CYBERSECURITY RISK ASSESSMENT FOR SELECTING A CLOUD SERVICE PROVIDER

Abstract

This paper presents the development of a cybersecurity risk assessment module for selecting a cloud service provider, enabling organizations to make informed decisions based on all aspects of security. The module is designed as part of an integrated decision support system (DSS) and utilizes a detailed taxonomy of cloud services, covering various models and deployment options (IaaS, PaaS, SaaS, public, private, and hybrid clouds). The system performs security assessments based on collected vulnerability data, including information from the National Vulnerability Database (NVD) and other sources.

One of the key stages of the assessment is determining the risks associated with each service, which allows for the accurate identification of potential threats and the selection of a provider with the best security performance. The module evaluates various factors, including the frequency and severity of vulnerabilities, the likelihood of exploitation by attackers, and the speed of vulnerability remediation. The collected data is used to form a weighted risk assessment matrix that aids decision-making based on specific criteria.

The results of the study show that the developed module can significantly improve the cloud service provider selection process, particularly for large organizations with high data security requirements. Future research will focus on integrating this module into automated decision support systems, which will allow the selection process to be adapted to the rapidly changing conditions of cloud technologies and emerging threats.