Federated cloud systems increase the reliability and reduce the cost of the computational support. The resulting combination of secure private clouds and less secure public clouds, together with the fact that resources need to be located within different clouds, strongly affects the information flow security of the entire system. In this paper, the clouds as well as entities of a federated cloud system are assigned security levels, and a probabilistic flow sensitive security model for a federated cloud system is proposed. Then the notion of opacity --- a notion capturing the security of information flow --- of a cloud computing systems is introduced, and different variants of quantitative analysis of opacity are presented. As a result, one can track the information flow in a cloud system, and analyze the impact of different resource allocation strategies by quantifying the corresponding opacity characteristics.

The use of cloud computing (CC) is rapidly increasing due to the demand for internet services and communications. The large number of services and data stored in the cloud creates security risks due to the dynamic movement of data, connected devices and users between various cloud environments. In this study, we will develop an innovative prototype for location-aware access control and data privacy for CC systems. We will apply location-aware access control policies to role-based access control of Cloud Foundry, and then analyze the impact on user privacy after implementing these policies. This innovation can be used to address the security risks introduced by inter-cloud use and communication, and will have significant impact in making citizen's personal data more secure.

Leveraging on the provisions of the internet enhances the productivity of Micro and Small Enterprises (MSEs), increases industrial growth and their contributions to national prosperity. Every cyber-attack against their businesses should be reported to the requisite incident response body through the appropriate channels for quick recovery from attack. This research examines how the MSEs in Nigeria report cybersecurity incidents. This study surveyed 100 MSEs. The outcome of the research shows that 72% of the MSEs is unaware of the channel of reporting cyber incidents and does not report cyber incidents. Participants totaling 90% believe that the Sectoral Computer Security Incident Response Team (CSIRT) could improve on reporting of cybersecurity incidents through sensitisation. Amongst others, we recommended the Sectoral CSIRTs were to develop an Incident Report and Response Plan (IRRP) for managing cybersecurity incidents in MSEs.

Risk assessment (RA) belongs to the core parts of an organizational risk management process. The primary goals of a RA are the identification, estimation and prioritization of risk(s) to organizational operations. The existing quantitative analysis of RA is focusing on the risk factors, that is, threat or vulnerability. However, the quantitative metrics of the assessment have not been formally defined and modeled yet. Consequently, it is essential to define a formal model and relevant security metrics for RA within an organization. In this study, we will use a complete lattice to analyze risk factors. Moreover, a formal model will be defined to describe the RA process. The reachability of the model will be discussed. Quantitative metrics will be defined to provide insight on the risk estimation. The model can be expressed using colored Petri nets. This study can assist chief information security officers analyze security risks in their organizations and help them balance the security budget in their organizations.