Who Is Responsible for Security and Privacy in the Cloud?

Cloud computing is becoming increasingly attractive both in commercial and government sectors because of the significant cost reduction in their IT operations. The technical benefits of cloud environment (and its service-oriented capabilities) are the availability of computing resources those can quickly be engaged for service execution and released when no longer needed. As the cloud services moving to the mainstream computing, the issues of ownership and the chain of custody of customer data are becoming very critical. In this talk, I will discuss various cloud security issues, and the role and responsibilities of cloud service providers since the secure cloud environment is essential for providing uninterrupted services to customers. This talk will introduce various metrics for cyber security coverage, and demonstrate a tool, called MEGHNAD for estimating security coverage for cloud services. This tool can serve as a specialized Cloud Doctor in prescribing the right combination of security tools for different cloud services and according to the level of security assurance required. It will useful to a cloud provider who wants to incorporate security insurance as part of their Service Level Agreements (SLA).