![](bg3.png)
be evaluated against security metrics previously
obtained from tests performed on predefined models.
The specifics of the tests will not be covered,
however, some guidelines should be followed to
assure that Cloud specific issues are addressed, such
as what to what to test, the approach, and how to
evaluate the results.
OWASP (2012) has started a new chapter
denominated “Cloud-10 Project” to approach Cloud
security risks. OWASP top ten lists are important
because it helps the enterprises to focus on the most
serious threats to web applications, and the Cloud-10
projects is a work in project (Pre-Alpha) to address
this new paradigm in enterprise computing. OWASP
top ten lists are maintained by a community of users
and experts in every domain, and are ranked by
criteria such as (OWASP, 2012):
Easily Executable
Most Damaging
Incidence Frequency (Known)
The OWASP Cloud-10 project defines the criteria
that can guide the security tests, but an appropriate
testing methodology is required. The Open Source
Security Testing Methodology or OSSTMM has its
focus on operational effectiveness, that is, how it
works (Herzog, 2011). OSSTMM3 is an evolution
from a penetration testing methodology which
evolved to more than a best practices framework by
2005 (Herzog, 2010) and finally into a more
contemporary security assessment methodology that
prioritizes tests (avoiding guesses), concentrates on
the interactions and its required protections, and
balance between security and operations (Herzog,
2011).
OSSTMM has redirected its focus in the earlier
releases from testing physical resources such as
firewalls and routers to verifying operational
security and its related channels, such as Human,
Physical, Wireless, Telecommunications, and Data
Networks (Herzog, 2010) in the latest versions of the
methodology. OSSTMM also introduces its own
measurement metrics called ravs, which provides
graphical representation of system’s states and
system state changes over time, and are suitable to
be used in operational monitoring consoles.
The Cloud Security Alliance (CSA) is a non-
profit organization engaged in providing security
awareness and tools to adopters. CSA has a specific
publication providing guidance to Cloud security,
“Security Guidance for Critical Areas of Focus in
Cloud Computing” (CSA, 2009), which is structured
around thirteen domains covering several aspects of
Cloud security, including Identity and Access
Management. CSA has also started the “Consensus
Assessments Initiative” to provide means of
documenting existing controls for Cloud services,
This initiative is based on a questionnaire available
at CSA web site, which can be downloaded, have the
questions answered and then submitted to the
repository of respondents where it can be consulted
by customers.
Guidance is also provided by the US
Government, and targeted to U.S. Federal Agencies
but publicly available. The “Proposed Security
Assessment and Authorization for U.S. Government
Cloud Computing” has a strong focus on
authorization, defines a baseline of security controls
and a monitoring process, and also proposes a
framework to assess cloud security during vetting of
Cloud Service Providers (U.S CIO, 2010).
4 BACKGROUND CONCEPTS
The Figure 3 presents our base line model.
Everything inside the enterprise can be seen as a
controlled environment, while everything in the
outside is beyond its control (Grobauer et al, 2011)
(Hiroyuki et al, 2011), and therefore, must not be
trusted. That is not to say that an intranet is a safe
place to run business without protection, which it is
not. According to the “2011 Cyber Security Watch
Survey - How Bad Is the Insider Threat?” (CERT
2011) carried out by the Carnegie Mellon University
over a population of 607 companies, 27% of all
security incidents were caused by insiders in 2010,
at the same time that 46% of all respondents affirm
that the internal incidents had caused more damage
than the outside attacks.
In the Figure 4 we have extended some services
from the internal enterprise network to a Public
Cloud, while in Figure 5 it was extended further to
provide employee’s access to the organization’s
resources in the Cloud.
Almost any enterprise application can be
configured to work in a Public Cloud. However, two
important factors must be considered:
The Cloud is not under the Enterprise’s control -
therefore, it can be considered an uncontrolled
environment (Hiroyuki et al, 2011).
To work with the applications in the Public
Cloud, it is necessary to cross a potential
insecure channel: the Internet.
EnterprisetoCloudSecurityAssessment-AMethodusingOSSTMM3.0Concepts
573