IEEE Access

An Integrated Knowledge Graph to Automate Cloud Data Compliance

Karuna Pande Joshi, Lavanya Elluri, and Ankur Nagar

November 1, 2020

To address data protection concerns, authorities and standards bodies worldwide have released a plethora of regulations, guidelines, and software controls to be applied to Cloud data. As a result, service providers maintaining their end-user’s private attributes have seen a surge in compliance requirements. Since most of these regulations are not available in a machine-processable format, it requires significant manual effort to adhere to them. Often many of the laws have overlapping rules, but as they are not referencing each other, providers must duplicate efforts to comply with each regulation. We have done a detailed study of all the data protection regulations that apply to Cloud data. We have developed an integrated, semantically rich knowledge graph that captures these various data compliance regulations. It includes the data threats and security controls that are needed to mitigate the risks. In this paper, we present this knowledge graph in detail, along with the system that we have developed to evaluate it. We have validated our knowledge graph against the privacy policies of various Cloud service providers like Amazon, Google, IBM, and Rackspace. This knowledge graph is available in the public domain and can be used by organizations to automate their compliance processes and set their enterprise Cloud security policies.

BibTeX OWL Tweet Scholar

Tags: cloud computing, cloud security models, cloud security, security compliance models, security domains

Type: Article

Publisher: IEEE

Organization: IEEE

Volume: 8

Downloads: 688 downloads