Evaluation of Cloud Computing Offers through Security Risks An Industrial Case Study

Cloud provider selection is a difficult task, even more when security is a critical aspect of the processes to be moved on the cloud. To support cloud offer selection by a cloud consumer, we have introduced an innovative risk-based approach, proposing to distribute risk assessment activities between the cloud provider and the cloud consumer. This paper proposes an evaluation of this approach by assessing and comparing the portfolio of offers of POST Telecom, a cloud provider in Luxembourg. The case study will cover the evaluation of the offers with the help of standard security controls provided by three leading cloud organizations: Cloud Security Alliance, ISO/IEC and SANS Institute.