Context: Cloud computing is a prospering technology that most organizations are considering for adoption as a cost effective strategy for managing IT. However, organizations also still consider the technology to be associated with many business risks that are not yet resolved. Such issues include security, privacy as well as legal and regulatory risks. As an initiative to address such risks, organizations can develop and implement SLA to establish common expectations and goals between the cloud provider and customer. Organizations can base on the SLA to measure the achievement of the outsourced service. However, many SLAs tend to focus on cloud computing performance whilst neglecting information security issues. Objective: We identify threats and security attributes applicable in cloud computing. We also select a framework suitable for identifying information security metrics. Moreover, we identify SLA based information security metrics in the cloud in line with the COBIT framework. Methods: We conducted a systematic literature review (SLR) to identify studies focusing on information security threats in the cloud computing. We also used SLR to select frameworks available for identification of security metrics. We used Engineering Village and Scopus online citation databases as primary sources of data for SLR. Studies were selected based on the inclusion/exclusion criteria we defined. A suitable framework was selected based on defined framework selection criteria. Based on the selected framework and conceptual review of the COBIT framework we identified SLA based information security metrics in the cloud. Results: Based on the SLR we identified security threats and attributes in the cloud. The Goal Question Metric (GQM) framework was selected as a framework suitable for identification of security metrics. Following the GQM approach and the COBIT framework we identified ten areas that are essential and related with information security in the cloud computing. In addition, covering the ten essential areas we identified 41 SLA based information security metrics that are relevant for measuring and monitoring security performance of cloud computing services. Conclusions: Cloud computing faces similar threats as traditional computing. Depending on the service and deployment model adopted, addressing security risks in the cloud may become a more challenging and complex undertaking. This situation therefore appeals to the cloud providers the need to execute their key responsibilities of creating not only a cost effective but also a secure cloud computing service. In this study, we assist both cloud provider and customers on the security issues that are to be considered for inclusion in their SLA. We have identified 41 SLA based information security metrics to aid both cloud providers and customers obtain common security performance expectations and goals. We anticipate that adoption of these metrics can help cloud providers in enhancing security in the cloud environment. The metrics will also assist cloud customers in evaluating security performance of the cloud for improvements.

The emergence and subsequent growth of Cloud computing has brought with it a great deal of change in the manner in which the world undertakes to compute and store information. This new technology has brought with it immense possibilities as far as processing of information and the pooling of resources is concerned. This potential has also been noticed by the public sector, as Governments all over the world have undertaken to introduce what has come to be known as e-Government, the provisioning of Government services and communications via Web based applications, rather than the traditional means of in person contact and paper based collection of personal information. While the move to Web based Government has been occurring for the last 20 or so years, a new development in this area is the introduction of Cloud computing and Cloud-based computing platforms, most notably Software-as-a-Service (SaaS) in the provisioning of these services. The computing and efficiency potential of this technology cannot be disputed, yet it’s important to recognize that taking advantage of this computing power does come at a price. That price being significant threats to personal privacy and security of personally identifiable information. This thesis will make it easier for government agencies to make informed decisions about whether or not to migrate data and applications into the cloud. The identification and analysis of potential risks to data security and personal information has drawn together key information from a multitude of both academic and industry sources to make such a decision plausible.

Context: Due to rapid increase in the population of elderly people, sharing healthcare information has become an essential requirement for the development of e-health system. By conducting a research in e-health and cloud computing we have explored the advantages and disadvantages of sharing healthcare information for elderly people through cloud computing. Objectives: The main purpose of this research is to investigate the suitability of cloud computing to share healthcare information. The study is conducted by exploring the advantages and disadvantages of cloud computing for e-Health systems. Investigating a suitable cloud computing platform is also one of the objectives of this research. Methods: In order to identify and get deeper understanding of these issues, we have performed literature review of E-health, EHI and Cloud Computing technologies and we have develop a prototype application as experiment. Results: Based on the finding of literature review, we came to know that E-health was huge field. It needs a huge infrastructure to establish. The healthcare information in e-health requires quick and easy sharing. In EHI research, we defined EHI and find reasons for sharing elderly healthcare information. At cloud computing research, we knew the concept of cloud computing and found out advantages and disadvantages of implementing e-health in cloud computing. From literature review, we developed sharing application which was used to share EHI in cloud computing. In experiment, we proved our supposition and discussed advantages and disadvantages of sharing EHI in cloud computing by using Google App Engine (GAE). Conclusions: We conclude that cloud computing meets the requirements of sharing EHI, but it also has some limitations due to its architecture and network condition. In this research we have identified further research area that can help in enhancing security and privacy in cloud environment.

Visibility aspects of User Interfaces are important; they deal with the crucial phase of human-computer interaction. They allow users to perform and at the same time hide the complexity of the system. Acceptance of new systems depends on how visibility aspects of the User Interfaces are presented. Human eyes make the first contact with the appearance of any system by so it generates the very beginning of the human – application interaction. In this study it is enforced that visibility aspects are essential in application development. Furthermore, it is stressed that with practice of automation, habitual and functional visibility fades and users lose control. Users accept visibility loss only at certain points where it does not impact their skillset and understanding of an application. Although, they prefer control over visibility aspects and automation to strengthen the reception of the User Interface. The environments used in this study are Google Docs, Dropbox and cloudHQ with a case study of collaboration involving five users.

Quick Response code opens possibility to convey data in a unique way yet insufficient prevention and protection might lead into QR code being exploited on behalf of attackers. This thesis starts by presenting a general introduction of background and stating two problems regarding QR code security, which followed by a comprehensive research on both QR code itself and related issues. From the research a solution taking advantages of cloud and cryptography together with an implementation come after. We also give an objective evaluation on the outcome in comparison to existing QR products. They are based on the purpose of enhancing QR code security and aim to interpret how we have tackle the specified problems meanwhile to suggest possible further work for bringing security of QR code to a higher level.

Traditionally, health records have been stored in paper folders at the physician’s consulting rooms – or at the patient’s home. Some people stored the health records of their family members, so as to keep a running history of all the medical procedures they went through, and what medications they were given by different physicians at different stages of their lives. Technology has introduced better and safer ways of storing these records, namely, through the use of Personal Health Records (PHRs). With time, different types of PHRs have emerged, i.e. local, remote server-based, and hybrid PHRs. Web-based PHRs fall under the remote server-based PHRs; and recently, a new market in storing PHRs has emerged. Cloud computing has become a trend in storing PHRs in a more accessible and efficient manner. Despite its many benefits, cloud computing has many privacy and security concerns. As a result, the adoption rate of cloud services is not yet very high. A qualitative and exploratory research design approach was followed in this study, in order to reach the objective of proposing guidelines that could assist PHR providers in selecting a secure Cloud Service Provider (CSP) to store their customers’ health data. The research methods that were used include a literature review, systematic literature review, qualitative content analysis, reasoning, argumentation and elite interviews. A systematic literature review and qualitative content analysis were conducted to examine those risks in the cloud environment that could have a negative impact on the secure storing of PHRs. PHRs must satisfy certain dimensions, in order for them to be meaningful for use. While these were highlighted in the research, it also emerged that certain risks affect the PHR dimensions directly, thus threatening the meaningfulness and usability of cloud-based PHRs. The literature review revealed that specific control measures can be adopted to mitigate the identified risks. These control measures form part of the material used in this study to identify the guidelines for secure cloud-based PHRs. The guidelines were formulated through the use of reasoning and argumentation. After the guidelines were formulated, elite interviews were conducted, in order to validate and finalize the main research output: i.e. guidelines. The results of this study may alert PHR providers to the risks that exist in the cloud environment; so that they can make informed decisions when choosing a CSP for storing their customers’ health data.

Cloud computing is a constantly developing topic that reaches most of the people in the world on a daily basis. Almost every website and mobile application is hosted through a cloud provider. Two of the most important metrics for customers is performance and availability. Current tools that mea- sure availability are using the Internet Control Message Protocol (ICMP) to monitor availability, which has shown to be unreliable. This thesis suggests a new way of monitoring both availability and response time by using Hypertext Transfer Protocol (HTTP). Through HTTP, we are able to reach both the front-end of the cloud service (just as ICMP), but also deeper, to find failures in the back-end, that ICMP would miss. With our monitoring tool, we have monitored five different cloud data centers during one week. We found that cloud providers are not always keeping their promised SLA and it might be up to the cloud customers to reach a higher availability. We also perform load tests to analyze how vertical and horizontal scaling performs with regards to response time. Our analysis concludes that, at this time, vertical scaling outperforms horizontal scaling when it comes to response time. Even when this is the case, we suggest that developers should build applications that are horizontally scalable. With a horizontally scalable application and our monitoring tool combined, we can reach higher availability than is currently possible.

Cloud Computing today, is an evolving technology which features large Data Storage and ready-to-access from any device. The Healthcare Industry stores large Databases of patient’s records, considering the advantages of Cloud Computing it is looking forward to moving on from the traditional, proprietary Database Management Model into an Open Source Cloud DBMS Model. To complete this transition, it is of primary importance to provide Privacy and Security for Electronic Medical Record / Electronic Health Record. There are several kinds of research being done on how to mitigate these privacy issues using algorithms like Attribute Based Encryption and Identity-Based Encryption. In this study, we compare the performance of these two attribute based encryption methods. This thesis compares the performance of the state-of-the-art Attribute Based Encryption Schemas for Electronic Medical Record / Electronic Health Record Systems. Performance evaluation is conducted in local and cloud environments. A Literature Review has been performed to identify the existing Cloud-based Electronic Health Record Systems which uses the attribute based encryption as a mechanism to mitigate the privacy issues and realization in Cloud. Two algorithms have been selected by performing snowballing from the IEEE Research Articles. Experimentation was performed on the two algorithms in a local machine and on Amazon Web Services Cloud Platform to compare the performance. Verification of performance in each stage of the execution of the algorithms, in both local machine and Cloud environment, was done.

Context. Cloud computing (CC) is developed as a Human-centered computing model to facilitate its users to access resources anywhere on the globe. The resources can be shared among any cloud user which mainly questions the security in cloud computing. There are Denial of Service and Distributed Denial of Service attacks which are generated by the attackers to challenge the security of CC. The Next-Generation Intrusion Prevention Systems (sometimes referred as Non-Traditional Intrusion Prevention Systems (NGIPS) are being used as a measure to protect users against these attacks. This research is concerned with the NGIPS techniques that are implemented in the cloud computing environment and their evaluation. Objectives. In this study, the main objective is to investigate the existing techniques of the NGIPS that can be deployed in the cloud environment and to provide an empirical comparison of source mode and destination mode in Snort IPS technique based on the metrics used for evaluation of the IPS systems. Methods. In this study, a systematic literature review is used to identify the existing NGIPS techniques. The library databases used to search the literature are Inspec, IEEE Xplore, ACM Digital Library, Wiley, Scopus and Google scholar. The articles are selected based on an inclusion and exclusion criteria. The experiment is selected as a research method for the empirical comparison of Source mode and destination mode of Snort NGIPS found through literature review. The testbed is designed and implemented with the Snort filter techniques deployed in the virtual machine. Results. Snort is one of the mostly used NGIPS against DoS and DDoS attacks in the cloud environment. Some common metrics used for evaluating the NGIPS techniques are CPU load, Memory usage, bandwidth availability, throughput, true positive rate, false positive rate, true negative rate, false negative rate, and accuracy. From the experiment, it was found that Destination mode performs better than source mode in Snort. When compared with the CPU load, Bandwidth, Latency, Memory Utilization and rate of packet loss metrics. Conclusions. It was concluded that many NGIPS of the cloud computing model are related to each other and use similar techniques to prevent the DoS and DDoS attacks. The author also concludes that using of source based and destination based intrusion detection modes in Snort has some difference in the performance measures.

Cloud computing has become a significant and well-known term within a short period of time. Some parts of it might even be considered as unclear, including its vague definition. Cloud computing has rapidly and successfully come to perform an essential role within information technology and therefore in how organizations are managing their IT departments today. Its many advantages allure organizations to deploy a cloud solution. Despite the flourishing growth of cloud computing it still has its draw backs. One of its problems has come to be acknowledged as security issues, which has resulted in many companies deciding not to deploy a cloud solution and instead retain their traditional system. This qualitative study will come to investigate the perspective of organizations regarding security within cloud computing. The aim is to outline the security aspects conferred by Swedish organizations as there already is existing information concerning security issues. The empirical study is based on the gathered information from conducted semi-structured interviews. This study resulted in the findings of seven security aspects outlined by organizations, with the main reason concerning the uncertainty and towards the services of cloud computing. These security aspects are essential as they are set by organizations that have the potentiality to become cloud users, but for certain reasons decide not to. From the outlined security aspects, a close relationship can be identified to the already known security problems. These problems have strengthened the meaning of the security aspects, and that they are based on real concerns that can be connected to real problems.