Cloud Computing Security Challenges

The assignment delves into the critical security concerns inherent in cloud computing environments. It analyzes various threats, vulnerabilities, and attack vectors that cloud platforms face, such as data breaches, unauthorized access, and malicious code injection. Furthermore, it examines a range of security measures and strategies employed to mitigate these risks, including encryption, access control, intrusion detection systems, and secure coding practices. The assignment highlights the importance of implementing robust security protocols to ensure the confidentiality, integrity, and availability of data stored and processed in the cloud.

Running head: IT RISK ASSESSMENT CASE STUDY
IT Risk Assessment Case Study
(Aztek Australian Finance Industry)
Name of the Student
Name of the University
Author Note

1
IT RISK ASSESSMENT CASE STUDY
Table of Contents
Executive Summary.........................................................................................................................2
Industry Regulation or Compliance.................................................................................................4
Security Posture...............................................................................................................................5
Operational Categories................................................................................................................7
Threats, Vulnerabilities and Consequences Assessment.................................................................9
Risk Severity Matrix..................................................................................................................13
Data Security Issues.......................................................................................................................13
Solution of the Issues Related to the Data Security...................................................................15
Conclusion.....................................................................................................................................17
References:....................................................................................................................................18
Appendix:......................................................................................................................................22

2
IT RISK ASSESSMENT CASE STUDY
Executive Summary
In this new world of technology cloud computing is playing very important role in
transforming this world into digital world. Technologies like Big Data and Cloud computing are
enhancing the performance of the organization through improving the operational activities in
better and efficient manner. The aim of this report is to assist Aztek on the threats and risks that
could be raised due to the implementation of Cloud Computing within the organization. Aztek is
a financial industry and most of the finance industries are adopting cloud computing for the
betterment of the organization but yet many of the industries are lacking in adopting it. However,
this could change the face of file transfer and management system in much cost effective manner
and help the Aztek to improve the quality of services in very few time and investment.
Cloud computing can be stated as “pay-per-use model for enabling available, convenient,
on-demand network access to a shared pool of configurable computing resources (e.g.., network,
servers, storage, applications, and services) that can be rapidly provisioned and released with
minimal management effort or service provider interaction (Erl, Cope & Naserpour, 2015). This
cloud model promotes availability and is comprised of five key characteristics, three delivery
models and four deployment models” (Bansal & Sharma, 2015). It has the flexibility that
provides feature of scaling up or down accessed through pooled computing resources through
using the multi-tenant model that can be metered and billed as per the usage of the organization.
There are mainly three delivery models for the cloud computing that can be listed as:
Information as a service (IaaS), Platform as a service (PaaS), and Software as a service (SaaS).
The vendors for the respective service providers are Google Docs and salesforce.com for SaaS,
Microsoft Azure and Google App Engine for PaaS, and Amazon EC2, Rackspace, and NYSE

3
IT RISK ASSESSMENT CASE STUDY
Euronext CMCP for the IaaS (Sreeramaneni, Seo & Chan, 2017). These cloud service can be
delivered through three models that can be described as: Public cloud: This is a cloud service
that is being offered and available for everyone over the internet. Private Cloud: This is service
is available for the trusted users of the industries. This is either managed by the cloud provider or
organization itself. Community Cloud: It is accessible to the members or individuals of a wider
community that is composition of more than one industry or firm. Hybrid Cloud: It can be
described as the mix of private and public cloud and mitigates the challenges that occur in the
individual deployments. Aztex should deploy Hybrid model in manner to keep data and
information secured and protected (Rani & Ranjan, 2014). This will let the organization avail all
the services and minimize the risks related to the data security.
The following report emphasis on the regulation and compliance of the agreements and
services offered by the cloud service provider along with the existing policies of the
organization. This report also states various Australian laws or policies that could be
implemented or considered while implementing Cloud Computing within the organization. All
perspective should be clear between the service provider and the service consumer related to the
information security to the information that is being transferred to the cloud. Security posture has
been also explained in this report in relation with the IT infrastructure of the Aztek. For the
management of information security six P’s concept has also been proposed in this report. This
report presents a risk assessment for the threats, vulnerabilities and issues raised due to this
innovative change in the organization. Aztek should consider following risk assessment before
and after implementing cloud computing within the organization.

4
IT RISK ASSESSMENT CASE STUDY
Industry Regulation or Compliance
Cloud Computing or hosting cloud applications for the operational activities within the
finance industries can be described as a new delivery and sourcing model that is capable of
sharing many legal issues. That give birth many legal challenges for the implementation of this
technology in the existing system of the firm or the organization that can be listed as: first and
the top most prior challenge is the legal compliance issues between the services and protection
provided by the third party, is compatible with the existing policies of the organization or not.
Second is the Service Legal Agreements or service level performance that should be again
aligning with the existing policies of the firm (Gangwar & Date, 2016). Cross-border issues
raises when the cloud service provider’s main database system or IT infrastructure is situated in
other country and the consumer is availing those services from outside the country. Data
protection usage and rights that is one of the most important aspects for any sector of the
organization including the financial industries that are availing cloud computing services for
their firm or the organization (Srinivasan, 2014). Transition and transition that is often very hard
once the organization is connected to the service provider, it becomes much complex to leave
them and move to another service provider including the rise in budget.
For Australian finance industries there are specific laws that could be related to the
cyberspace and cloud computing that can be listed as:
 Copyright Amendment (Digital Agenda) Act 2000 (Cth) - intellectual property
 Archives Act, FOI Act
 Spam Act 2003
 Privacy Act 1988 & Privacy Amendment (Private Sector) Act 2000 (Cth)
 Electronic Transactions Acts (Selvadurai, 2013)

5
IT RISK ASSESSMENT CASE STUDY
 Telecommunications (Interception) Act 1979 (Cth)
 Cybercrime Act 2001 (Cth)
The policy should be based on considering the impact and consequences on the stakeholders.
Internal stake holders such as manager of the Aztec, their staffs, and boards or heads should go
thoroughly to the agreement made between the service provider and the government policies
(Almosry, Grundy & Muller, 2016). However, this will alternatively affect the external
stakeholders, which are government agencies, financiers, suppliers and many others.
Security Posture
Implementing cloud computing into the existing system and using cloud hosted
application could lead to issues to the security of the information and data that is being
transferred on the cloud. Information related to operational activities and sensitive information
related o the employee and transactions of the organization will mitigate on the cloud. Data
breaches and other malicious attack could hamper these data and information and priority should
be given on mitigating such issues (Rittinghouse & Ransome, 2016). However these security
issues could managed by application of the principles of information security management that
could be explained as six P’s:
Planning: It can be stated as the first and most important approach towards Information
Security Management. This step includes modelling of the strategies that could be implemented
in manner to support the information strategy that involves designing, creating and implementing
of the strategies respectively. There are various types of information security planning that
includes: Business continuity planning, Incident response planning, Policy planning, Security

6
IT RISK ASSESSMENT CASE STUDY
program planning, Disaster recovery planning Technology rollout planning, Personnel planning,
and Risk management planning (Chandra, Challa & Hussain, 2014).
Policy: There should be certain set of guidelines for the Aztec that dedicates the
behaviour within the organization after the migration of data to the cloud and hosting cloud
applications. Recommended policies for the cloud computing adoption for Aztek can be put into
three categories that are; firstly, ISSP (Issue-Specific Security Policy), secondly, EISP
(Enterprise Information Security Policy), SysSPs (System-Specific Policies). Implementation of
these policies before or after adopting cloud computing will help in enhancing the information
security (Rivery et al., 2015).
Programs: The operations involved in the information security management should be
executed as a part of the culture of the organization and should be managed separately. Programs
such as SETA (Security Education Training and Awareness) should be enrolled in the list of the
primary activities within then management system including the physical security programs. This
will help in protecting personal credentials and devices that could be connected to the network of
the cloud (Aikat et al., 2017).
Protection: This could be a vast chapter in the implementation of cloud computing within
the existing system of Aztek as it includes risk assessment of the identified threats and issues,
tools to minimize the identified threat, control, technologies, and protection mechanism. These
mechanisms could be helpful in improving and achieving maximum information security for the
data and then information (Haimes et al., 2015).
People: The stakeholders including internal, external and cloud service provider are the
most critical link for the information security management in the cloud computing adoption.

7
IT RISK ASSESSMENT CASE STUDY
There should be recognition of the roles and the responsibilities of each individual within the
organization and should be motivated toward achieving better information security management.
This section describes about the security personnel and the security of the personnel including
the aspects of the SETA program.
Project Management: This includes controlling and identifying the resources that could
be applied to the project like new infrastructure or more systems within the premises for
adopting cloud computing. Continuously monitoring the progress and motivating the employees
to the target stated by the organization. For this case of cloud adoption information system
cannot be described as a project rather it can be defined as a process in which each element
should be managed as a project (Rao et al., 2016). This should be a chain or series of projects.
Operational Categories
Security of the information while moving towards cloud adoption is also based on the
way of implementation of the technology. There are three common classification based on the
implementation, which can be listed as:
Management controls: Management security control emphasis on using assessment
methods based on the planning made earlier in manner to manage and reduce the risks related to
the data security. It can also be described as the “management controls as administrative
controls.” Most common management controls are: Firstly, Risk assessments that could be
helpful in making quantitative and qualitative analysis of the risks within the cloud adoption in
the organization and will provide helpful output for managing the serious risks. It can be
explained as cost and asset values for implementing cloud computing, and risk assessment for
that for the monetary values is a quantitative risk assessment (McCrie, 2015). However,

8
IT RISK ASSESSMENT CASE STUDY
qualitative risk assessment is based on the impact and probability of the risks that have been
identified during the risk assessment. Second component is vulnerability assessment that is an
attempt for discovering the current weaknesses or vulnerabilities. Aztec can implement
additional controls for reducing the risks from these vulnerabilities. Third approach involved in
this control is Penetration tests, which can be stated as the one step further from then
vulnerability assessment that can be helpful in attempting to exploit vulnerabilities that might
occur due to the cloud storage (Layton, 2016). An example stating the situation is that
vulnerability assessment will discover that the server is not up-to-date but the penetration test
will make an attempt in compromising the server through exploiting several of the un-patched
vulnerabilities.
Operational Controls: It could be helpful in ensuring the operational activities that are
being performed using cloud of the Aztek and complying with the overall security plan.
Operation controls that are being controlled by the individuals can be listed as: Firstly,
Awareness and training; it can be a beneficial aspect for maintaining the information security and
minimizing the threats. It could be helpful in understanding password security malware attacks,
phishing, and many more. Second control is the configuration and chain management that
ensures that the systems are properly configured (Rohdes, 2013). Third control includes
contingency plan plans that could ensure the planning and execution are going in right way.
Technical Controls: This includes protecting the data and systems from being breached
by an unwanted intruder or unauthorized use Risk. This includes proper encryption of the
systems, which could be helpful in protecting confidential and sensitive information. Antivirus,
anti-malware, IDSs (Intrusion detection systems), updated firewall, and least privilege are
recommended in this control (Peppard & Ward, 2016).

9
IT RISK ASSESSMENT CASE STUDY
Threats, Vulnerabilities and Consequences Assessment
Following is the list of threats vulnerabilities and consequences along with the impact
probability and severity that could help in later risk severity matrix that could be a beneficial
aspect for the decision-making by the stakeholders:
Sl. No. Risks Explanation Probability Impact Priority
Risk 1. Supply Chain Failure Cloud service provider sometimes
hires the server of another service
provider.
L M M
Risk 2. Interface
compromises
Using cloud hosted application leads
to such issues because the customer
management interfaces of the public
Cloud service providers are mediate
access and accessible to the internet
(Albakri et al., 2014).
M VH H
Risk 3. Conflicts in the
Cloud environment
When the service provider lacks in
providing the offered services and
solutions.
M M M
Risk 4. Lock-in The customer or client got stuck
with single service provider because
moving to other could cost much
more than estimated (Theoharidou,
Tsalis & Gritzalis, 2013).
H M H
Risk 5. Intellectual property
issues
Lacking in proper infrastructure and
risks to the data and information.
L M M
Risk 6. Social Engineering It can be tricked manipulation M H M

10
IT RISK ASSESSMENT CASE STUDY
Attacks (Phishing) through sending malicious coding
via mail or any messaging media and
hamper the information saved in the
system (Theoharidou et al., 2013).
Risk 7. Malicious Insider
(Cloud Provider)
Generally formal stakeholders with
credentials can cause such risk.
H VH H
Risk 8. Ineffective deletion
of data or Insecure
Generally data is not deleted
completely from the cloud.
H VH H
Risk 9. Loss of Governance Completely dependent on the service
provider for own data and
information.
VH VH VH
Risk 10. Technical risks Not meeting the infrastructure
requirement leads to such risks
M M M
Risk 11. Intercepting data in
transit
Involvement of an intruder while
data transfer could intercept the
exchange of information (Carlson,
2014).
M H M
Risk 12. Isolation Failure There are chances of failure in data
transfer either not properly uploaded
or not encrypted properly.
H H M
Risk 13. DDOS (Distributed
Denial of Service)
This is a network attack that happens
due to many requests at the same
moment from different applications
or sources (Latif et al., 2014).
M H M
Risk 14. Loss of Losing decryption code is similar to L H M

11
IT RISK ASSESSMENT CASE STUDY
Cryptographic keys the loss of data as the user will not
be able to recover his or her files.
Risk 15. Service Engine
Compromised
Compromise of the major
component could lead to serious
risks that in general very less
probability (Craig & Shackelford,
2013).
L VH H
Risk 16. EDOS (Economic
Denial of Service)
Manipulation with the budget
planning by an unauthorized user
could create distance for the users in
availing the complete service that is
being offered by the service
provider.
L H M
Risk 17. Cloud-specific
network related
technical attacks or
failures
This could cause serious issues
while exchanging the files means
either uploading or downloading, by
consumer or the service provider.
The loss in internet connection or
failure in establishing proper
network. Natural calamities and low
bandwidth network are the main
reasons for this cause.
M M M
Risk 18. Natural Disasters Calamities like earthquakes,
flooding, tsunamis and many others
could affect the infrastructure of the
service provider and will
VL H M

12
IT RISK ASSESSMENT CASE STUDY
alternatively affect the Customers as
most of the service providers have
different and far locations
Risk 19. Data protection
services
Legislations and policies of the
different country could lead to the
issues related with the security of the
data and the information that is
being saved on the Cloud in different
country. Another issue related with it
is the data protection authority from
different government cannot be
accessed (Djemame et al., 2016).
H H H
Risk 20. Risks from changing
jurisdictions
Many of the service providers
provide their services from outside
the country and change in
jurisdictions might seize the data.
H H H
Risk 21. Loss of Backups The above mentioned all the threats
could lead to the loss of data and
information is power for any
organization. There should be proper
backup storage for the instances
when data losses due to some
accident or intrusion.
L H M

13
IT RISK ASSESSMENT CASE STUDY
Risk Severity Matrix
Probability
Very
High Risk 9
High Risk 4.
Risk 12
Risk 19
Risk 20
Risk 7
Risk 8
Medium Risk. 3
Risk 10
Risk 17
Risk 6
Risk 11
Risk 13
Risk. 2
Low Risk. 1
Risk 5.
Risk 14
Risk 16
Risk 21
Risk 15
Very Low Risk 18
Very Low Low Medium High Very High
Impact
Data Security Issues
Cloud computing security can be seen with two perceptive, one from the side of the user
and another from the side of the cloud service provide Risk. The service provider should ensure
that the server that is being used by them is well maintained secured from external threats and
breaches. There should be no window left for the unauthorized user to enter the server and
command on it. There should be backup plan from the provider side for the instances when there
is breach or data theft, or data loss due to some unwanted events (Hashem et al., 2015). There are
chances of identity theft, in this case all the users have been provided with unique credentials. It

14
IT RISK ASSESSMENT CASE STUDY
could give access to the network to the unauthorized user who had already stolen the identity of
the individual and alter the data for personal use (Hashizume et al., 2013). Cloud security can be
divided into three groups that are Infected Application Data Issues, Data Issues, and Privacy
issues.
Cloud services provide access to the data from anywhere via connected to the internet
that lead to another security issue that is data breach. Since the data is being saved over the
internet, it becomes vulnerable to such attacks that could lead to the several issues for the
provider and the consume Risk. This could lead to the expose of data, manipulation of data, and
even data can be lost due to such intrusions into server. Recently, there are various examples of
the cyber-attacks that have caused serious damage globally and data that is being saved on the
cloud are much vulnerable to such attacks (Stojmenovic & Wen, 2014). This is because the
intruder could affect more than one organization at the same time through hacking the server of
the service providing Risk. This could also lead to privacy issues as the data and information that
is being saved into the cloud will contain very sensitive and personal information of the
employee and expose of such data or information. Organizations acquire third party for the
maintenance of cloud service and their data related to the day-to-day operations, whereas for
many cases even cloud service provider acquire third party for the server distribution (Modi et
al., 2013). This result in the fourth party involvement and the organization will never know about
how much they concern about security policy. This also increases the concern related to the
server breaches that could serious loss to the data security.
Data loss is most common security issue in adopting cloud computing from third party as
the organization becomes completely dependent on the third party after delivering all the
informational assets and no one knows when the service provider shut down his services. There

15
IT RISK ASSESSMENT CASE STUDY
are certain natural activities that could also lead to data loss or data corruption such as natural
calamities like earthquake, tsunami and many more that could affect the IT infrastructure of the
customer or the service provide Risk (Rewagad & Pawar, 2013). Amazon and Google are the
very recent examples of such case when the thunder lightning causes loss of all the data that
were saved. This implies that physical location of the storage is very crucial and important to
keep all data safe and protected from losing it. Physical location of data storage is very important
and crucial. The involvement of third party role in managing the data and the information leads
to some opaque clarification about the way they are protecting the information and the place
where they are keeping the information. The service provider provides services to more than one
organization; it may provide cloud services to the competitors of the Aztek. This leads to the
probability that the data is being shared to the competitors and it is a very big issue in all the
aspect for any organization (Inukollu, Arsi & Ravuri, 2014). It is the responsibility of the service
provider to maintain the privacy of the data and there should be not a single chance that
information gets exchange between any other user and customer Risk.
Solution of the Issues Related to the Data Security
Proper research about the service provider: an individual or heads of the organization
should firs thoroughly investigate about the background of the service provider whether he is
loyal to his agreements or not whether the vendor is experienced, well established, regulated, and
standard or not according to the needs of the organization.
Cross checking the agreement and Service Level Agreements (SLAs): Before agreeing to
the agreements there should be proper compliance of the services that are being offered by the
service provider with the existing policies and regulation of the organization (Arora, Parashar &
Transforming, 2013).

16
IT RISK ASSESSMENT CASE STUDY
Data Backups: This is a measure that should be taken by both the consumer and service
provider in manner of precaution if there is any data loss happens due to some unwanted event or
activities like natural calamities, terrorist attacks or many more (Ahmed & Hossain, 2014).
IT Infrastructure of Aztek: Aztek must have proper and advanced infrastructure that could
smoothly allow the configuration and installation of hardware components and the software that
are being offered by the cloud service provide Risk. It should also installations of routers, proxy
servers, software, servers, and firewalls including the infrastructure that could prevent the cyber
attacks and intrusions (Hashem et al., 2015).
Data encryption: Again this is the precaution that if both the customer and service
provider should emphasis on. Initially encrypting the data before uploading the file to the cloud
will help in protecting the file even if only intrusion or data breach happens in the server of the
service provider or the organization. This encryption should have only decryption code in
manner to keep it safe (Almorsy, Grundy & Muller, 2016). IT management team should properly
define the efficient key strategy and security elements to decide which data should be encrypted
and where there is no need of the encryption.
Chart preparation regarding data flow: The decision-making can be improved by
preparing a flow chart of the data flow. The data analysis should be made thoroughly and there
should be proper investigation about where the data is being saved and where it is being
transferred and many more (Rao & Selvamani, 2015).
Cloud Computing Security: “Cloud computing security (sometimes referred to simply as
"cloud security") is an evolving sub-domain of computer security, network security, and, more
broadly, information security (Zhao, Li & Liu, 2014). It refers to a broad set of policies,

17
IT RISK ASSESSMENT CASE STUDY
technologies, and controls deployed to protect data, applications, and the associated
infrastructure of cloud computing.”
Conclusion
Based on the above report it can be concluded that Aztek can improve many of the
operational activities including computing, data storage, data transfer management and many
more. Cloud computing is a leading advance technology in the field of Information Technology
sectors, that is spreading widely with rapid rate. Implementing Cloud computing into the system
of the Aztek could help in enhancing the performance of the organization with much efficiency
and accuracy. Implementing cloud computing will ensure the maintenance and it is also cost
effective system as the third party will be responsible to manage all the maintenance and provide
security for the information and data the customer is sharing with them. However, despite of all
the benefits there are certain threats and issues in implementing this into the system that has been
stated above along with a risk assessment that could improve the decision making of the
executives and improve the data security.

18
IT RISK ASSESSMENT CASE STUDY
References:
Ahmed, M., & Hossain, M. A. (2014). Cloud computing and security issues in the
cloud. International Journal of Network Security & Its Applications, 6(1), 25.
Aikat, J., Akella, A., Chase, J. S., Juels, A., Reiter, M. K., Ristenpart, T., ... & Swift, M. (2017).
Rethinking Security in the Era of Cloud Computing. IEEE Security & Privacy, 15(3), 60-
69.
Albakri, S. H., Shanmugam, B., Samy, G. N., Idris, N. B., & Ahmed, A. (2014). Security risk
assessment framework for cloud computing environments. Security and Communication
Networks, 7(11), 2114-2124.
Almorsy, M., Grundy, J., & Müller, I. (2016). An analysis of the cloud computing security
problem. arXiv preprint arXiv:1609.01107.
Arora, R., Parashar, A., & Transforming, C. C. I. (2013). Secure user data in cloud computing
using encryption algorithms. International journal of engineering research and
applications, 3(4), 1922-1926.
Carlson, F. R. (2014). Security analysis of cloud computing. arXiv preprint arXiv:1404.6849.
Craig, A. N., & Shackelford, S. J. (2013). Hacking the planet, the dalai lama, and you: managing
technical vulnerabilities in the Internet through polycentric governance. Fordham Intell.
Prop. Media & Ent. LJ, 24, 381.
Djemame, K., Armstrong, D., Guitart, J., & Macias, M. (2016). A risk assessment framework for
cloud computing. IEEE Transactions on Cloud Computing, 4(3), 265-278.

19
IT RISK ASSESSMENT CASE STUDY
Erl, T., Cope, R., & Naserpour, A. (2015). Cloud computing design patterns. Prentice Hall Press.
Gangwar, H., & Date, H. (2016). Critical Factors of Cloud Computing Adoption in
Organizations: An Empirical Study. Global Business Review, 17(4), 886-904.
Hashem, I. A. T., Yaqoob, I., Anuar, N. B., Mokhtar, S., Gani, A., & Khan, S. U. (2015). The
rise of “big data” on cloud computing: Review and open research issues. Information
Systems, 47, 98-115.
Hashem, I. A. T., Yaqoob, I., Anuar, N. B., Mokhtar, S., Gani, A., & Khan, S. U. (2015). The
rise of “big data” on cloud computing: Review and open research issues. Information
Systems, 47, 98-115.
Hashizume, K., Rosado, D. G., Fernández-Medina, E., & Fernandez, E. B. (2013). An analysis of
security issues for cloud computing. Journal of Internet Services and Applications, 4(1),
5.
Inukollu, V. N., Arsi, S., & Ravuri, S. R. (2014). Security issues associated with big data in
cloud computing. International Journal of Network Security & Its Applications, 6(3), 45.
Latif, R., Abbas, H., Assar, S., & Ali, Q. (2014). Cloud computing risk assessment: a systematic
literature review. In Future Information Technology (pp. 285-295). Springer, Berlin,
Heidelberg.
Layton, T. P. (2016). Information Security: Design, implementation, measurement, and
compliance. CRC Press.
McCrie, R. (2015). Security operations management. Butterworth-Heinemann.

20
IT RISK ASSESSMENT CASE STUDY
Müller, I. (2016). An analysis of the cloud computing security problem. arXiv preprint
arXiv:1609.01107.
Rani, D., & Ranjan, R. K. (2014). a comparative study of SaaS, PaaS and IaaS in cloud
computing. International Journal of Advanced Research in Computer Science and
Software Engineering, 4(6), 458-461.
Rao, J. R., Chari, S. N., Pendarakis, D., Sailer, R., Stoecklin, M. P., Teiken, W., & Wespi, A.
(2016). Security 360°: Enterprise security for the cognitive era. IBM Journal of Research
and Development, 60(4), 1-1.
Rao, R. V., & Selvamani, K. (2015). Data security challenges and its solutions in cloud
computing. Procedia Computer Science, 48, 204-209.
Rewagad, P., & Pawar, Y. (2013, April). Use of digital signature with diffie hellman key
exchange and AES encryption algorithm to enhance data security in cloud computing.
In Communication Systems and Network Technologies (CSNT), 2013 International
Conference on (pp. 437-439). IEEE.
Rhodes-Ousley, M. (2013). Information security the complete reference. McGraw Hill
Professional.
Rittinghouse, J. W., & Ransome, J. F. (2016). Cloud computing: implementation, management,
and security. CRC press.
Rivera, J., Yu, H., Williams, K., Zhan, J., & Yua, X. (2015, May). Assessing the security posture
of cloud service providers. In Proceedings of the 5th International Conference on IS
Management and Evaluation—ICIME (pp. 103-110).

21
IT RISK ASSESSMENT CASE STUDY
Sreeramaneni, A., Seo, B., & Chan, K. O. H. (2017). A Business Driven Scalable Cloud
Computing Service Platform (PaaSXpert). 15(1), 35-44.
Srinivasan, S. (Ed.). (2014). Security, Trust, and Regulatory Aspects of Cloud Computing in
Business Environments. IGI Global.
Stojmenovic, I., & Wen, S. (2014, September). The fog computing paradigm: Scenarios and
security issues. In Computer Science and Information Systems (FedCSIS), 2014
Federated Conference on (pp. 1-8). IEEE.
Theoharidou, M., Papanikolaou, N., Pearson, S., & Gritzalis, D. (2013, December). Privacy risk,
security, accountability in the cloud. In Cloud Computing Technology and Science
(CloudCom), 2013 IEEE 5th International Conference on (Vol. 1, pp. 177-184). IEEE.
Theoharidou, M., Tsalis, N., & Gritzalis, D. (2013, June). In cloud we trust: Risk-Assessment-as-
a-Service. In IFIP International Conference on Trust Management (pp. 100-110).
Springer, Berlin, Heidelberg.
Zhao, F., Li, C., & Liu, C. F. (2014, February). A cloud computing security solution based on
fully homomorphic encryption. In Advanced Communication Technology (ICACT), 2014
16th International Conference on (pp. 485-488). IEEE.