TY  - JOUR
A1  - Pape, Sebastian
A1  - Paci, Federica
A1  - Jürjens, Jan
A1  - Massacci, Fabio
T1  - Selecting a secure cloud provider - an empirical study and multi criteria approach
T2  - Information
N2  - Security has become one of the primary factors that cloud customers consider when they select a cloud provider for migrating their data and applications into the Cloud. To this end, the Cloud Security Alliance (CSA) has provided the Consensus Assessment Questionnaire (CAIQ), which consists of a set of questions that providers should answer to document which security controls their cloud offerings support. In this paper, we adopted an empirical approach to investigate whether the CAIQ facilitates the comparison and ranking of the security offered by competitive cloud providers. We conducted an empirical study to investigate if comparing and ranking the security posture of a cloud provider based on CAIQ’s answers is feasible in practice. Since the study revealed that manually comparing and ranking cloud providers based on the CAIQ is too time-consuming, we designed an approach that semi-automates the selection of cloud providers based on CAIQ. The approach uses the providers’ answers to the CAIQ to assign a value to the different security capabilities of cloud providers. Tenants have to prioritize their security requirements. With that input, our approach uses an Analytical Hierarchy Process (AHP) to rank the providers’ security based on their capabilities and the tenants’ requirements. Our implementation shows that this approach is computationally feasible and once the providers’ answers to the CAIQ are assessed, they can be used for multiple CSP selections. To the best of our knowledge this is the first approach for cloud provider selection that provides a way to assess the security posture of a cloud provider in practice.
KW  - cloud service provider
KW  - security self-assessment
KW  - security assessment
KW  - risk assessment
Y1  - 2020
UR  - http://publikationen.ub.uni-frankfurt.de/frontdoor/index/index/docId/54902
UR  - https://nbn-resolving.org/urn:nbn:de:hebis:30:3-549021
SN  - 2078-2489
VL  - 11
IS  - 261
SP  - 1
EP  - 27
PB  - MDPI
CY  - Basel
ER  -