…In our previous work [9,10], we advance SLA research by developing a schema, based on WS-Agreement [19], that is capable of expressing security requirements in a standard way across service providers. We define an associated matchmaking algorithm that compares security requirements to identify the security offerings best suited to a particular organization.…”

“…Although various approaches have improved the ability of SLAs to expose and advertise their security services [9][10][11][12][13], selecting the provider that is most compatible with organizationally selected security controls is still ad-hoc [14]. The main problem is that security controls lack representation in cloud services [14,15], making it difficult to connect organizational certification efforts to the services and security features being used by the cloud.…”

An Analysis of Cloud Computing Information Security Challenges.

“…However risk quantification is not semantically netted in ws-agreement. SecAgreement [46] articulates the security parameters and services to be provided in the SLAs. The SecAgreement extends the template of the ws-agreement to include security constraints and metrics into the SLAs.…”