SLA Based Information Security Metric for Cloud Computing from COBIT 4.1 Framework

Cloud Computing is one of the rapidly adopted technology in the field of Information and Communication Technology (ICT) in which resources (like processor and storage devices) can be rented out and released by the Cloud customer by using the Internet in on-demand basis. Information Security issues in Cloud Computing hold vital importance as the global economy depends upon the secure flow of information within the organization and exchange of information with other organization (private and public Cloud). To measure security in Cloud Computing at each level, Information Security metrics are better tools that help the organization to take good decisions on the base of qualitative and quantitative analysis, performance reports, efficiency and effectiveness of the implemented standard or certification security controls. SLA metrics are mostly used to evaluate performance of the service object but not to measure Information Security risks. These service objects can be further categorized as Hardware, Software, Network, Storage and Help Desk / Service Desk. Each object has its own quality metrics and can be combined to form a complex and compound service. COBIT is IT Governance framework which is widely used in IT industry. It covers several areas of IT Governance. Information Security is the part of this framework and the same part can be used to build SLA based Information Security Metrics in Cloud Computing. To obtain Information Security Metrics particularly for Cloud Computing, a criteria have been developed and Information Security Metrics are developed accordingly to facilitate both Cloud Customers and Cloud Service Providers.