Abstract

Cloud computing presents formidable design challenges. Although the utility of cloud computing drove its rapid adoption, its deployment has revealed security shortcomings. These shortcomings, in turn, have created a lack of trust in cloud-based services. We argue that cloud computing must consider security as spanning and responding to the evolving requirements of stakeholder communities, e.g., designers, developers, users, owners, partners, customers, and suppliers. This perspective on security supplants a focus on what must be allowed and disallowed in an information system with a holistic focus on designing and connecting trustworthy services. Specifically, the central goal of achieving quality design is providing peace of mind to stakeholders in the cloud as Trust = Utility + Security. We demonstrate framing design specific to security based on Thriving Systems Theory (TST). TST’s properties provide a vocabulary and taxonomy to inform the alignment of design choices with stakeholders’ intentions. Our demonstration classifies protection mechanisms and protocols that characterize aspects of cloud security based upon the TST design properties they entail. Each aspect is a lens through which stakeholders can clarify their intentions with respect to security and subsequently assess the quality of design and of implementation.