Security Assessment Model of Cloud Computing for Government Organizations

Abstract

The objectives of this study were to 1) survey, analyze and evaluate risk factors of Cloud computing systems of government organizations in Thailand, 2) design and develop a Cloud computing security model for government organizations, and 3) evaluate the efficiency of the model. The findings were as follows. The survey, analysis, and evaluation of risk of using Cloud computing systems revealed that usage patterns differed from organization to organization; meanwhile, no differences in Cloud computing among these organizations were found. Moreover, the level of risk was found to be very low, in spite of the high stakes, because Cloud computing systems were served and supervised by the Digital Government Development Agency (DGA). As for a security model of Cloud computing for government organizations, the researcher designed and constructed a security model according to three international standards (ISO, COBIT, ITIL) and criteria for selected items. This model was evaluated by experts whose opinions were solicited via a focus group. This model, featuring a security policy, consisted of 4 domains, 26 objectives and 109 sub-terms. The evaluation conducted by three experts according to qualitative rubrics showed that the overall security of the existing practice was at a moderate level, of which the mean was 3. After the security policy was introduced, its efficiency increased to a very high level of which the mean was 5, an increase of 66.67 percent. Our model can be applied in any government organization in Thailand in order to assess the risk of Cloud computing.