Prioritizing Cloud Service Threats for Succession to Information Security Management System
AUTHORS
Hyun Chul Jung,Ph.D Student, Dept. of Management Engineering, Graduate School, Sangmyung Univ., 03016, Seoul, Korea
Kwang-Kyu Seo,Professor, Dept. Management Engineering, Sangmyung Univ., Cheonan, Chungnam, 31066, Korea
ABSTRACT
With the growth of the cloud computing industry, there is also an increased risk that cloud service providers are stably providing services. Cloud service providers need to identify these threats and be proactive. Because cloud service is a service that requires a high availability rate of at least 99.9%. Therefore, this study presents a framework for collecting and prioritizing potential threats that could compromise the service of a cloud service provider. In addition, a case study was conducted to verify the proposed framework. This framework can be used only when the cloud service provider has a risk management procedure, and has a limitation in that the subjective characteristics of the cloud service provider may be included in the use of the framework. Nevertheless, it can be used in establishing a proactive threat management plan for cloud service delivery and researching cloud security management methodology.
KEYWORDS
Cloud computing, Security, Cloud service, Job importance, Risk management, Service continuity, Threat evaluation, Threat priority
REFERENCES
[1] Sungpil Jo, “A study on threats and countermeasures of information security in the era of the 4th Industrial Revolution,” Security Research, pp.9-35, (2017)
[2] https://cloudsecurityalliance.org/press-releases/, Aug 9 (2019)
[3] Jeong-hoon Jeon, “A study on the vulnerability of the Cloud computing security,” Journal of The Korea Institute of Information Security and Cryptology, vol.23, no.6, vol.23, no.6, pp.1239-1246, (2013)
[4] Kyoung-a Shin and Sang-Jin Lee, “Information security management system on cloud computing service,” Journal of The Korea Institute of Information Security and Cryptology, vol.22, no.1, pp.155-167, (2012)
[5] http://www.skinfosec.com/newsRoom/eqstInsight/eqstInsightList.do, Jun 21 (2019)
[6] https://www.kisa.or.kr/public/laws/laws3.jsp, Dec, (2017)
[7] https://cyber-edge.com/wp-content/uploads/2019/03/CyberEdge-2019-CDR-Report.pdf, Mar, (2019)
[8] https://www.iso.org/obp/ui/#iso:std:iso-iec:27001:ed-2:v1:en, (2013)