![](bg4.png)
interacts with the insurance provider as well, in
order to define the liability contract (agreement)
between the provided ILA to the consumers, and its
coverage by the insurance provider (10).
3.2 Prototypical Usage Pattern
A typical example for a scenario of the system and
method is as follows:
When a consumer of an IT services (9),
approaches a Provider (11) (either for
IaaS/PaaS/SaaS), it is offered with modified service
that includes insurance element. The insurance
includes liability in case of data security issue,
breach of a service level agreement or lack of
operational services. This offering can be part of the
basic service (without any negotiation and
amendment), or the consumers can select different
Insurance Level Agreements (ILA) from the
provider (11). The ILAs are predefined and
determined by the service provider (11) negotiating
a liability service from the insurance provider (10),
and either offers readymade ILAs to its consumers
(9), or builds a new definition (design) for an ILA,
using the ILA configuration management component
(8). The defined ILA are monitored and managed by
CA Technologies’ tools (2) according to the type of
services needed. For example, when the ILA
provider sets security enforcement, CA
Technologies’ tools (2) will monitor Identity Access
Management and provide Privileged Access
Management to server administrators. If roaming
limitations insurance is needed, CA Technologies’
tools (2) will enforce network zone protection, and
physical roaming policies, enabling supervised
automatic provisioning by the provider datacenter.
Setting an ILA does not preclude the service
provider from protecting its private or public cloud,
rather that evidence or remedy of these activities
will not necessarily be provided
However, when such ILA do apply, CA
Technologies’ tools (2) will monitor and control, as
well as provide dedicated logging options for further
analysis by the reporting tools (6). Nevertheless,
ILA setting might be also partially configured,
enabling CA Technologies’ tools (2) to monitor just
part of the data, thus reducing data monitoring
capacity and aggregated reports.
Since the ILA is defined between the consumers
and providers, periodic monitoring and report
generation is conducted. These reports are delivered
either as a service, on-demand, periodically, or even
off-line. The recipients of these reports can be the
service providers, the consumers, and the insurance
provider, according to business arrangements.
4 CONCLUSIONS
In this position paper, we presented a novel
approach for providing certified cloud services, by
means of insurance provider, technology, and a new
business model for cloud services. Auditing and
reporting tools, when connected to IT management
tools, enables a centralized “evidence vault” for
future use. These reports and logs may be used for
insurance claims, certification and/or compliance
needs. We suggest that combining IT monitoring
and security tools with a reporting layer, alongside
risk mitigation and remedy from an insurance
provider, will increase trust and transparency, while
maintaining cloud computing abstraction concepts.
We argue in this position paper that certified
services with financial backup will provide a more
appealing approach for commerce relationship, and
will generate a significant market opportunity for
insurance providers, as well as for IT management
technology.
REFERENCES
Blakley B., “2012 Planning Guide: Identity and Privacy”,
G00217746 Burton IT1 Research, 1 November 2011
Blum D., Schacter P., Maiwald E., Krikken R., Henry T.,
Boer M., Chuvakin A., “2012 Planning Guide:
Security and Risk Management”, G00224667, Burton
IT1 Research, 1 November 2011
Brandic, I.; Dustdar, S.; Anstett, T.; Schumm, D.;
Leymann, F.; Konrad, R.; “Compliant Cloud
Computing (C3): Architecture and Language Support
for User-Driven Compliance Management in Clouds”,
2010 IEEE 3rd International Conference on Cloud
Computing (CLOUD), Miami, FL, USA, 5-10 July
2010
Glazer I., "Identity and Access Governance." Gartner. 21
Jul 2010.
Habib, S. M.; Ries, S.; Muhlhauser, M.; “Cloud
Computing Landscape and Research Challenges
Regarding Trust and Reputation”, Ubiquitous
Intelligence & Computing and 7th International
Conference on Autonomic & Trusted Computing
(UIC/ATC), Xian, Shaanxi, 26-29 Oct. 2010
Heiser H, Nicolett M, “Assessing the Security Risks of
Cloud Computing”, Gartner Research Report
G00157782, 3 June 2008
Ko, R. K. L.; Jagadpramana, P.; Mowbray, M.; Pearson,
S.; Kirchberg, M.; Qianhui Liang; Bu Sung Lee;
“TrustCloud: A Framework for Accountability and
CLOSER2012-2ndInternationalConferenceonCloudComputingandServicesScience
214