# A Framework for Security Transparency in Cloud Computing
## 2 Related Works
In their work, SLAs are consistently specified and managed within SOL. They presented the run-time functional view of the conceptual architecture, applied and discussed the concepts to real case studies including Enterprise Resource Planning. [PERSON] _et al._ in [12] proposed an autonomous QoS management that uses a proxy-like approach, which is implemented based on WS-Agreement. The work suggested that SLAs can be exploited to define certain QoS parameters that a service must maintain during its interaction with customers. In compliance, assurance programs such as Security, Trust & Assurance Registry (STAR) dominate the scene and they have developed assurance schemes for promoting cloud security transparency [13]. CSPs subscribe to this initiative by adequately and satisfactorily implementing the security objectives specified by such bodies for enhancing security transparency. Also, ISO/IE27001 provides a certification framework for demonstrating best practice information security routines exercised by CSPs. The objective is to assist CSPs in improving the performance and effectiveness of Information Security Management Systems (ISMS) and help CSCs implement controls to address risks and understand their security needs. CSA STAR Self-Assessment is also a free initiative that allows CSPs to submit self-assessment reports documenting compliance to CSA's published best practices through a report [12]. The report involves a Consensus Assessments Initiative Questionnaire (CAIQ) that provides a set of questions a CSC would naturally wish to ask and CSPs may decide to submit completed answers to the questions. The approaches discussed above have made tremendous and important contributions but they also demonstrate a number of limitations. Some of the limitations associated with an SLA based approach include the enormity of areas in cloud security that ought to be covered and the works are mainly rationalised to address transparency from the position of a CSP. Furthermore, other works evolve around the integration of vulnerability management for checking the actual enforcement of SLA related metrics. This implies that the security transparency expectations of cloud users are not appropriately considered, thus making the initiatives appear as CSP-centred. The current efforts in virtual machines monitoring are mainly steered by the need to strengthen the management of security from a CSP perspective rather than providing an all-encompassing solution that unravels multi-party trust and mutual auditability complexities from CSCs' side. This direction thereby makes virtual machine monitoring CSP-centred. Compliance through certifications by security standards only provide a periodic assessment for a timespan, but do not provide additional feedback for intervals between assessments. Self-assessments prepared by CSPs are self-proclaimed declarations that are usually tilted in their favour, thus susceptible to bias, subjectivity, and failing to capture an accurate impression of the authentic state of affairs within the environment. Conversely, third-party customer audit has its own setbacks as a CSP may conceivably decline to consent to a physical audit of its infrastructure, and likely attempt to limit customer audit scope in protecting the confidential security processes of its services. Our work attempts to complete the shortfall in preceding literatures by providing the basics of cloud security transparency by elaborating on what constitutes transparency, its deployment types and practices. Given the scarcity of initiatives for practically implementing and overseeing security transparency requirements, this work's contribution could improve state of the art knowledge of the concepts surrounding it and the means to enforcing it. A distinguishing contribution of our work is that it adopts a multi-tiered approach to security transparency through three levels of abstraction, namely: conceptual level, organisational level and technical level.