Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
From rationale to lessons learned in the cloud information security risk assessment: a study of organizations in Sweden
Luleå University of Technology, Department of Computer Science, Electrical and Space Engineering, Computer Science.
School of Informatics, University of Skövde, Skövde, Sweden.
School of Informatics, University of Skövde, Skövde, Sweden.
2022 (English)In: Information and Computer Security, E-ISSN 2056-4961, Vol. 30, no 2, p. 190-205Article in journal (Refereed) Published
Abstract [en]

Purpose — This study aims to address the issue of practicing information security risk assessment (ISRA) on cloud solutions by studying municipalities and large organizations in Sweden.

Design/methodology/approach — Four large organizations and five municipalities that use cloud services and conduct ISRA to adhere to their information security risk management practices were studied. Data were gathered qualitatively to answer the study’s research question: How is ISRA practiced on the cloud? The Coat Hanger model was used as a theoretical lens to study and theorize the practices.

Findings — The results showed that the organizations aimed to follow the guidelines, in the form of frameworks or their own experience, to conduct ISRA; furthermore, the frameworks were altered to fit the organizations’ needs. The results further indicated that one of the main concerns with the cloud ISRA was the absence of a culture that integrates risk management. Finally, the findings also stressed the importance of a good understanding and a well-written legal contract between the cloud providers and the organizations using the cloud services.

Originality/value — As opposed to the previous research, which was more inclined to try out and evaluate various cloud ISRA, the study provides insights into the practice of cloud ISRA experienced by the organizations. This study represents the first attempt to investigate cloud ISRA that organizations practice in managing their information security.

Place, publisher, year, edition, pages
Emerald Group Publishing Limited, 2022. Vol. 30, no 2, p. 190-205
Keywords [en]
Cloud computing, Practice, Impact, Rationale, Information security risk assessment, Lesson learned
National Category
Information Systems, Social aspects
Identifiers
URN: urn:nbn:se:ltu:diva-86916DOI: 10.1108/ICS-03-2021-0034ISI: 000688206900001Scopus ID: 2-s2.0-85113812542OAI: oai:DiVA.org:ltu-86916DiVA, id: diva2:1589300
Note

Godkänd;2022;Nivå 0;2022-04-19 (sofila)

Available from: 2021-08-31 Created: 2021-08-31 Last updated: 2022-04-19Bibliographically approved

Open Access in DiVA

No full text in DiVA

Other links

Publisher's full textScopus

Search in DiVA

By author/editor
Faizi, Ana
By organisation
Computer Science
In the same journal
Information and Computer Security
Information Systems, Social aspects

Search outside of DiVA

GoogleGoogle Scholar

doi
urn-nbn

Altmetric score

doi
urn-nbn
Total: 55 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf