A survey of information security incident handling in the cloud. Issue 49 (March 2015)

• Record Type: Journal Article
• Authors: Ab Rahman, Nurul Hidayah; Choo, Kim-Kwang Raymond
• Is Part Of: Computers & security. Issue 49(2015)
• Page Start: 45
• Page End: 69
• Publication Date: 2015-03
• Subjects: Capability Maturity Model For Services (CMMI-SVC) -- Cloud computing -- Cloud response -- Incident handling -- Incident management -- Incident response; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2014.11.006
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Incident handling strategy is one key strategy to mitigate risks to the confidentiality, integrity and availability (CIA) of organisation assets, as well as minimising loss (e.g. financial, reputational and legal) particularly as organisations move to the cloud. In this paper, we surveyed existing incident handling and digital forensic literature with the aims of contributing to the knowledge gap(s) in handling incidents in the cloud environment. 139 English language publications between January 2009 and May 2014 were located by searching various sources including the websites of standard bodies (e.g. National Institute of Standards and Technology) and academic databases (e.g. Google Scholar, IEEEXplore, ACM Digital Library, Springer and ScienceDirect). We then propose a conceptual cloud incident handling model that brings together incident handling, digital forensic and the Capability Maturity Model for Services to more effectively handle incidents for organisations using the cloud. A discussion of open research issues concludes this survey. Graphical abstract: Highlights: Survey of incident handling strategy and standards. Cloud security incident handling strategy. The role of digital forensics in incident handling. A conceptual cloud incident handling model. Research trends and future research directions.