# A Framework for Security Transparency in Cloud Computing
## 5 Cloud Security Transparency Framework
### Organisational Level and Modelling Concepts for the Framework
They provide a detailed representation of the actual security controls in the areas of technical, human, physical and operational safeguards adopted by a CSP to sustain security, and reveal the actions, functions and steps taken in order to provide transparency and meet CSC security expectations. They are provided through attested sources such as automated evidence collection tools, websites, security whitepapers, _etc._
* **Requirements**. Requirements imply vital security needs for safeguarding CSC assets and enabling security transparency. In some scenarios of service negotiation, a CSC may be wholly satisfied with CSP offerings while in other scenarios the CSC may identify some inadequacies between CSP offerings and their needs. In both circumstances, the CSC identifies and clearly defines the essential security requirements that safeguard assets and which are worthy of tracking to ensure continuous transparency. Put differently, requirements represent the crucial CSC security needs that are continuously monitored for transparency once assets are outsourced to the cloud. It is important to mention that requirements' extraction considers the identified goals from the cloud strategy, risks, security best practice and assets. For ensuring the extraction of appropriate requirements, best security practice guide such as Cloud Security Alliance's Cloud Control Matrix (CSA CCM, 2011) should be taken into consideration. * **SLA**. The pertinent CSC security needs identified through the requirements concept are stipulated as requisite clauses in the SLA. The clauses are transformed to form the subject of security transparency that deliver visibility into the security occurrences on assets migrated to the cloud. * **Monitoring**. Monitoring involves the tracking of security events pertaining to CSC security requirements as specified in the SLA. It also tracks CSP controls in order to check their operational status. It consolidates several services that are supported by the CSP to enable CSCs to collect evidences on the status of their assets. * **Events**. Events deal with information provided to show the incidents, or activities performed on CSC assets and the resulting status of the assets. They are the occurrences that take place in the cloud services relevant for CSC assets. Events send a status report generated by the monitoring concept to provide accurate and timely information relating to the operating conditions that are of interest to CSC requirements. This will generate evidence-based trust between cloud actorsthat all expectations are being met and that everything claimed to be happening in the cloud is indeed happening. The metamodel in Figure 6 shows an overall view of the concepts and their relationships. A CSC actor could be a corporate or individual user interested in cloud services offered by a CSP. At the preliminary stages of cloud adoption, the CSC performs an appraisal of cloud strategy designed to (i) identify the goals for cloud adoption such as cost reduction and security; (ii) and analyze the readiness for cloud technology in terms of security, portability, integration _etc._ The cloud strategy allows the CSC to comprehensively identify their critical assets so as to determine what assets are put into the cloud and to also recognize the security specificities that could protect the assets while in the cloud. CSPs, on the other hand, implement the necessary technical and non-technical controls for safeguarding CSC assets, as well as transparency mechanisms for providing information to such security services. They also adopt proactive and reactive transparency mechanisms to generate evidence in various forms to disclose how CSC needs are supported. Moreover, the CSC may require more security services. Therefore, the CSC defines the desirable and essential requirements for the protection of its assets. The security requirements become the major points of attention to the CSC that ought to be monitored in the cloud, and therefore, they are enumerated and specified in SLA.