A Cloud Computing Security Assessment Framework for Small and Medium Enterprises ()
1. Background of the Study
In the Kenyan market, an SME is defined by researchers as a company that has a yearly turnover of between KES 70 million and 1 billion and is not listed in the stock exchange [1]. Under the Micro and Small Enterprises Act of 2002, micro enterprises have a maximum annual turnover of KES 500,000 ($5000) and employ less than 10 people. Small enterprises have between $5000 to $50,000 annual turnovers and employ 10 - 49 people. Medium enterprises—while not covered by the Act have a turnover of between $50,000 and $8 million and employ 50 - 99 people (Kenya Gazette Supplement No. 219, 2013). A recent National Economic Survey report by the Central Bank of Kenya [2] shows that, SMEs constitute 98 percent of all businesses in Kenya and create 30 percent of the jobs annually as well as contribute 3 percent of the GDP. Despite their immense contribution to the economy, Kenya’s SMEs are faced with numerous challenges and one of the main challenges has been information technology related costs [3]. Business applications have always been very complicated and expensive; the amount and variety of hardware and software required to run them are overwhelming. Businesses need a whole team of experts to install, configure, test, run, secure, and update them, which most SMEs are unable to afford [4]. With the introduction of cloud computing for businesses, most of the SMEs are able to avoid headaches that come with storing their own data, because they are not managing hardware and software—that becomes the responsibility of cloud computing provider. The shared infrastructure means cloud computing works like a utility, where SMEs only pay for what they need, upgrades are automatic and scaling up or down is easy [5].
1.1. Introduction
Cloud computing is a means of data storage whereby the data is stored and accessed over the network, mostly through the internet. The data is stored on multiple servers (and often locations), and the environment is controlled and managed by a hosting company called cloud storage providers [6]. It is a kind of outsourcing of computer programs where users are able to access software and applications from wherever they are. In other words, the computer programs are hosted by an outside party and reside in the cloud and the users do not have to worry about things such as storage and power, they simply enjoy the end result [6]. The providers always keep the data available and accessible wherever and whenever the owner or users require [7]. Put differently, cloud computing is the provisioning of IT resources including hardware, software, or services from third parties over a network, usually the internet. It is the delivery of scalable IT resources over the Internet, as opposed to hosting and operating those resources locally [8].
Researchers [9] assert that cloud computing is a web-service that comprises provision of storage capacity and virtualised computing resources. The virtual computing resource (email, software, data storage) are managed through remote servers by cloud providers. The cloud providers manage the cloud platform to offer their services and the end users access these services through normal browsers on computing devices such as; PC, iPad and Mobile Phones, among others [4] [9]. Therefore, end users do not have to manage or scale the IT infrastructure resources and instead focus on their core businesses. This leads to reduced running/capital costs, increased productivity, mobility, collaboration and profitability of businesses [10]. It is a model that enables on-demand access to shared configurable computing resources which can then be configured for usage by an organisation.
Where cloud computing can help organisations accomplish more by paying less and breaking the physical boundaries between IT infrastructure and its users, heightened security threats must be overcome in order to benefit fully from this new computing exemplar [11].
The rate of cyber-attacks has increased in recent times and experts believe that if nothing is done about it, the severity of future attacks could be much greater than what has been observed currently [12]. Cloud hackers have become innovative and have the capacity to cause harm with catastrophic impact from anywhere in the world, while equipped with only a computer and the knowledge needed to identify and exploit vulnerabilities [13]. It is noted that mid-sized businesses which include SMEs, focus their investment on customer satisfaction and mechanisms of reducing operating costs and therefore tend to disregard necessary investment towards securing their cloud infrastructure [14].
1.2. Problem Statement
As more SMEs today continue to use cloud computing as a vital business tool and to store their data online, the need for security of information assets of an organisation cannot be over-emphasised. SMEs are utilising the opportunities offered by cloud to adopt innovative business operations, to increase business efficiency, to develop customer-centric strategies, and to stay competitive with the use of technology. It is therefore imperative to ensure that the information stored in the cloud is protected against any kind of failures or attacks. Although, cloud computing offers several benefits for achieving business success, if the cloud service used is not sufficiently available, reliable, and secure, the business justification for moving to the cloud will be significantly reduced. And, unfortunately, the concentration of the data and applications in the cloud can create a more attractive target for potential attackers.
Therefore, it is absolutely essential to have a comprehensive, end-to-end standardised security framework based on industry standards, but tailored to the specific requirements of SMEs. The authors developed a standardised cloud security framework for SMEs that would aid SMEs to self-assess and index challenges in cloud computing and therefore improving their overall security.
2. Review of Existing Frameworks
The benefits of security frameworks are to protect vital processes and the systems that provide those operations. A security framework is a coordinated system of tools and behaviours in order to monitor data and transactions that are extended to where data utilization occurs, thereby providing end-to-end security [14]. Table 1 shows various security frameworks and their pros and cons.
![]()
Table 1. Review of existing frameworks.
Source: Research Data (2019).
As indicated in the above section, framework and guidelines like ISO 27001, NIST 800-53, ENISA and COSO have been reviewed, but all these standards are in evolving stages for the Cloud computing environment. Although ISO/IEC 27001 provides generic guidance in developing the security objectives and metrics, but it still does not provide methods to guide SMEs and is very general. Apart from this, the security requirements of SMEs vary based on their specific security risks. Therefore, it is vital to have a standardized security framework based on industry standards, but tailored to the specific requirement of SMEs. While reviewing industry security framework and guidelines, it was found out that there are no cloud security frameworks, best practices and guidelines aligned towards the challenges faced by SMEs either due to their complex nature in adopting them or because they do not cover the cloud aspect effectively.
3. Basics of the Framework for Cloud Security
As any company risk, the risk of data in the cloud cannot be eliminated (or minimized to an accepted level) and therefore requires a series of coordinated actions to be taken in order to manage it. Such actions involve the organisation and technology departments of the company, in addition to the financial management of the risk, also through the establishment of a residual risk management strategy and a strategy to protect the company balance.
Furthermore, the cyber risk is intrinsically highly dynamic. It changes as threats, technology and regulations change. To start approaching this issue in a way which is useful for the developing country systems (state, enterprises and citizens) it is necessary to define a common ground, a Framework, in which the various production sectors, government agencies and regulated sectors can recognise their business, so to align their cyber security policies in a steadily developing process.
To reach this aim a common framework should be first of all neutral both in terms of business risk management policies and in terms of technology, so that each player could keep on using its own risk management tools, managing its technology assets while monitoring at the same time the compliance with sector standards.
The study presents a Framework for Improving Security in Cloud Computing for SMEs (FISCCS) aimed at creating a common language to compare the implementation of these systems risks. The framework may well help an SME to plan a cloud risk management strategy, developed over the time according to their business, size and other distinguishing and specific elements of the SMEs.
The choice to develop the framework is based on the idea that the answer to threat management should provide an alignment at international level, not only at national level. The framework offers high flexibility, which is mostly targeted at SME facilities; and was developed according to the characteristics of the social and economic system of our country, reaching a cross-sector framework that can be contextualised in implementation of secure cloud for SMEs. This allows the transfer of practices and knowledge from one sector to another in an easy and efficient way.
Framework Building through Metrics
Security metrics are measurements from which to monitor and compare the level of security and privacy attained, as well as the current security status of a computing environment. The use of security metrics promotes transparency, decision making, predictability and proactive planning [15]. Metric is a measurement standard, defining both what is being measured (the attribute) and how it is measured (the unit of measure) [16].
Measurement is the process of metric collection which, through pre-established rules, will allow the interpretation of results [16]. Metrics can be composed of sub-elements that are referred to as primitive metrics or sub-metrics. Any restrictions or controls relating to the primitives are defined in the measurement process. A metric can be expressed in one of the following ways:
1) #—“Number”—expressing an absolute value of any element measured;
2) %—Percentage—expressing a percentage of an element measured in relation to the total number of elements;
3) Logic value—expressing Yes or No for an event.
Figure 1 represents the proposed life cycle of security management for cloud computing environments.
![]()
Figure 1. Life cycle of security management. Source: Author (2019).
The proposed methodology for security management in cloud computing is based on the following components:
1) Cloud security metrics hierarchy;
2) Index of Security (IndSec);
3) Security Management by SMEs.
In the 1970s, the GQM method (Goal Question Metric) [15] was designed to move testing for software defects from the qualitative and subjective state it was currently into an empirical model, in which defects would be measured against defined goals and objectives that could then be linked to results.
The GQM methodology defines a measurement model on three levels:
1) Conceptual level (goal)—a goal is defined for an object for a variety of reasons, with respect to various models of quality, from several points of view and relative to a particular environment.
2) Operational level (question)—a set of questions is used to define models of the object under study and then attention is focused on that object to characterize the assessment or achievement of a specific goal.
3) Quantitative level (metric)—a set of metrics, based on the models, is associated with every question in order to answer it in a measurable way.
The Cloud security metrics hierarchy is derived from the GQM methodology. A security index (IndSec) will be computed using the security metrics hierarchy. Finally, the SME will use the security index as a reference for improving their security. In the context of the life cycle of security management (Figure 1), a security metrics hierarchy is presented as a new form of visualisation of security-related information that is collected from the cloud computing environment [17].
In this research methodology, the security metrics hierarchy is generated directly from the GQM definition process, during which stage security features are mapped to corresponding security metrics. Table 2 shows the relationship between the GQM methodology and the security metrics hierarchy (SMH).
![]()
Table 2. Relationship between the GQM methodology and SMH.
Source: Security Metrics Hierarchy (2019).
For each goal statement identified in the conceptual level, a group metric was defined. The operational level identifies which objects or activities must be observed or collected to measure the individual components of the goal statement. Lastly, the quantitative level defines which metrics remains explicitly aligned with the higher-level goal statement.
The security metrics hierarchy is derived from the GQM methodology. The metrics are classified into Group metrics, Metrics and Sub-Metrics as shown in Figure 2.
The sub-metric represents a sub-part of a metric; it is used when a metric can be specialised in several ways, with each one having a different contribution to the overall metric. The importance of value conversion is to extract a meaning for the values measured by the primitive metrics. Further, value conversion helps to prevent the value domains of security metrics from having instances that are difficult to be compared with each other, and to simplify the computational model using a method to converge the values of each primitive metric measured to a common scale of values.
A metric of type logic must return a logical value measured from an event, for instance, does the cloud have a 2-factor authentication for authorising users? The conversion function is described as y = f(x), where x can be a measured logic value Yes or No:
Beginning with goals, the researcher defined the strategic objectives for cloud security based on the feedback from the SMEs. These goals naturally trigger questions that must be answered to determine whether the goal has been met. For instance, if the goal is ensuring that a cloud provider is protecting sensitive data as well as the consumer, certain questions emerge: How well does the consumer protect data today? How well does the provider protect internal data? What controls are in place in the SME? Many questions emerge, all representing the process by which the SME verifies performance against the goal. Questions in turn trigger demands for data and measurement.
4. Developed Framework
The framework developed by the researcher is as indicated in Figure 3. The author proposes an eight-stage cloud security framework divided into two sections.
![]()
Figure 2. Metrics classification. Source: GQM Methodology (2019).
![]()
Figure 3. Framework for improving security in cloud computing. Source: Author (2019).
The first five stages are Identify, Protect, Detect, Respond and Recover. The second section includes Metric Hierarchy, Index of Security and finally Implementation of a Secure Cloud [18].
The developed framework has considered factors from results of the data collected, previous studies and frameworks that are in place. It was evident that SMEs need a cloud security framework with the ability to guide them on the three core factors that cause compromise on security (people, lack of technologies and external factors).
Several key references were employed to gather the information required for building these categories, including CSA‘s security guidance and top threats analysis, ENISA’s security assessment and the cloud computing definitions from NIST.
4.1. Implementation of the Framework
The framework core represents the life cycle structure of the management process of cyber security, both from a technical and organisational point of view. The core is structured hierarchically into group metrics, metrics and sub metrics. The group metrics are: Identify, Protect, Detect, Respond, Recover and they represent the main topics to deal with in order to strategically secure data in the cloud. Thus, the framework, for each group metrics, metrics and sub metrics, will provide information in terms of specific questions, defines the categories and technologies to be put in place in order to manage the single function.
The priority levels help to support organisations and companies in the preliminary identification of sub metrics to be implemented in order to further reduce their risk levels, while balancing the effort to implement them. The priority levels aid to:
1) Simplify the identification of essential sub metrics to be immediately implemented;
2) Support the organisations in their risk analysis and management process.
The identification of priority levels assigned to Subcategories has been performed according to two specific criteria:
1) Ability to reduce cyber risk, by working on one or more key factors for the identification, that is, exposure to threats, intended as the set of factors that increase or diminish the threat probability; Occurrence Probability, that is the frequency of the possible event of a threat over the time; impact on business operations and company assets, intended as the amount of damage resulting from the threat occurrence;
2) Ease of sub metric implementation, considering the technical and organisational maturity usually required to put in place specific countermeasures.
The framework suggests the use of a priority scale of three levels among sub metrics. The combination of these two criteria allows the definition of three different priority levels:
1) High Priority: Actions that enable the slight reduction of one of the three key factors of cyber risk. Such actions are prioritised and must be implemented irrespective of their implementation complexity;
2) Medium Priority: Actions that enable the reduction of one of the three key factors of cloud security risk, that is generally easily implementable.
3) Low Priority: Actions that make possible to reduce one of the three key factors of the cloud security risk and that are generally considered as hard to be implemented (Require significant organisational and/or infrastructural changes).
Further, the framework core structure shows validation references that link the single sub metric to a number of known security practices by using internationally recognised security standards like ISO, SP800-53r4, COBIT-5, SANS20 and others [19] [20].
The classification of the sub-levels advises the SME on the rules and procedures that all individuals accessing and using the organisation’s IT assets and resources must follow. The goal of the classifications is to provide details on which aspect of the security needs attention and also who is in charge of doing so.
Appendix 1 shows details of the framework, its levels, priority, validation reference, which group it applies to, the metric type and the metric classification. The research suggests a score of one (1) point if the answer is yes and score of zero (0) if the answer is no. The total scored subjected to the GQM formula will enable one to work out the indicator of how secure the SME’s cloud data is.
4.2. Testing the Framework Functionality
The Security Index (IndSec) is defined as the highest value in a set of security items:
IndSec = max(Met1, Met2, Met3, Met4, Met5)
Example 1, max(Met1, Met2, Met3, Met4, Met5) = max(1, 1, 1, 1, 1) = 1.
Therefore, IndSec = 1, meaning the cloud environment is secure.
Example 2, max(Met1, Met2, Met3, Met4, Met5) = max(1, 0, 1, 0, 0) = 0.
Therefore, IndSec = 0, meaning the cloud environment is not secure.
The use of the function max at each level of hierarchy causes the largest measured metric value to be passed on to the level. Immediately above, i.e. the highest measured value will be the only significant one.
The value of a metric group (Metx) is defined as the highest value from a set of metrics:
Metx = max(Metx.1, Metx.2, ..., Metx.n). For instance, Met1 = max(Met1.1, Met1.2, Met1.3).
An example for a best-case scenario is as below:
Met1 = max(Met1.1, Met1.2, Met1.3).
Met1 = max(1, 1, 1).
Met1 = 1
Met2 = max(Met2.1, Met2.2, Met2.3, Met2.4, Met2.5).
Met2 = max(1, 1, 1, 1, 1).
Met2 = 1
Met3 = max(Met3.1, Met3.2, Met3.3).
Met3 = max(1, 1, 1).
Met3 = 1
Met4 = max(Met4.1, Met4.2, Met4.3, Met4.4, Met4.5).
Met4 = max(1, 1, 1, 1, 1).
Met4 = 1
Met5 = max(Met5.1, Met5.2, Met5.3).
Met5 = max(1, 1, 1).
Met5 = 1
On the flip side, a non-secure scenario result is represented below:
Met1 = max(Met1.1, Met1.2, Met1.3).
Met1 = max(1, 0, 0).
Met1 = 0
Met2 = max(Met2.1, Met2.2, Met2.3, Met2.4, Met2.5).
Met2 = max(1, 1, 0, 0, 0).
Met2 = 0
Met3 = max(Met3.1, Met3.2, Met3.3).
Met3 = max(0, 0, 0).
Met3 = 0
Met4 = max(Met4.1, Met4.2, Met4.3, Met4.4, Met4.5).
Met4 = max(0, 1, 0, 0, 0).
Met4 = 0
Met5 = max(Met5.1, Met5.2, Met5.3).
Met5 = max(1, 0, 0).
Met5 = 0
The value of a metric (Metx.y) is defined as the highest value from a set of sub-metrics:
Metx.y = max(Metx.y.1, Metx.y.2, ..., Metx.y.n). For instance, Met1.1 = max(Met1.1.1, Met1.1.2, Met1.1.3, Met1.1.4, Met1.1.5).
An example for a best-case scenario is as below:
Met1.1 = max(Met1.1.1, Met1.1.2, Met1.1.3, Met1.1.4, Met1.1.5).
Met1.1 = max(1, 1, 1, 1, 1).
Met1.1 = 1
Met1.2 = max(Met1.2.1, Met1.2.2, Met1.2.3, Met1.2.4).
Met1.2 = max(1, 1, 1, 1).
Met1.2 = 1
Met1.3 = max(Met1.3.1, Met1.3.2, Met1.3.3, Met1.3.4, Met1.3.5).
Met1.3 = max(1, 1, 1, 1, 1).
Met1.3 = 1
On the flip side, a non-secure scenario result is represented below:
Met1.1 = max(Met1.1.1, Met1.1.2, Met1.1.3, Met1.1.4, Met1.1.5).
Met1.1 = max(1, 0, 0, 0, 1).
Met1.1 = 0
Met1.2 = max(Met1.2.1, Met1.2.2, Met1.2.3, Met1.2.4).
Met1.2 = max(0, 0, 0, 1).
Met1.2 = 0
Met1.3 = max(Met1.3.1, Met1.3.2, Met1.3.3, Met1.3.4, Met1.3.5).
Met1.3 = max(0, 0, 0, 0, 0).
Met1.3 = 0
The sub-metric Metx.y.n either yields a 1 (based on a yes) or a 0 (based on a no). For example, Met2.3.2—Is the Data protected while in transit (upload/download from the cloud)? Yes.
Then Met2.3.2 = 1
Met2.3.2—Is the Data protected while in transit (upload/download from the cloud)? No.
Then, Met2.3.2 = 0
4.3. Using the Framework
The implementation of the Framework by an SME should be performed in five steps, as showed in Figure 4.
The steps are explained as follows:
1) Understand the Framework and the Metrics. The SME has to understand
![]()
Figure 4. Using the framework for improving security in cloud computing. Source: Author (2019).
the framework and its sub-components for its business objectives and its security pertaining to the cloud. This activity can be performed also starting from a publicly available contextualisation and adjusting it to the specific business context of the SME. The questions representing the contextualisation are structured in a logical manner with a yes or no as an answer.
2) Identify Systems and Critical Assets. The identification of ICT systems and information is considered crucial or anyway critical by the SME to ensure its operations. This step is important especially for the following stages, as it makes it possible to properly evaluate the impacts during risk analysis and it makes it easier to understand the actual needed protection. It should be noted that within SMEs it is important to also identify the ones who are responsible for the implementation of the Framework steps for each sub metric.
3) Determine the Index of Security. Once the sub metric questions have been answered, the answers are subjected to the GQM metrics to be able to determine the index of security which can be either secure or not secure.
4) High Priority Sub-Metric Implementation. The SME should start to use the Framework by implementing the high priority sub metrics. This is a critical step in the Framework implementation and it makes it possible to reach a degree of preparedness and awareness of the cloud security risk. The target (turning all sub metrics into positive responses) represents the reference to compare the current profile, thus establishing the existing gaps within the cybersecurity management.
5) Definition and Implementation of an Action Plan to Improve the Cloud Security Index. The last step of the process of Framework endorsement consists of defining the set of activities needed to reach a secure security index. This means to establish a specific plan to implement the Framework security practices, according to a schedule, that varies upon the actual identified risks and specific conditions of the SME business.
Clearly it is preferable to have a continuous evolution of the Framework implementation, even after having reached the target profile, in line with the cyclic risk assessment staged and following actions of steady improvement.
5. Conclusions
Cloud computing offers many opportunities to SMEs, but risks and challenges as well [21]. For an SME to succeed, they must critically examine available data, create policies especially security policies, follow existing standards and develop adequate procedures of ensuring adherence [22]. This research offers a means for SMEs to implement cloud solutions in a more secure way, by an approach that is oriented on most of the stages that an organisation must go through to achieve a relatively secure cloud environment.
Standardised frameworks such as FISCCS make a significant impact and create healthy competition among Cloud providers to satisfy their Service Level Agreement (SLA) and improve their Quality of Services (QoS) as well as give SMEs an opportunity to store data in the cloud in a more secure manner as well as increase their trust in the cloud and the cloud provider. It is important to note that as stated by Becker and Bailey (2014), no one framework or model encompasses all of the possible IT controls, collectively they cover the—what, how, and scope of IT Governance.
The framework further gives a guiding strategy and procedure to SMEs who wish to develop a cloud security policy by telling them what to secure at which stage and how to do it. It further also gives IT technicians a better idea of how processes flow in the cloud, thereby allowing them to solve security related problems in an informed manner.
Appendix 1: Framework Details