TU Darmstadt / ULB / TUbiblio

A Trust-aware Framework for Evaluating Security Controls of Service Providers in Cloud Marketplaces

Habib, Sheikh Mahbub and Varadharajan, Vijay and Mühlhäuser, Max (2013):
A Trust-aware Framework for Evaluating Security Controls of Service Providers in Cloud Marketplaces.
In: Trust, Security and Privacy in Computing and Communications (TrustCom), 2013 12th IEEE International Conference on, IEEE, Melbourne, Australia, ISBN 978-0-7695-5022-0,
DOI: 10.1109/TrustCom.2013.58,
[Conference or Workshop Item]

Abstract

Trustworthy selection of cloud services has become a significant issue in emerging cloud marketplaces. As a consequence, the Cloud Security Alliance (CSA) has formulated a self-assessment framework for cloud providers to publish their cloud platform's security controls and capabilities. This framework enables consumers to select a cloud service based on the capabilities and controls published by the providers. However, a fundamental question that arises is, how can consumers trust that the security controls are satisfied as claimed by the providers and are compliant with consumers' requirements. This paper proposes a trust-aware framework to verify and evaluate these security controls considering consumers' requirements. First, we model the security controls in the form of trust properties. Then, we introduce a taxonomy of these properties based on their semantics and identify the authorities who can validate the properties. The taxonomy of these properties is the basis of trust formalisation in our proposed framework. The framework rests on the notion of hybrid trust that combines hard and soft trust mechanisms for verifying the trust properties. Furthermore, a decision model is proposed as an integral part of the framework in order to empower consumers to determine trustworthiness of cloud providers. Finally, we demonstrate that the proposed trust-aware security evaluation framework could be potentially useful in practice for consumers to determine trustworthy cloud providers in a competitive marketplace

Item Type: Conference or Workshop Item
Erschienen: 2013
Creators: Habib, Sheikh Mahbub and Varadharajan, Vijay and Mühlhäuser, Max
Title: A Trust-aware Framework for Evaluating Security Controls of Service Providers in Cloud Marketplaces
Language: English
Abstract:

Trustworthy selection of cloud services has become a significant issue in emerging cloud marketplaces. As a consequence, the Cloud Security Alliance (CSA) has formulated a self-assessment framework for cloud providers to publish their cloud platform's security controls and capabilities. This framework enables consumers to select a cloud service based on the capabilities and controls published by the providers. However, a fundamental question that arises is, how can consumers trust that the security controls are satisfied as claimed by the providers and are compliant with consumers' requirements. This paper proposes a trust-aware framework to verify and evaluate these security controls considering consumers' requirements. First, we model the security controls in the form of trust properties. Then, we introduce a taxonomy of these properties based on their semantics and identify the authorities who can validate the properties. The taxonomy of these properties is the basis of trust formalisation in our proposed framework. The framework rests on the notion of hybrid trust that combines hard and soft trust mechanisms for verifying the trust properties. Furthermore, a decision model is proposed as an integral part of the framework in order to empower consumers to determine trustworthiness of cloud providers. Finally, we demonstrate that the proposed trust-aware security evaluation framework could be potentially useful in practice for consumers to determine trustworthy cloud providers in a competitive marketplace

Title of Book: Trust, Security and Privacy in Computing and Communications (TrustCom), 2013 12th IEEE International Conference on
Publisher: IEEE
ISBN: 978-0-7695-5022-0
Uncontrolled Keywords: - SST: CASED:;- SST: CASED;- SST - Area Smart Security and Trust;SPIN: Smart Protection in Infrastructures and Networks;Cloud Security
Divisions: 20 Department of Computer Science > Telecooperation
LOEWE > LOEWE-Zentren > CASED – Center for Advanced Security Research Darmstadt
Profile Areas > Cybersecurity (CYSEC)
LOEWE > LOEWE-Zentren
20 Department of Computer Science
Profile Areas
LOEWE
Event Location: Melbourne, Australia
Date Deposited: 22 Jan 2017 18:57
DOI: 10.1109/TrustCom.2013.58
Identification Number: TUD-CS-2013-0466
Export:
Suche nach Titel in: TUfind oder in Google

Optionen (nur für Redakteure)

View Item View Item