# An Analysis of Cloud Security Frameworks, Problems and Proposed Solutions
## 3 Cloud Security Frameworks
### COBIT 5 for Cloud Security
#### 3.1.2 Strengths  
1. Holistic Approach: COBIT 5 provides a comprehensive approach to cloud control and assurance, encompassing topics like governance, risk management, control goals, and performance assessment. It provides a complete framework for managing cloud security in a methodical and integrated manner. 2. Risk Focus: COBIT 5 emphasizes a risk-oriented approach to cloud control and assurance. It assists businesses in identifying, assessing, and prioritizing risks connected \begin{table}
\begin{tabular}{c c c c} \hline \hline  & **Focus** & **Scope** & **Approach** \\ \hline \multirow{5}{*}{_COBIT 5_} & COBIT5 is a comprehensive & & COBIT5 focuses on governance, risk management, and compliance (GRC) \\  & framework that provides direction for & It addresses a wide range of IT & management, and compliance (GRC) \\  & enterprise IT governance and & disciplines, such as security, risk management, and compliance. & procedures and emphasizes \\  & management, including security & & connecting IT with business \\  & measures. & & objectives. \\ \hline \multirow{5}{*}{_NIST SP 800-144_} & NIST SP 800-144 addresses security & It gives guidance for organizations & NIST SP 800-144 takes a risk-based \\  & and privacy problems in public cloud & using cloud computing and focuses & approach and addresses particular \\  & computing systems particularly. & on risk management, security & security and privacy concerns for \\  & & measures, and data privacy. & cloud installations. \\ \hline \multirow{5}{*}{_ISO 27017_} & ISO 27017 is a standard that focuses & It addresses security issues such as & \\  & on implementing information security & data protection, access restrictions, & ISO 27017 adopts a risk-management \\  & measures for cloud services especially. & incident management, and & approach to cloud security and \\  & measures for cloud services especially. & regulatory compliance for both & provides a set of controls and \\  & & cloud service providers and cloud & recommended. \\  & & users. & \\ \hline \multirow{5}{*}{_CSA STAR_} & CSA STAR is a program that allows & It focuses on evaluating cloud & CSA STAR presents a set of control \\  & cloud service companies to show their & It focuses on evaluating cloud & goals and criteria for assessing cloud \\  & security practices and consumer & service providers’ security, privacy, & service providers’ security posture, \\  & openness. & and risk management skills. & allowing consumers to make educated \\  & The Amazon Web Services (AWS) & It discusses different areas of cloud & Security, dependability, performance \\  & Well-Architectered Framework is & architecture, such as security, & efficiently, cost optimization, and \\  & particular to AWS and provides & dependability, performance, cost & operational excellence are the \\  & assistance for developing, & optimization, and operational & framework’s five pillars. It outlines \\  & implementing, and running safe and & excellence. & best and design guidelines for each of \\  & efficient cloud systems. & the pillars. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Comparison of Frameworks. Figure 2: COBIT5 Principles. with cloud services, data security, and regulatory compliance. This helps organizations to properly allocate resources and prioritize risk reduction activities. * 3. Alignment with Industry Standards, Frameworks, and Laws: COBIT 5 is aligned with industry standards, frameworks, and laws, allowing organizations to satisfy compliance needs. It advises on how to apply best practices from standards such as ISO 27001, the NIST Cybersecurity Framework, and GDPR. This alignment makes it easier to implement a uniform and effective control and assurance program. * 4. Control Objectives: COBIT 5 provides a set of specified control goals targeted to cloud settings. Access management, data protection, incident response, and vendor management are among the important control objectives addressed. They serve as realistic guidance for building cloud security policies. * 5.