I/UCRC FRP: Collaborative: Risk Assessment Techniques for Off-line and On-line Security Evaluation of Cloud Computing

了解风险和对特定系统安全实践的依赖对于制定安全云采用的连贯战略至关重要。本文将对云计算的安全风险评估技术进行研究，重点研究离线风险管理和在线信任评估两个领域。该研究将开发一个项目评估模型，以捕获威胁、任务、资产和业务逻辑之间的关系；开发一个供应商评估模型，以评估供应商在安全责任中的份额；并开发一个成本效益权衡方法，以实现最佳的云采用战略。在此基础上，将制定基于不同应用、服务和供应商构成的云服务提供商评估的在线评估方法。随着云架构的激增，确保其安全性可评估和问题可解决至关重要。拟议的工作有可能使响亮的用户能够衡量单个云元素或聚合云资源的可信性，并分析和建议适当的风险缓解战略。这项工作得到了行业咨询委员会的支持，并将吸引该中心的多名行业成员参与。该中心将招收研究生，并纳入研究生课程。还将开发和提供行业教程。

Understanding the risk and reliance on specific system security practices is critical in order to formulate a coherent strategy on safe cloud adoption. This work will investigate techniques for security risk evaluation for cloud computing with specific focus on the two areas of off-line risk management and on-line trust evaluation. The research will develop a project assessment model to capture relations between threats, tasks, assets and business logic; develop a vender assessment model to evaluate the venders share of security responsibility; and develop a cost benefit trade-off methodology for optimal cloud adoption strategy. Based on these, will develop an on-line assessment methodology for cloud service providers assessment based on different applications, services and vendor compositions. With the proliferation of cloud architectures, it is critical that their security be assessable and issues addressable. The proposed work has the potential to enable loud users to gauge the trust-worthiness of individual cloud elements or aggregated cloud resources and to analyze and suggest appropriate risk mitigation strategy. The work is supported by the Industry Advisory Board and will engage multiple industry members of the center. The center will involve graduate students and be integrated in graduate course offerings. Industry tutorials will also be developed and offered.