{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,26]],"date-time":"2026-02-26T00:04:41Z","timestamp":1772064281186,"version":"3.50.1"},"reference-count":36,"publisher":"MDPI AG","issue":"9","license":[{"start":{"date-parts":[[2019,9,10]],"date-time":"2019-09-10T00:00:00Z","timestamp":1568073600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>Many companies are adapting cloud computing technology because moving to the cloud has an array of benefits. During decision-making, having processed for adopting cloud computing, the importance of risk management is progressively recognized. However, traditional risk management methods cannot be applied directly to cloud computing when data are transmitted and processed by external providers. When they are directly applied, risk management processes can fail by ignoring the distributed nature of cloud computing and leaving numerous risks unidentified. In order to fix this backdrop, this paper introduces a new risk management method, Enterprise Risk Management for Operationally Critical Threat, Asset, and Vulnerability Evaluation (ERMOCTAVE), which combines Enterprise Risk Management and Operationally Critical Threat, Asset, and Vulnerability Evaluation for mitigating risks that can arise with cloud computing. ERMOCTAVE is composed of two risk management methods by combining each component with another processes for comprehensive perception of risks. In order to explain ERMOCTAVE in detail, a case study scenario is presented where an Internet seller migrates some modules to Microsoft Azure cloud. The functionality comparison with ENISA and Microsoft cloud risk assessment shows that ERMOCTAVE has additional features, such as key objectives and strategies, critical assets, and risk measurement criteria.<\/jats:p>","DOI":"10.3390\/fi11090195","type":"journal-article","created":{"date-parts":[[2019,9,10]],"date-time":"2019-09-10T10:52:26Z","timestamp":1568112746000},"page":"195","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":10,"title":["ERMOCTAVE: A Risk Management Framework for IT Systems Which Adopt Cloud Computing"],"prefix":"10.3390","volume":"11","author":[{"given":"Masky","family":"Mackita","sequence":"first","affiliation":[{"name":"ING Bank, B-1040 Brussels, Belgium"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Soo-Young","family":"Shin","sequence":"additional","affiliation":[{"name":"Department of IT Convergence Engineering, Kumoh National Institute of Technology, Gumi 39177, Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5253-3488","authenticated-orcid":false,"given":"Tae-Young","family":"Choe","sequence":"additional","affiliation":[{"name":"Department of Computer Engineering, Kumoh National Institute of Technology, Gumi 39177, Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2019,9,10]]},"reference":[{"key":"ref_1","unstructured":"Regenscheid, A., and Scarfone, K. (2011). Recommendations of the National Institute of Standards and Technology, NIST Spec. Publ."},{"key":"ref_2","unstructured":"Crawshaw, J. (2019). Evaluating Cloud Risk for the Enterprise: A Shared Assessments Guide, The Santa Fe Group."},{"key":"ref_3","unstructured":"Ferguson, T. (2019, September 09). Salesforce.com Outage Hits Thousands of Businesses. Available online: https:\/\/www.cnet.com\/news\/salesforce-com-outage-hits-thousands-of-businesses\/."},{"key":"ref_4","unstructured":"(2019, June 19). Threat, Vulnerability, Risk - Commonly Mixed up Terms. Available online: https:\/\/www.threatanalysis.com\/2010\/05\/03\/threat-vulnerability-risk-commonly-mixed-up-terms\/."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Alberts, C., Dorofee, A., Stevens, J., and Woody, C. (2003). Introduction to the OCTAVE Approach, Software Engineering Institute. Technical Report.","DOI":"10.21236\/ADA634134"},{"key":"ref_6","unstructured":"Bediako, T. (2014, January 20). Enterprise Risk Management - Integrated Framework. Proceedings of the ISACA\u2019s IT Audit, Information Security & Risk Insights Africa, Alisa Hotel, Ghana."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"De Hert, P., Papakonstantinou, V., and Kamara, I. (2014). The New Cloud Computing ISO\/IEC 27018 Standard through the Lens of the EU Legislation on Data Protection, IEC. Technical Report.","DOI":"10.2139\/ssrn.2542125"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Catteddu, D. (2009, January 10\u201311). Cloud Computing: benefits, risks and recommendations for information security. Proceedings of the Iberic Web Application Security Conference, Madrid, Spain.","DOI":"10.1007\/978-3-642-16120-9_9"},{"key":"ref_9","unstructured":"Dekker, M., and Dimitra, L. (2015). Cloud Security Guide for SMEs, ENISA."},{"key":"ref_10","unstructured":"Hubbard, D., and Sutton, M. (2010). Top Threats to Cloud Computing v1.0., Cloud Security Alliance."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s13677-015-0037-5","article-title":"Security transparency: The next frontier for security research in the cloud","volume":"4","author":"Ouedraogo","year":"2015","journal-title":"J. Cloud Comput."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Badger, L., Grance, T., Patt-Corner, R., and Voas, J. (2012). Cloud Computing Synopsis and Recommendations, NIST Spec. Publ.","DOI":"10.6028\/NIST.SP.800-146"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Hogan, M., Liu, F., Sokol, A., and Tong, J. (2011). Nist Cloud Computing Standards Roadmap, NIST Spec. Publ.","DOI":"10.6028\/NIST.SP.500-291v1"},{"key":"ref_14","unstructured":"ISACA (2011). IT Control Objectives for Cloud Computing: Controls and Assurance in the Cloud, ISACA."},{"key":"ref_15","unstructured":"Stone, G., and Noel, P. (2015). Cloud Risk Decision Framework, Microsoft. Technical Report."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Fit\u00f3, J.O., Mac\u00edas, M., and Guitart, J. (2010, January 25\u201329). Toward business-driven risk management for cloud computing. Proceedings of the 2010 International Conference on Network and Service Management, Niagara Falls, ON, Canada.","DOI":"10.1109\/CNSM.2010.5691291"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"871","DOI":"10.1007\/s10796-011-9317-x","article-title":"Decision-making in cloud computing environments: A cost and risk based approach","volume":"14","author":"Martens","year":"2012","journal-title":"Inf. Syst. Front."},{"key":"ref_18","unstructured":"(2019, September 09). FICO Xpress Optimization. Available online: https:\/\/www.fico.com\/en\/products\/fico-xpress-optimization."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Fan, C.K., and Chen, T.C. (2012). The risk management strategy of applying cloud computing. Risk Manag., 3.","DOI":"10.14569\/IJACSA.2012.030903"},{"key":"ref_20","unstructured":"Mackita, M. (2016). ERMOCTAVE: A Novel Risk Management Method for Cloud Computing Security. [Master\u2019s Thesis, Kumoh National Institute of Technology]."},{"key":"ref_21","unstructured":"Brunschwiler, C. (2019, June 18). Lean Risk Assessment Based on OCTAVE Allegro. Available online: https:\/\/blog.compass-security.com\/2013\/04\/lean-risk-assessment-based-on-octave-allegro\/."},{"key":"ref_22","first-page":"27","article-title":"Project Risk Management Handbook: A Scalable Approach","volume":"1","author":"Pieplow","year":"2012","journal-title":"Risk"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Baldwin, A., Pym, D., and Shiu, S. (2013). Enterprise information risk management: Dealing with cloud computing. Privacy and Security for Cloud Computing, Springer.","DOI":"10.1007\/978-1-4471-4189-1_8"},{"key":"ref_24","unstructured":"Homer, A., Narumoto, M., Sharp, J., Zhang, H., and Densmore, S. (2013). Building Hybrid Applications in the Cloud on Windows Azure, Microsoft Patterns & Practices."},{"key":"ref_25","unstructured":"Canalys (2019, June 18). Cloud Infrastructure Services Spend up by US$7.2 Billion in Q2 2019, Driven by Cloud Migration. Available online: https:\/\/www.canalys.com\/newsroom\/cloud-market-share-Q2-2019."},{"key":"ref_26","unstructured":"Chappell, D. (2010). Introducing the Windows Azure Platform, David Chappell & Associates."},{"key":"ref_27","unstructured":"Hiles, A. (2002). The Complete Guide to IT Service Level Agreements: Aligning IT Services to Business Needs, Rothstein Associates Inc."},{"key":"ref_28","unstructured":"Topal, B. (2019, June 18). Comparison of Methods of Single Sign-On: Post Authentication Methods in Single Sign on. Available online: https:\/\/people.kth.se\/~maguire\/DEGREE-PROJECT-REPORTS\/160302-BaranTopal-with-cover.pdf."},{"key":"ref_29","first-page":"8","article-title":"Integrate cloud storage with on-premises arrays","volume":"14","author":"Matchett","year":"2015","journal-title":"Storage"},{"key":"ref_30","unstructured":"Alberts, C.J., and Dorofee, A. (2002). Managing Information Security Risks: The OCTAVE Approach, Addison-Wesley Longman Publishing Co., Inc."},{"key":"ref_31","unstructured":"Sterne, B., and Barth, A. (2019, June 19). Available online: https:\/\/www.w3.org\/TR\/CSP1\/."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Karam, Y., Baker, T., and Taleb-Bendiab, A. (2012, January 14\u201316). Security support for intention driven elastic cloud computing. Proceedings of the 2012 Sixth UKSim\/AMSS European Symposium on Computer Modeling and Simulation, Valetta, Malta.","DOI":"10.1109\/EMS.2012.17"},{"key":"ref_33","unstructured":"Rayne Wiselman (2019, August 15). Back up Windows Machines with the Azure Backup MARS Agent. Available online: https:\/\/docs.microsoft.com\/en-us\/azure\/backup\/backup-configure-vault."},{"key":"ref_34","unstructured":"Dafikpaku, E., Eng, M., and Mcmi, M. (2011, January 14\u201316). The strategic implications of enterprise risk management: A framework. Proceedings of the ERM Symposium, Chicago, IL, USA."},{"key":"ref_35","first-page":"79","article-title":"A survey of information security risk analysis methods","volume":"2","author":"Behnia","year":"2012","journal-title":"SmartCR"},{"key":"ref_36","unstructured":"Radack, S. (2011). Managing Information Security Risk: Organization, Mission and Information System View, National Institute of Standards and Technology. Technical Report."}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/11\/9\/195\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T13:18:36Z","timestamp":1760188716000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/11\/9\/195"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,9,10]]},"references-count":36,"journal-issue":{"issue":"9","published-online":{"date-parts":[[2019,9]]}},"alternative-id":["fi11090195"],"URL":"https:\/\/doi.org\/10.3390\/fi11090195","relation":{},"ISSN":["1999-5903"],"issn-type":[{"value":"1999-5903","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019,9,10]]}}}