# A Framework for Security Transparency in Cloud Computing
## 4 Cloud Security Transparency
### Principles of Security Transparency in Cloud  
It is necessary to provide some guiding principles that are imperative for understanding transparency. A justification for these principles is to establish the fundamental norms that represent what is desirable and affirmative in the general sense of information disclosure within the sphere of CC. In other words, they are meant to govern the action of providing visibility and to inform cloud actors about the precepts they can be expected to uphold in the delivery of transparency. These considerations impact the accessibility and quality of information released under a transparency initiative. According to [PERSON] _et al._, in [24], there are some generic guiding principles for transparency. Our research will adopt these principles and tailor them according to cloud based systems.  
* **Availability**. Availability means that information relating to occurrences regarding migrated assets should be available to the users. A monitoring system should be configured to stream real-time or near-real time status information regarding customer assets and every action performed to those assets.
* **Clarity**. Implies that information should be clear and precise for easy understanding. In other terms, clarity eliminates all elements of ambiguity so that information is delivered precisely, in a coherent and intelligible manner. The benefit of clarity is about helping CSCs utilise information to reduce complexity and uncertainty so that analysis can be applied to identify a clear path forward. An example to this is represented by a scenario where a shared responsibility model for security provisioning is adopted. The CSP should clarify their responsibility in securing a cloud infrastructure, while CSCs should take on the responsibility of securing data or applications integrated into that infrastructure.
* **Current**. Means that the information should be up-to-date. Information should be regularly streamed to CSCs in a real-time or near real-time flow for enabling the evaluation of actions pertaining to their assets in the cloud. Also, the information should clearly state the timestampand occurrences of actions in relation to cloud-hosted assets. For example, anomaly detection in the cloud environment greatly depends upon current or real time information.
* **Relevance**. Information should be relevant to the context. Cloud systems consist of numerous virtual machines, hardware, operating systems and applications that provide valuable information. Information must be relevant to provide information from a variety of platforms. For example, if a CSC subscribes to information feed on cloud resource availability, the usage data of the cloud resource being considered should be particularly streamed to CSCs.
* **Notification**. Information relating to security incidents, events, deviations, or occurrences that affect customer assets in the cloud should be appropriately disseminated to concerned customers so that they can evaluate the occurrences and optionally take action. For example, the presence of dedicated monitoring systems that detect security phenomenon and notify CSCs to take remedial actions or invoke an autonomous action.
* **Free of Charge or at Low Cost**. Information should be automatically compiled, organised collocated and streamed to concerned cloud actors that subscribe information feed for free of charge or at a low cost.