# A Framework for Security Transparency in Cloud Computing
## 2 Related Works  
There are a number of efforts that consider transparency for the cloud based context. Most of the works by academia unravel the challenges by offering solutions through SLA management and virtual machine monitoring, while industry experts have developed acceptable initiatives such as audit and compliance programmes, and self-assessments [6]. This section outlines some of these essential works. [PERSON] _et al._ in [6; 7] proposed one of the first solutions for promoting security transparency in the cloud realm. Their proposal which is event-driven allows both CSC and CSP to make specifications to represent patterns of events of which their occurrence can be evidence of a security anomaly or breach or simply a sign of a nefarious use of the cloud infrastructure by some of its users. Dedicated algorithms for the detection of composite events coalesced with the definition of primitive events structure based on XCCDF format is meant to ensure the reuse and interoperability with security audit tools based on the Security Content and Automation Protocol-SCAP. In literature related to the SLA based-approach, [PERSON] _et al._ in [8] presented a monitoring architecture that integrates different security-related monitoring tools to provide continuous monitoring capabilities for SLA security parameters. The monitoring architecture put forward by the authors is built on and integrated with monitoring components belonging to SPECS framework, which also aims at designing and implementing a management framework of the SLA lifecycle. The validity of the approach was demonstrated through a case study related to the detection and management of vulnerabilities, where an open source monitoring system (OpenVAS) was integrated into the architecture in order to prove how open source and commercial monitoring tools can be flexibly mapped to enable automatic monitoring according to security SLOs. [PERSON] _et al._ in [4] discussed a preliminary design and implementation of a security solution for PaaS based on SLA approach with the aim of addressing the issues related to the management of security requirements in the cloud. The work adopts a dedicated cloudware platform that is deployed over infrastructure resources. The platform supports end-users and CSPs to specify their security requirements by means of SLAs, evaluate security features offered by remote cloud security brokers, management of SLA lifecycle as well as the development and deployment of security services. The preliminary architectural design of the platform involves three service layers, namely: application layer, services and platform layer, each with a distinctive function. [PERSON] _et al._ in [9] also proposed SLA@SOI management framework for service oriented architectures and CC. The authors advanced the idea of monitoring SLA by translating them into operational monitoring specifications that can be checked by a low level monitor. The foundation of the SLA@SOI is built on a universal monitoring engine used for monitoring quality and behavioural properties of distributed systems based on events captured from them during the operation of systems at run time. The engine is called EVEREST and the properties that can be monitored by this machine are expressed in a language based on Event-Calculus. For virtual machine monitoring, [PERSON] [10] offered Private Virtual Infrastructure for the pre-measurement of cloud security properties, secure provisioning of cloud data, and provision of situational awareness enforced through continuous monitoring. The initiative uses a concept based on combination of Trusted Platform Module and a Locator Bot as a channel to support cloud service monitoring. Through this approach, the author argued that security remains a common responsibility between a CSP and a CSC, thereby making an SLA a critical tool for defining roles and responsibilities of both actors. [PERSON] _et al._ in [11] discussed multi-level approach to SLA management for service-oriented infrastructure (SOI).