A framework for cloud security audit

Abstract

More and more individual users and businesses are earnestly considering cloud adoption for achieving mission objectives. However, concerns being raised include the ability of users to ascertain the security posture of cloud service providers to adequately safeguard data and applications. We present a cloud security audit framework that entails a set of concepts such as goals, constraint, plan and evidence to enable prospective cloud users to identify their migration goals and introduce constraints that must be satisfied by a potential cloud provider before migration. The concepts are considered as a language for describing the properties necessary for cloud security audit through a metamodel. An example is given to demonstrate the applicability of the approach.