云计算中的网络安全：风险评估模型
Cyber Security in Cloud: Risk Assessment Models
摘要：
本文提出了云风险评估模型应具有的特征，并对考虑这些特征的文献进行了回顾，以确定当前的差距。这项工作显示了云RA模型的排名及其与理论参考云风险评估模型的符合程度。文献回顾表明，RA方法利用CSA（云安全联盟）STAR注册表，已考虑到组织的安全要求，呈现出更高的合规程度，但他们仍然缺乏风险经济量化。尽管基于当前NIST SP 800：30、ISO 27001、ISO 27005、ISO 30001、ENISA标准的概念模型、方法和框架数量众多，但可以通过使用技术经济模型（如作者创建的UTEM）来增强，以便构思更简化的模型，用于有效的风险评估和缓解，更接近云风险评估的理论参考模型，适用于所有云模型（IaaS、PaaS、SaaS），并且易于所有利益相关者使用。
英文摘要：
The present paper shows a proposal of the characteristics Cloud Risk Assessment Models should have and presents the review of the literature considering those characteristics in order to identify current gaps. This work shows a ranking of Cloud RA models and their degree of compliance with the theoretical reference Cloud Risk Assessment model. The review of literature shows that RA approaches leveraging CSA (Cloud Security Alliance) STAR Registry that have into account organizations security requirements present higher degree of compliance, but they still lack risk economic quantification. The myriad of conceptual models, methodologies and frameworks although based on current NIST SP 800:30, ISO 27001, ISO 27005, ISO 30001, ENISA standards could be enhanced by the use of techno-economic models like UTEM, created by the author, in order to conceive more simplified models for effective Risk Assessment and Mitigation closer to the theoretical reference model for Cloud Risk Assessment, available for all cloud models (IaaS, PaaS, SaaS) and easy to use for all stakeholders.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
