Inadequacies of Current Risk Controls for the Cloud

Abstract

In this paper we describe where current risk controls (as documented in ISO27001/27002) for mitigating information security risks are likely to be inadequate for use in the cloud. Such an analysis could provide a rationale for prioritizing protection research, and the work presented here is part of a larger exercise designed to identify the potential for cascade attacks in the cloud, and those areas most likely to be targeted based on both an understanding of threat motivations and likely areas of vulnerability.