Business-driven management of infrastructure-level risks in Cloud providers

Cloud computing is an innovative and promising paradigm that is leading to remarkable changes in the way inwhich hardware and software are designed and purchased, aswell as how IT systems aremanaged. However, the Cloud is a risky paradigm. For instance, the use of Cloud services, which usually are external assets to their consumers, implies unprecedented risks that must be taken into account. In this paper, we propose the involvement of the risk management discipline into the Cloud computing realm. We present a risk management approach led by business-level objectives (BLOs) of Cloud organizations. Its main goal is to assist in business-driven self-managed Cloud providers, by facing uncertainties always present in their internal decision-making processes. Our Cloud-aware risk management method includes a SEmi-quantitative BLO-driven Cloud Risk Assessment (SEBCRA) as the core subprocess. Its aim is to constantly rank and prioritize risks affecting the governing business-level