Triangulation Theory: an Approach to Mitigate Governance Risks in Clouds

Cloud computing is a business concept that delivers technology “as a service”. Its lower cost of operation is the main economic driver for consumers and enterprises. The major obstruction to its adoption is security and governance risks inherent in its transnational nature. These risks are associated with relative change of governance level within the cloud service layers during the relationship between the customer and cloud provider in public cloud computing (PCC). The responsibility and authority of both the entities differs in each layer bifurcating influence of due care and due diligence. The existing internationally recognized security standards International Organization for Standardization (ISO 27001/2), Control Objectives for Information and Related Technology (COBIT) etc do not handle cloud computing domains from every aspect. Similarly, due to transnational nature of PCC, legislative acts of one country cannot get dejure recognition in different jurisdiction. These variations incapacitate PCC from achieving assurance and governance level to sustain cloud security. The paper will present a theoretical model to develop common criteria using triangulation of service layers, security standards and statutory laws, essential to maintain governance and security. Keywords-Governance, Cloud Computing, Security, Assurance