Enhanced Grey Risk Assessment Model for Support of Cloud Service Provider

Security and privacy concerns represent a significant hindrance to the widespread adoption of cloud computing services. While cloud adoption mitigates some of the existing information technology (IT) risks, research shows that it introduces a new set of security risks linked to multi-tenancy, supply chain and system complexity. Assessing and managing cloud risks can be a challenge, even for cloud service providers (CSPs), due to the increased numbers of parties, devices and applications involved in cloud service delivery. The limited visibility of security controls down the supply chain, further exacerbates this risk assessment challenge. As such, we propose the Cloud Supply Chain Cyber Risk Assessment (CSCCRA) model, a quantitative risk assessment model which is supported by supplier security posture assessment and supply chain mapping. Using the CSCCRA model, we assess the risk of a SaaS application, mapping its supply chain, identifying weak links in the chain, evaluating its security risks and presenting the risk value in monetary terms (£), with this, promoting cost-effective risk mitigation and optimal risk prioritisation. We later apply the Core Unified Risk Framework (CURF) in comparing the CSCCRA model with already established methods, as part of evaluating its completeness.

Download Full-text

CLOUD SECURITY PRE-ASSESSMENT MODEL FOR CLOUD SERVICE PROVIDER BASED ON ISO/IEC 27017:2015 ADDITIONAL CONTROL

International Journal of Innovation and Industrial Revolution ◽

10.35631/ijirev.25001 ◽

2020 ◽

Vol 2 (5) ◽

pp. 01-17

Author(s):

Nur Ahada Kamaruddin ◽

Ibrahim Mohamed ◽

Ahmad Dahari Jarno ◽

Maslina Daud

Keyword(s):

Cloud Computing ◽

Service Provider ◽

Cost Effective ◽

Cloud Service ◽

Cloud Security ◽

Assessment Method ◽

Cloud Services ◽

Assessment Model ◽

Cloud Service Provider ◽

Security Controls

Cloud computing technology has succeeded in attracting the interest of both academics and industries because of its ability to provide flexible, cost-effective, and adaptable services in IT solution deployment. The services offered to Cloud Service Subscriber (CSS) are based on the concept of on-demand self-service, scalability, and rapid elasticity, which allows fast deployment of IT solutions, whilst leads to possible misconfiguration, un-patched system, etc. which, allows security threats to compromise the cloud services operations. From the viewpoint of Cloud Service Provider (CSP), incidents such as data loss and information breach, will tarnish their reputations, whilst allow them to conserve the issues internally, in which there is no transparency between CSP and CSS. In the aspects of information security, CSP is encouraged to practice cybersecurity in their cloud services by adopting ISO/IEC27017:2015 inclusive of all additional security controls as mandatory requirements. This study was conducted to identify factors that are influencing the CSP readiness level in the cybersecurity implementation of their cloud services by leveraging the developed pre-assessment model to determine the level of cloud security readiness. Approached the study is based on the combination of qualitative and quantitative assessment method in validating the proposed model through interview and prototype testing. The findings of this study had shown that factors that influence the CSP level of cloud security readiness are based on these domains; technology, organisation, policy, stakeholders, culture, knowledge, and environment. The contribution of the study as a Pre-Assessment Model for CSP which is suitable to be used as a guideline to provide a safer cloud computing environment.

Download Full-text

Risk assessment model for venous thromboembolism in hospitalized surgical and non-surgical patients in the 4th Hungarian Antithrombotic Guidelines entitled “Diminution and Treatment of Venous Thromboembolism”

Orvosi Hetilap ◽

10.1556/oh.2010.28944 ◽

2010 ◽

Vol 151 (34) ◽

pp. 1365-1374 ◽

Cited By ~ 1

Author(s):

Marianna Dávid ◽

Hajna Losonczy ◽

Miklós Udvardy ◽

Zoltán Boda ◽

György Blaskó ◽

...

Keyword(s):

Risk Assessment ◽

Venous Thromboembolism ◽

Assessment Model ◽

Surgical Patients ◽

Risk Assessment Model

A kórházban kezelt sebészeti és belgyógyászati betegekben jelentős a vénásthromboembolia-rizikó. Profilaxis nélkül, a műtét típusától függően, a sebészeti beavatkozások kapcsán a betegek 15–60%-ában alakul ki mélyvénás trombózis vagy tüdőembólia, és az utóbbi ma is vezető kórházi halálok. Bár a vénás thromboemboliát leggyakrabban a közelmúltban végzett műtéttel vagy traumával hozzák kapcsolatba, a szimptómás thromboemboliás események 50–70%-a és a fatális tüdőembóliák 70–80%-a nem a sebészeti betegekben alakul ki. Nemzetközi és hazai felmérések alapján a nagy kockázattal rendelkező sebészeti betegek többsége megkapja a szükséges trombózisprofilaxist. Azonban profilaxis nélkül marad a rizikóval rendelkező belgyógyászati betegek jelentős része, a konszenzuson alapuló nemzetközi és hazai irányelvi ajánlások ellenére. A belgyógyászati betegek körében növelni kell a profilaxisban részesülők arányát és el kell érni, hogy trombózisrizikó esetén a betegek megkapják a hatásos megelőzést. A beteg trombóziskockázatának felmérése fontos eszköze a vénás thromboembolia által veszélyeztetett betegek felderítésének, megkönnyíti a döntést a profilaxis elrendeléséről és javítja az irányelvi ajánlások betartását. A trombózisveszély megállapításakor, ha nem ellenjavallt, profilaxist kell alkalmazni. „A thromboemboliák kockázatának csökkentése és kezelése” című, 4. magyar antithromboticus irányelv felhívja a figyelmet a vénástrombózis-rizikó felmérésének szükségességére, és elsőként tartalmazza a kórházban fekvő belgyógyászati és sebészeti betegek kockázati kérdőívét. Ismertetjük a kockázatbecslő kérdőíveket és áttekintjük a kérdőívekben szereplő rizikófaktorokra vonatkozó bizonyítékokon alapuló adatokat.

Download Full-text

Signature Analysis: Statistical Models and Their Application to FA

ISTFA 1996: Conference Proceedings from the 22nd International Symposium for Testing and Failure Analysis ◽

10.31399/asm.cp.istfa1996p0183 ◽

1996 ◽

Author(s):

C.K. Lakshminarayan ◽

S. Pabbisetty ◽

O. Adams ◽

F. Pires ◽

M. Thomas ◽

...

Keyword(s):

Risk Assessment ◽

Failure Analysis ◽

Statistical Models ◽

Essential Elements ◽

Assessment Model ◽

Signature Analysis ◽

Risk Assessment Model ◽

Sample Sizes ◽

Reliability Engineering ◽

Semiconductor Chips

Abstract This paper deals with the basic concepts of Signature Analysis and the application of statistical models for its implementation. It develops a scheme for computing sample sizes when the failures are random. It also introduces statistical models that comprehend correlations among failures that fail due to the same failure mechanism. The idea of correlation is important because semiconductor chips are processed in batches. Also any risk assessment model should comprehend correlations over time. The statistical models developed will provide the required sample sizes for the Failure Analysis lab to state "We are A% confident that B% of future parts will fail due to the same signature." The paper provides tables and graphs for the evaluation of such a risk assessment. The implementation of Signature Analysis will achieve the dual objective of improved customer satisfaction and reduced cycle time. This paper will also highlight it's applicability as well as the essential elements that need to be in place for it to be effective. Different examples have been illustrated of how the concept is being used by Failure Analysis Operations (FA) and Customer Quality and Reliability Engineering groups.

Download Full-text