Risk-driven compliant access controls for clouds

Rahmouni, Hanene Boussi; Munir, Kamran; Odeh, Mohammed; McClatchey, Richard

Abstract

There is widespread agreement that cloud computing have proven cost cutting and agility benefits. However, security and regulatory compliance issues are continuing to challenge the wide acceptance of such technology both from social and commercial stakeholders. An important facture behind this is the fact that clouds and in particular public clouds are usually deployed and used within
broad geographical or even international domains. This implies that the exchange of private and other protected data within the cloud environment would be governed by multiple jurisdictions. These jurisdictions have a great degree of harmonisation; however, they present possible conflicts that are hard to negotiate at run time. So far, important efforts were played in order to deal with regulatory compliance management for large distributed systems. However, measurable solutions are required for the context of cloud. In this position paper, we are suggesting an approach that starts with a conceptual model of
explicit regulatory requirements for exchanging private data on a multijurisdictional environment and build on it in order to define metrics for non-compliance or, in other terms, risks to compliance. These metrics will be integrated within usual data access-control policies and will be checked at policy analysis time before a decision to allow/deny the data access is made.

• Presentation Conference Type: Conference Paper (unpublished)
• Conference Name: Proceedings of the International Arab Conference on Information Technology (ACIT 2011)
• Start Date: Dec 11, 2011
• End Date: Dec 14, 2011
• Publication Date: Dec 11, 2011
• Journal: arXiv
• Peer Reviewed: Peer Reviewed
• Keywords: cloud, privacy, data access, semantic web, requirements engineering
• Public URL: https://uwe-repository.worktribe.com/output/956950
• Publisher URL: http://www.acit2k.org/ACIT/index.php?option=com_content&task=view&id=295&Itemid=476
• Related Public URLs: http://arxiv.org/abs/1202.5482v2
• Additional Information: Additional Information : Imported from arXiv; Title of Conference or Conference Proceedings : Proceedings of the International Arab Conference on Information Technology, ACIT 2011