Exploring cloud User Role in the context of information security and sematic traceability

Cloud services are becoming an essential part of many organizations.Cloud providers have to adhere to security and privacy policies to ensure their users' data remains confidential and secure.Though there are some ongoing efforts on developing cloud security standards, most cloud providers are implementing a mish-mash of security and privacy controls.This has led to confusion among cloud consumers as to what security measures they should expect from the cloud services, and whether these measures would comply with their security and compliance requirements.We have conducted a comprehensive study to review the potential threats faced by cloud consumers and have determined the compliance models and security controls that should be in place to manage the risk.Based on this study, we have developed an ontology describing the cloud security controls, threats and compliances.In order to design, build, and provide cloud based solutions that best meet customers' needs, it is essential to understand the skills, goals, primary tasks, and responsibilities of the people or organizations involved throughout the cloud service lifecycle.To minimize this risk, cloud applications need to be engineered to adapt their security policies to maintain satisfaction of security requirements despite changes in their usage context.We call such adaptation capability Adaptive Information Security.The paper argues that one of the prerequisites to adaptive information security is the use of traceability as a means to understanding the relationship between security requirements and security policies.Using an example, we motivate the need for improving traceability in the development of cloud applications.