Abstract

The study proposes a cloud security framework for Cloud Service Providers (CSPs) in Ghana. It adopted a number of strategies, such as experimental research achieved through integrated simulation and mixed mode research method approach, using SPSS for data analysis to execute the study expectations of proposing a new cloud security framework. It also carried out an investigation into cloud security deployment technologies, and then undertook a comparative study of these technologies. In addition, it also investigated whether or not CSPs in Ghana follow any cloud security policy guidelines to deliver cloud services in Ghana. An experimental research approach adopted an Open AM server for the purpose of achieving integrity and secure authorization in the proposed framework which employed XACML Version 3.0 to define and enforce policies. Tools such as, Cygwin, curl/libcurl, Scala and IntelliJ IDEA IDE were used together to enhance simulation in the study. The results from analysis revealed that, HSM, OTFE and other cloud based security systems are the major security technologies deployed by service providers for integrity and authorization. Two curl HTTP/ 1.1 GET request were made at the service application endpoint where the access controller is wrapped over. Based on the rule set, two basic users were allowed and disallowed when accessing a cloud resource. A basic resource of an application with HTTP gave a status and a security token. To maintain the integrity of cloud data, the study recommends a root hardware TPM Chip be adopted to ensure maximum application security and systems performance. The proposed security framework assures cloud data integrity and also ensures authorization. The study therefore also recommends XACML V 3.0 to be adopted as a language for cloud systems for policy definition and enforcement.

References

• Bisong, A., Rahman, M.S., 2011. An Overview of the Security Concerns in Enterprise Cloud Computing. International Journal of Network Security & Its Applications (IJNSA), Vol.3, No.1, January 2011. DOI: 10.5121/ijnsa.2011.3103 30 from: http://airccse.org/journal/nsa/0111jnsa03.pdf ON 13th February,2015.
• Lewis, G.A., 2012. The Role of Standards in Cloud- Computing Interoperability. (October).
• Rajaraman, V., 2014. Cloud Computing. , (March), pp.242–258.
• Ramachandran, M., 2012. Service Component Architecture for building enterprise cloud services. Service technology magazine. Retrieved from http://www.servicetechmag.com/I65/0812-4 on 14th July, 2016.
• Mell, P. and Grance, T. 2011. The NIST definition of Cloud computing. Gaithersburg, MD: Computer Security Division, Information Technology Laboratory, National Institute of Standards and Technology.
• Mogull, R. u.d. Best Practices for Endpoint Data Loss Prevention, Securosis, L.L.C.D. Sponsored by Symantec Inc.
• Department of Homeland Security, 2004, A Comparison of Cyber Security Standards Developed by the Oil and Gas Segment. (November 5, 2004).
• Price Water Cooperhouse, 2014.Why you should adopt the NIST Cyber security Framework. www.pwc.com/cybersecurity. May 2014
• Weiss, A., 2013. Cloud Security Standards: What You Should Know Retrieved from eSecurity Planet http://www.esecurityplanet.com/network-security/cloud-security-standards-what-you-should-know.html on 16th March, 2016.
• Brewer, D., 2013. Moving from ISO/IEC 27001:2005 to ISO/IEC 27001:2013 The new international standard for information security management systems. BSI Group Information Security Management - Transition guide
• PCI Security Standards Council, 2013. Payment Card Industry (PCI) Data Security Standard. Summary of Changes from PCI DSS Version 2.0 to 3.0 Data Security Standard © 2006-2013, LLC. All Rights Reserved. Updated on November, 2013
• Indian Association of Extracorporeal Technology, IsecT, 2016
• Zeltser, L, 2016. Limitations of Frameworks in Information Security. Retrieved from htt1ps://zeltser.com/limitations-of-frameworks-in-infosec/ On 30 March, 2016.
• Davis, F. D., Bagozzi, R. P., and Warshaw, P. R., 1989. User acceptance of computer technology: A comparison of two theoretical model. Management Science, 35(8), 982-1003
• International Telecommunication Union, ITU, 2012. Cloud computing in Africa. Situation and perspective. Technology Development Centre. Regulatory & market environment
• National Institute of Standards for Technology, 2011.Cloud Computing Standards Roadmap, NIST CCSRWG– 070, Eleventh Working Draft, May 2, 2011 NIST Reference Architecture http://www.nist.gov/itl/cloud/refarch.cfm
• Naruchitparames, J. and Güneş, M.H., 2011, July. Enhancing data privacy and integrity in the cloud. In High Performance Computing and Simulation (HPCS), 2011 International Conference on (pp. 427-434). IEEE.
• McLellan, C. 2015. Cyber security in 2015: What to expect. Retrieved from
• http://www.zdnet.com/article/cybersecurity-in-2015-what-to-expect/ on 14th July, 2016.