II. RELATED WORK
Previous studies [6][7][8][33] [34] have attempted to determine
cloud security issues. Popović et al.’s [34] study on cloud
security controls and standards has been focused primarily at
the provider end and concentrated on cloud engineering.
Subashini and Kavitha [6] present a survey of the different
security risks to the cloud. This study is specific to the security
issues due to the cloud service delivery models. Kamongi et. al.
[33] have also developed a risk model for the cloud but haven’t
tied it with existing compliance standards. How many cloud
providers are adapting the cloud security standards in [2], [1]
and are capable of handling potential threats remains an open
question, and potential source of concerns to consumers who
have to select between these providers.
NIST’s cloud computing reference architecture [2][11]
classifies security and privacy policies under the purview of themodel is applicable across all the roles in the reference
architecture. Security controls used to protect a cloud
environment are the same for all cloud delivery models.
Compliance standards are applied on these security controls.
The IT compliance model [3] focuses on electronic data
processing, network and IT infrastructure. Compliance models
implement rules and regulations across various components of
IT to make them work harmoniously. Organizations often adopt
a security control based on these compliance models.
Transparency amongst the cloud service model, security
controls and the compliance model will help consumers and end
users achieve reliable cloud data protection.
We used the Web Ontology Language (OWL) [32] to develop
our ontology for Cloud security controls, threats and
compliances, which is described briefly in section IV.