# A Framework for Security Transparency in Cloud Computing
## 5 Cloud Security Transparency Framework
### Technical Level  
This level is influenced by the organisational level because concepts at the organisational level support the understanding of what type of technical means are needed to ensure security transparency. The primary emphasis of the technical level focuses on the technicalities for realizing continuous  
Figure 6: A metamodel for security transparency at the organisational level. transparency and generating security event notifications through SLA based monitoring as identified at the organisational level. This further illustrates the interdependence or interlinking of the three levels of abstraction that can be viewed from a conceptual view, at the organisational level down to the technical level. However, it is relatively important to identify the most commonly used conventional transparency mechanisms adopted by CSPs to provide customers with detailed and useful information. The mechanisms include:  
* **Compliance Programs:** CSPs are increasingly using compliance programs as mechanisms for demonstrating transparency through conformity with multiple traditional standards that predominantly focus on certifying the composition and management of security practices in CSP environments. Consequently, CSPs earmark a significant sum of budget for ensuring security, and spend sizeable amount of resources and time into compliance with security standards such as ISO 27001/27002, Payment Card Industry Data Security Standards (PCI DSS), and other relevant standards. * **Self-assessments:** CSPs have realised the obligation to provide satisfactory transparency of their services to CSCs. CSPs often conduct a discretional self-assessment of their services by employing control objectives specified in frameworks that document and certify best security practice within CSP environment in order to provide transparency to their customers. Self-assessments are usually free and open to all CSPs. One such framework is CSA STAR Certification that embarks on a three-levelled certification scheme to certify CSP's compliance to its set of security guidance and control objectives. * **Third-Party Customer Audit:** This is another type of transparency mechanism that materialises in the form of a systematic and objective evidence gathering process initiated by an independent auditor appointed by a CSC to physically appraise the CSP environment. Also, a CSP may be mutually obliged to fill-out a questionnaire and complete a detailed checklist prepared by a CSC about areas that are of concern to them. * **Security Policies:** CSPs usually enforce security transparency policies that make them committed to making information available to the public upon demand. CSPs consider access to information a key component of effective participation of all CSCs. Transparency policies are often enforced through an Information Disclosure Policy, which is guided by the underlying principles of accountability and openness concerning operational programmes and customer related aspects. * **Service Level Agreements (SLAs):** Another important technique for ensuring adequate disclosure of information involves the use of SLA. The SLA is a binding contract between the CSP and a customer, which specifies customer security requirements and the CSP's commitment to fulfilling them. It clearly describes the security responsibilities and liabilities between the two parties, states the service performance and delivery, problem management, legal compliance, _etc._  
We advocate SLA specifications as a part of contractual transparency because it is a common practice by CSPs to provide service offers with adjustable SLAs for allowing their customers negotiate the terms of offers. This provides an added opportunity that enables potential CSCs to request additional services on top of CSP offerings through the specification of their security expectations and the collection of evidences. CSCs achieve this by including most refined security needs that require frequent visibility as part of SLA security guarantees.