Skip to main content
SpringerLink
Log in

Supporting the Establishment of a Cloud-Specific ISMS According to ISO 27001 Using the Cloud System Analysis Pattern

  • Chapter
  • First Online:
Pattern and Security Requirements

  • 1430 Accesses

Abstract

Our context-patterns describe common elements, structures, and stakeholders for a specific domain such as cloud computing. In the previous chapters, we introduced our catalog of context-patterns, and our pattern language for context-patterns. The pattern language helps engineers to describe their own context-patterns and to understand the relations between our existing context-patterns. In this chapter, we show how to conduct a cloud-specific security analysis based on a specific context-pattern, namely our cloud system analysis pattern. Initially, we discuss the larger issue of governance, risk management, and compliance for cloud computing and argue why the ISO 27001 security standard certification is one possible choice to establish security management for clouds. Furthermore, we analyzed the entire ISO 27001 standard and show how each demanded activity can be conducted using our context-pattern and how information can be reused between different security analyses. As a result of our analysis, we created the PACTS methodology, which also dedicates individual activities concerning legal compliance and privacy management. Finally, we illustrate how all of the ISO 27001 documentation demands can be met by using our method.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
eBook
USD 16.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 109.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info
Hardcover Book
USD 109.99
Price excludes VAT (USA)
  • Durable hardcover edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    Sarbanes-Oxley Act: https://www.sec.gov/about/laws/soa2002.pdf.

  2. 2.

    Gartner BPM Maturity Model: https://www.gartner.com/doc/497289/bpm-maturity-model-identifies-phases.

  3. 3.

    The EDEN Maturity Model for BPM: http://www.bpm-maturitymodel.com/eden/opencms/en/What_is_eden/.

  4. 4.

    Safe Harbor: http://www.export.gov/safeharbor/.

  5. 5.

    https://www-304.ibm.com/isv/library/pdfs/cloud_idc.pdf.

  6. 6.

    http://blogs.msdn.com/b/windowsazure/archive/2011/12/19/windows-azure-achieves-is0-27001-certification-from-the-british-standards-institute.aspx.

  7. 7.

    http://www.windowsazure.com/en-us/support/trust-center/compliance/.

  8. 8.

    http://aws.amazon.com/security/.

  9. 9.

    http://googleenterprise.blogspot.com.br/2012/05/google-apps-receives-iso-27001.html.

  10. 10.

    http://www.computerweekly.com/news/2240150882/Google-Apps-for-Business-wins-ISO-27001-certification.

  11. 11.

    http://www.salesforce.com/platform/cloud-infrastructure/security.jsp.

  12. 12.

    https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Minimum_information/SecurityRecommendationsCloudComputingProviders.pdf.

  13. 13.

    http://www.iso27001security.com/html/iso27k_toolkit.html.

  14. 14.

    http://www.uml4pf.org/cloudtool/cloudSystemAnalysisTool.zip.

  15. 15.

    According to http://thesaurus.com/browse/Nefarious?s=t.

  16. 16.

    Cloud Security Alliance-Cloud Controls Matrix Version 3.0.1: https://cloudsecurityalliance.org/research/ccm/.

  17. 17.

    Reproduced by permission of the Cloud Security Alliance. Please contact the Cloud Security Alliance (Europe), 34 Melville Street, Edinburgh, EH3 7HA, United Kingdom for the definitive version of this document.

  18. 18.

    http://www.pwc.de/en/prozessoptimierung/trotz-einiger-bedenken-der-virtuellen-datenverarbeitung-gehoert-die-zukunft.jhtml.

  19. 19.

    http://www.uni-due.de/swe/apf12.shtml.

References

  • Álvarez, J. A. T., Olmos, A., & Piattini, M. (2002). Legal requirements reuse: A critical success factor for requirements quality and personal data protection. In Proceedings of the International Conference on Requirements Engineering (RE) (pp. 95–103). IEEE Computer Society.

    Google Scholar 

  • Armbrust, M., Fox, A., Griffith, R., Joseph, A. D., Katz, R. H., Konwinski, A., et al., (2009). Above the clouds: A Berkeley view of cloud computing. Technical report. San Francisco, U.S.: EECS Department, University of California, Berkeley.

    Google Scholar 

  • Auty, M., Creese, S., Goldsmith, M., & Hopkins, P. (2010). Inadequacies of current risk controls for the cloud. In Proceedings of the 2010 IEEE Second International Conference on Cloud Computing Technology and Science (pp. 659–666). IEEE Computer Society.

    Google Scholar 

  • Beckers, K. (2012). Comparing privacy requirements engineering approaches. In Proceedings of the International Conference on Availability, Reliability and Security (ARES)—6th International Workshop on Secure Software Engineering (SecSE 2012) (pp. 574–581). IEEE Computer Society.

    Google Scholar 

  • Beckers, K., & Jürjens, J. (2010). Security and compliance in clouds. In ISSE 2010 Securing Electronic Business Processes: Highlights of the Information Security Solutions Europe 2010 Conference (pp. 91–101). Vieweg + Teubner.

    Google Scholar 

  • Beckers, K., & Heisel, M. (2012). A foundation for requirements analysis of privacy preserving software. In Proceedings of the International Cross Domain Conference and Workshop (CD-ARES 2012)

    Google Scholar 

  • Beckers, K., Küster, J.-C., Faßbender, S., & Schmidt, H. (2011). Pattern-based support for context establishment and asset identification of the ISO 27000 in the field of cloud computing. In Proceedings of the International Conference on Availability, Reliability and Security (ARES) (pp. 327–333). IEEE Computer Society.

    Google Scholar 

  • Beckers, K., Faßbender, S., & Schmidt, H. (2012). An integrated method for pattern-based elicitation of legal requirements applied to a cloud computing example. In Proceedings of the International Conference on Availability, Reliability and Security (ARES)—2nd International Workshop on Resilience and It-Risk in Social Infrastructures(RISI 2012) (pp. 463–472). IEEE Computer Society.

    Google Scholar 

  • Beckers, K., Côté, I., Faßbender, S., Heisel, M., & Hofbauer, S. (2013a). A pattern-based method for establishing a cloud-specific information security management system. Requirements Engineering, 18(4), 1–53.

    Google Scholar 

  • Beckers, K., Hofbauer, S., Quirchmayr, G., & Wills, C. C. (2013b). A mapping between ITIL and ISO 27001 processes for use by a high availability video conference service provider. In Proceedings of the International Cross Domain Conference and Workshop (CD-ARES 2013) (pp. 224–239). Springer.

    Google Scholar 

  • Beckers, K., Faßbender, S., Heisel, M., & Meis, R. (2014). A problem-based approach for computer aided privacy threat identification. In Proceedings of the Annual Privacy Forum APF 2012 (pp. 1–16). Springer.

    Google Scholar 

  • Bench-Capon, T., Robinson, G., Routen, T., & Sergot, M. (1987). Logic programming for large scale applications in law: A formalization of supplementary benefit legislation. In International Conference on Artificial Intelligence & Law (ICAIL) (pp. 190–198). ACM.

    Google Scholar 

  • Biagioli, C., Mariani, P., & Tiscornia, D. (1987). ESPLEX: A rule and conceptual model for representing statutes. In Proceedings of the 1st International Conference on Artificial Intelligence and Law (ICAIL) (pp. 240–251). ACM.

    Google Scholar 

  • Breaux, T. D., & Antón, A. I. (2008). Analyzing regulatory rules for privacy and security requirements. IEEE Transactions on Software Engineering, 34(1), 5–20.

    Article  Google Scholar 

  • Breaux, T. D., Vail, M. W., & Antón, A. I. (2006). Towards regulatory compliance: Extracting rights and obligations to align requirements with regulations. In RE (pp. 46–55). IEEE Computer Society.

    Google Scholar 

  • Buyya, R., Ranjan, R., & Calheiros, R. N. (2009). Modeling and simulation of scalable cloud computing environments and the cloudSim toolkit: Challenges and opportunities. In Proceedings of the International Conference Von High Performance Computing and Simulation (HPCS). IEEE Computer Society.

    Google Scholar 

  • Calder, A. (2009). Implementing information security based on ISO 27001/ISO 27002: A management guide. Zaltbommel: Van Haren Publishing.

    Google Scholar 

  • Cheremushkin, D. V., & Lyubimov, A. V. (2010). An application of integral engineering technique to information security standards analysis and refinement. In Proceedings of the International Conference on Security of Information and Networks (pp. 12–18). ACM.

    Google Scholar 

  • Chow, R., Golle, P., Jakobsson, M., Shi, E., Staddon, J., Masuoka, R. et al., (2009). Controlling data in the cloud: Outsourcing computation without outsourcing control. In Cloud Computing Security Workshop (CCSW) (pp. 85–90). ACM.

    Google Scholar 

  • Clauß, S., Kesdogan, D., & Kölsch, T. (2005). Privacy enhancing identity management: protection against re-identification and profiling. In Proceedings of the 2005 Workshop on Digital Identity Management (pp. 84–93). ACM.

    Google Scholar 

  • Cloud Security Alliance (CSA). (2010). Top threats to cloud computing v1.0. https://cloudsecurityalliance.org/topthreats/csathreats.v1.0.pdf.

  • Deng, M., Wuyts, K., Scandariato, R., Preneel, B., & Joosen, W. (2011). A privacy threat analysis framework: supporting the elicitation and fulfillment of privacy requirements. Requirements Engineering, 16, 3–32.

    Article  Google Scholar 

  • Duisberg, A. (2011). Gelöste und ungelöste Rechtsfragen im IT-outsourcing und cloud computing. In Trust in IT (pp. 49–70). Springer.

    Google Scholar 

  • Fabian, B., Gürses, S., Heisel, M., Santen, T., & Schmidt, H. (2010). A comparison of security requirements engineering methods. Requirements Engineering—Special Issue on Security Requirements Engineering, 15(1), 7–40.

    Google Scholar 

  • Fay Chang, S. G., & Dean, J. (2006). Bigtable: A distributed storage system for structured data (Technical report). Google. Retrieved from http://labs.google.com/papers/bigtable-osdi06.pdf.

  • Fenz, S., Goluch, G., Ekelhart, A., Riedl, B., & Weippl, E. (2007). Information security fortification by ontological mapping of the ISO/IEC 27001 standard. In Proceedings of the International Symposium on Dependable Computing (pp. 381–388). IEEE Computer Society.

    Google Scholar 

  • Gartner. (2008). Assessing the security risks of cloud computing. (http://www.gartner.com/id=685308).

  • Greenwood, D., & Sommerville, I. (2011). Responsibility modeling for identifying sociotechnical threats to the dependability of coalitions of systems. In 2011 6th International Conference on System of Systems Engineering (SOSE), (pp. 173–178).

    Google Scholar 

  • Grobauer, B., Walloschek, T., & Stocker, E. (2011). Understanding cloud computing vulnerabilities. Security Privacy, IEEE, 9(2), 50–57.

    Article  Google Scholar 

  • Gsell, H., Weißenberg, N., Beckers, K., & Hirsch, M. (2010). Process intelligence in der finanzwirtschaft. In Software as a Service, Cloud Computing und Mobile Technologien (pp. 63–75). GITO Verlag.

    Google Scholar 

  • Hafiz, M. (2006). A collection of privacy design patterns. In Proceedings of the 2006 Conference on Pattern Languages of Programs (pp. 1–13). ACM.

    Google Scholar 

  • HM Government. (2012). IT Infrastructure Library (ITIL). (http://www.itil-officialsite.com/home/home.aspx).

  • Hofbauer, S., Beckers, K., & Quirchmayr, G. (2012a). Conducting a privacy impact analysis for the analysis of communication records. In Proceedings of the International Conferences on Perspectives in Business Informatics Research (BIR 2012) (pp. 148–161). Springer.

    Google Scholar 

  • Hofbauer, S., Beckers, K., & Quirchmayr, G. (2012b). A privacy preserving approach to call detail records analysis in VoIP systems. In Proceedings of the International Conference on Availability, Reliability and Security (ARES)—7th International Workshop on Frontiers in Availability, Reliabilityand Security (FARES 2012) (pp. 307–316). IEEE Computer Society.

    Google Scholar 

  • Hofbauer, S., Beckers, K., Quirchmayr, G., & Sorge, C. (2012c). A lightweight privacy preserving approach for analysing communication records to prevent VoIP attacks using toll fraud as an example. In Proceedings of the Second International Symposium on Anonymity and Communication Systems (ACS-2012) (pp. 992–997). IEEE Computer Society.

    Google Scholar 

  • Hohfeld, W. N. (1917). Fundamental legal conceptions as applied in judicial reasoning. The Yale Law Journal, 26(8), 710–770.

    Article  Google Scholar 

  • Hüning, N., Gsell, H., Weißenberg, N., Hirsch, M., & Beckers, K. (2010). Process compliance und process intelligence in der finanzwirtschaft. ERP Management, 2, 39–42.

    Google Scholar 

  • IETF. (1997). Hmac: Keyed-hashing for message authentication (IETF RFC 2104). Fremont, U.S.: Internet Engineering Task Force (IETF). Retrieved from http://tools.ietf.org/rfc/rfc2104.txt

  • I. G. (2007). Cobit 4.1. IT Governance Institute (I. G.) ISA.

    Google Scholar 

  • ISO. (2008). Quality management systems—Requirements (ISO/IEC 9001). Geneva, Switzerland: International Organization for Standardization (ISO).

    Google Scholar 

  • ISO/IEC. (2005a). Information technology—Security techniques—Code of practice for information security management (ISO/IEC 27002). Geneva, Switzerland: International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC).

    Google Scholar 

  • ISO/IEC. (2005b). Information technology—Security techniques—Information security management systems—Requirements (ISO/IEC 27001). Geneva, Switzerland: International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC).

    Google Scholar 

  • ISO/IEC. (2008). Information technology—security techniques—information security risk management (ISO/IEC 27005). Geneva, Switzerland: International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC).

    Google Scholar 

  • ISO/IEC. (2009). Information technology—Security techniques—Information security management systems—Overview and Vocabulary (ISO/IEC 27000). Geneva, Switzerland: International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC).

    Google Scholar 

  • ISO/IEC. (2012). Common Criteria for Information Technology Security Evaluation (ISO/IEC 15408). Geneva, Switzerland: International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC).

    Google Scholar 

  • ISO/IEC. (2013). Information technology—Security techniques—Information security management systems—Requirements (ISO/IEC 27001). Geneva, Switzerland: International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC).

    Google Scholar 

  • Jackson, M. (2001). Problem frames. Analyzing and structuring software development problems. Boston: Addison-Wesley.

    Google Scholar 

  • Jansen, W. A. (2011). Cloud hooks: Security and privacy issues in cloud computing. In Hawaii International Conference on System Sciences (HICSS) (pp. 1–10). IEEE Computer Society.

    Google Scholar 

  • Kalloniatis, C., Kavakli, E., & Gritzalis, S. (2008). Addressing privacy requirements in system design: The PriS method. Requirements Engineering, 13, 241–255.

    Article  Google Scholar 

  • Kersten, H., Reuter, J., & Schröder, K.-W. (2011). IT-Sicherheitsmanagement nach ISO 27001 und Grundschutz. Vieweg+Teubner.

    Google Scholar 

  • Klipper, S. (2010). Information Security Risk Management mit ISO/IEC 27005: Risikomanagement mit ISO/IEC 27001, 27005 und 31010. Vieweg+Teubner.

    Google Scholar 

  • Lyubimov, A., Cheremushkin, D., Andreeva, N., & Shustikov, S. (2011). Information security integral engineering technique and its application in isms design. In Proceedings of the International Conference on Availability, Reliability and Security (ARES) (pp. 585–590). IEEE Computer Society.

    Google Scholar 

  • Mell, P., & Grance, T. (2009). The NIST definition of cloud computing. Working Paper of the National Institute of Standards and Technology (NIST).

    Google Scholar 

  • Moeller, R. (2007). Coso enterprise risk management: Understanding the new integrated ERM framework. New York: Wiley.

    Google Scholar 

  • Montesino, R., & Fenz, S. (2011). Information security automation: how far can we go? In Proceedings of the International Conference on Availability, Reliability and Security (ARES) (pp. 280–285). IEEE Computer Society.

    Google Scholar 

  • Moyano, F., Beckers, K., & Fernandez-Gago, C. (2014). Trust-aware decision-making methodology for cloud sourcing. In Proceedings of the 26th International Conference on Advanced Information Systems Engineering (CAiSE). (pp. 136–149). Springer.

    Google Scholar 

  • OECD. (1980). OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (Technical report). Paris, France Organisation for Economic Co-operation and Development (OECD). Retrieved from http://www.oecd.org/document/18/0,3746,en_2649_34255_1815186_1_1_1_1,00&&en-USS_01DBC.html.

  • Opdahl, A. L., & Sindre, G. (2009). Experimental comparison of attack trees and misuse cases for security threat identification. Information and Software Technology, 51, 916–932.

    Article  Google Scholar 

  • Open Group. (2009). The open group’s risk taxonomy. Technical report. Berkshire, United Kingdom: Author. (http://pubs.opengroup.org/onlinepubs/9699919899/toc.pdf).

  • Scarfone, K. A., Souppaya, M. P., & Hoffman, P. (2011). Sp 800-125. Guide to security for full virtualization technologies. Technical report. Gaithersburg, MD, United States NIST.

    Google Scholar 

  • Shaikh, F., & Haider, S. (2011). Security threats in cloud computing. In 2011 International Conference for Internet Technology and Secured Transactions (ICITST), (pp. 214–219).

    Google Scholar 

  • Siena, A., Perini, A., & Susi, A. (2008). From laws to requirements. In RELAW (pp. 6–10). IEEE Computer Society.

    Google Scholar 

  • Siena, A., Perini, A., Susi, A., & Mylopoulos, J. (2009). A meta-model for modelling law-compliant requirements. In Proceedings of the International Workshop on Requirements Engineering and Law (RELAW) (pp. 45–51). IEEE Computer Society.

    Google Scholar 

  • Streitberger, W., & Ruppel, A. (2009). Cloud-Computing Sicherheit—Schutzziele. Taxonomie. Marktübersicht, Fraunhofer Institute for Secure Information Technology (SIT). Technical report. Darmstadt, Germany: Fraunhofer Institute for Secure Information Technology (SIT).

    Google Scholar 

  • Summerville, I. (2007). Software engineering (8th ed.). Boston: Addison-Wesley.

    Google Scholar 

  • UML Revision Task Force. (2010). OMG unified modeling language: Superstructure.

    Google Scholar 

  • Vaquero, L. M., Rodero-Merino, L., Caceres, J., & Lindner, M. (2008). A break in the clouds: Towards a cloud definition. Special interest group on data communication (SIGCOMM). Computer Communication Review, 39(1), 50–55.

    Article  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. paluno-The Ruhr Institute for Software Technology, University of Duisburg-Essen, Duisburg, Germany

    Kristian Beckers

Authors
  1. Kristian Beckers
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Kristian Beckers .

Rights and permissions

Reprints and permissions

Copyright information

© 2015 Springer International Publishing Switzerland

About this chapter

Cite this chapter

Beckers, K. (2015). Supporting the Establishment of a Cloud-Specific ISMS According to ISO 27001 Using the Cloud System Analysis Pattern. In: Pattern and Security Requirements. Springer, Cham. https://doi.org/10.1007/978-3-319-16664-3_12

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-16664-3_12

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-16663-6

  • Online ISBN: 978-3-319-16664-3

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation