# ERMOCTAVE: A Risk Management Framework for IT Systems Which Adopt Cloud Computing
## 2 Terminologies and Related Works  
### Terminologies  
Cloud computing is a model for delivering data virtually on the Internet through web-based tools and applications, rather than a direct connection to a server. Resources are stored in servers. In the IT security environment, \"risk\" is the probability that a confidential information is exposed, data integrity is damaged, or information availability is interfered. Risk formula is the result of likelihood probability multiplied by the impact of the above events. Also, risk can be defined as result of identified vulnerability being exploited by a specific threat [4]. \"IT risk management\" is the process enabling the balance between operational cost and economic costs of protective controls in order to protect IT systems that support their organization's objectives. This process provides decision-making in all areas of our lives not only in IT environments. An effective risk management methodology helps managers determine appropriate actions for offering security capabilities [1]. Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) is a strategic assessment method for risk-based security [5]. It uses people's knowledge of security practices to understand the current security posture of the organization. Unlike typical assessments, which only target technological risk, OCTAVE also considers organizational and strategic risks. Using OCTAVE, a small team of people from the operational units and the technology department together address the security requirements, balancing three key aspects: operational risk, security practices, and technology. The OCTAVE method has three phases in which processes are described below [5]. **Phase 1**: Build asset-based threat profiles: Phase 1 gathers information from the organization and defines threat profiles for critical assets. **Process 1**: Identify senior management knowledge: Information about important assets, security requirements, threats, current strengths, and current vulnerabilities is collected from senior managers. * _Identify operational area knowledge: The information is collected from managers of selected operational areas._
* _Identify staff knowledge: The information is collected from general staff and IT staff members._
* _Create threat profiles: Critical information assets are selected and threat profiles for those assets are defined._
* _Identify infrastructure vulnerabilities: This phase evaluates key components of systems supporting the critical assets for technological vulnerabilities._
* _Identify key components: This process identifies key components from the systems that support the critical assets._
* _Evaluate selected components: Tools are run to evaluate the selected components, and the results are analyzed to refine the threat profiles._
* _Develop security strategy and plans: The primary purpose of this phase is to evaluate risks on critical assets and to develop a protection strategy and risk mitigation plans._
* _Conduct risk analysis: A set of impact evaluation criteria is defined to elaborate the impact value (high, medium, or low)._
* _Develop protection strategy: The organization-wide protection strategy focuses on improving security practices and mitigation plans, which reduce the important risks on critical assets are developed._  
Enterprise risk management (ERM) is a framework affected by the board of directors and the management of an entity. ERM aims to identify potential events that may affect the entity and to manage risks using its risk appetite. \"Risk appetite\" is the level of risk that the entity is prepared to accept in pursuit of its objectives. The level could be averse, minimal, cautious, open, or hungry. ERM offers assurance regarding the accomplishment of objectives set by the entity [6]. In ERM, uncertainty has both risk and opportunity. Risk can reduce value while an opportunity can enhance value. ERM components are described as follows.