Selecting a cloud service provider to minimize privacy risks

Abstract

The growth of the Internet has been accompanied by the growth of cloud services, leading to the need to protect the privacy of cloud service users. Cloud service providers differ in their capability to protect privacy. It is important to consider this capability as a major factor in the selection of a provider, thus minimizing the privacy risks associated with the selection. This work derives estimates of this capability, based on the number of vulnerabilities to attack, in comparison with the number of vulnerabilities that have been secured. It is proposed that cloud service providers calculate and publish these estimates, so that users can incorporate them as part of the process of selecting a provider (this would in turn encourage cloud service providers to pay more attention to privacy). Cloud service providers could also benefit from such estimates by using them to adjust their security measures for protecting privacy, until certain target capability levels of privacy protection are reached. An example of calculating and applying the estimates is included.