![](bg4.png)
computing are similar to those raised by the Internet
as a whole. Consumers of cloud computing, like
general Internet consumers, must trust that cloud
service providers will not default on implied or
explicit bonds, that the service quality is good and
will be delivered as promised, and that their personal
information will be securely held and their privacy
respected (Aiken and Boush, 2006).
Trustmarks are any third-party mark, logo,
picture, or symbol that is presented in an effort to
dispel consumers’ concerns about risk and therefore
increase firm-specific trust levels (Aiken and Boush,
2003). Trustmark services typically involve one or
more of six elements: (i) a declaration of best
practice, (ii) a subscription to a code of conduct, (iii)
scrutiny for membership (based on criteria), (iv)
sanctions for failure to adhere to a code of conduct,
(v) recourse (appeals) for wrongful revocation of the
trustmark and (vi) a remedy for aggrieved customers
(Endeshaw, 2001). Policymakers, academia and
industry have called for research on trustmarks in
the cloud computing context (IAMCP, 2011; GAP
Task Force, 2011; Robinson et al., 2010). Research
suggests that trustmarks have the greatest effect on
perceived trustworthiness in an Internet context
(when compared to objective source third-party
ratings and advertising-derived implications),
influencing respondents’ beliefs about security and
privacy, general beliefs about firm trustworthiness,
and willingness to provide personal information
(Aiken and Boush, 2006). Recipients of trustmarks
are typically subject to a manual verification and
certification process that varies widely within the
trustmark provision sector and is not transparent to
cloud customers and consumers. Trustmarks have
been criticised for consistency, reliability, currency /
timeliness, accuracy, transparency and ease of abuse
(Schouten, 2012; Endeshaw, 2001; Remotti, 2012).
Trustmarks are widely used in e-commerce
(Remotti, 2012). We posit that existing static passive
conceptualisations of trustmarks will not
satisfactorily address the trust and confidence issues
in cloud computing due to the inherently dynamic
nature of these services. As such, we propose an
active dynamic trustmark system for cloud
computing that overcomes the shortfalls of
accountability, assurance and trustmarks as discrete
solutions for trustworthiness issues in cloud
computing.
2.1 Active Dynamic Trustmarks
As noted above, trustmarks are typically presented
as a static visual representation, typically a badge-
like logo, on websites or promotional material.
However, trustmarks need not be static; by utilising
modern web technologies, such as HTML 5,
trustmarks could be presented as active dynamic
entities that succinctly communicate up-to-date
values for a number of high-level dependability
measures. These dependability measures would be
based on “live” analytics of aspects of the
underlying service. Static badge-like images could
be replaced by multi-modal entities that
communicate information (i) graphically using
lightweight, standard-compliant technologies such as
HTML 5 canvas (ii) textually and (iii) in a machine
readable format via semantic web technologies such
as OWL. Furthermore, the authenticity of these
trustmarks can be verified by a certification
mechanism. Unlike the opaque assurance-backed
certification approach that has been traditionally
applied to trustmarks, active dynamic trustmarks
would provide prospective and existing cloud
customers with a window into the operation of the
underlying cloud service by providing a mechanism
that would allow users to “drill down” into specific
high-level metrics, at that moment or over a period
of time, that comprise the trustmark. As a result,
stakeholders can satisfy themselves that the service
is both trustworthy and dependable and the level of
trustworthiness is signalled to the market as a whole.
The design of the trustmark interface would need
to balance the need to inform stakeholders with
varying roles against privacy and security concerns.
Discrete independent virtualised services could be
provided for internal and external auditors and
regulators to analyse service performance against
business policy, legal or regulatory compliance
requirements.
3 ASSURANCE-AS-A-SERVICE
To deliver the real-time metrics communicated by
the active dynamic trustmarks, as proposed in
Section 2.1, necessitates the collection, collation and
computation of data relating to the operation of the
service. These metrics must be re-evaluated on an
ongoing basis with the resulting data being
communicated to the trustmark metadata platform
before being surfaced via multi-modal trustmark
updates. This task could be delivered by the cloud
service provider or offloaded to an independent
third-party assurance service, which could itself be a
cloud service. In its primary capacity, the assurance
service would watch the operation of other cloud
services and surface data to the trustmark interface.
TheCaseforCloudServiceTrustmarksandAssurance-as-a-Service
113