Security Risk Assessment & Mitigation Framework for Cloud-based IT Systems

More often than not, the need for security is realized only after the system has been broken. Adding security afterwards is often difficult and much costlier and sometimes, nearly impossible. Hence, Security needs to be embedded into an IT system in order to develop secure IT systems which is possible only when a Security Engineering Framework is well defined for the entire lifecycle of an IT system. In this Paper, we have designed and developed an implementable Framework for Security Engineering of Cloud-based IT Systems. Cloud-based IT Systems are vulnerable to a plethora of cyber-attacks because of their accessibility and their services exposed in a multi-tenant environment. The Cloud-based IT Systems Security Risk Assessment & Mitigation Framework (CISSRAMF) is agnostic to Cloud Service Providers (CSPs) as well as to the type of Services provided, i.e., Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS). CISSRAMF encompasses the entire lifecycle of any Cloud-based IT System right from the conception phase till decommissioning of the system. CISSRAMF utilizes the Standards for Information Security and Cybersecurity like ISO/IEC 27001:2013, ISO/IEC 27002:2013, NIST SP 800-53 Rev. 5 and OWASP Application Security Verification Standard (ASVS) Project.