Cloud Computing is a flexible, cost-effective, and proven delivery platform for providing business or consumer IT services over the Internet. However, cloud Computing presents an added level of risk because essential services are often outsourced to a third party, which makes it harder to maintain data security and privacy, support data and service availability, and demonstrate compliance. Cloud Computing leverages many technologies (SOA, virtualization, Web 2.0); it also inherits their security issues, which we discuss here, identifying the main vulnerabilities in this kind of systems and the most important threats found in the literature related to Cloud Computing and its environment as well as to identify and relate vulnerabilities and threats with possible solutions.

Cloud computing is a new paradigm that combines several computing concepts and technologies of the Internet creating a platform for more agile and cost-effective business applications and IT infrastructure. The adoption of Cloud computing has been increasing for some time and the maturity of the market is steadily growing. Security is the question most consistently raised as consumers look to move their data and applications to the cloud. We justify the importance and motivation of security in the migration of legacy systems and we carry out an analysis of different approaches related to security in migration processes to cloud with the aim of finding the needs, concerns, requirements, aspects, opportunities and benefits of security in the migration process of legacy systems.

Increasing digitisation in the maritime domain and the intensive use of information technologies have become essential for the effective functioning of systems that manage navigation, communications, sensors and weapons throughout the maritime chain. In this context, the issuance and enforcement of international standards and policies are seeking to mitigate the appearance of threats and vulnerabilities that aim to compromise access to functionalities, on-board systems and network integrity. Thus, in this article, we first review the main proposals for guidelines, frameworks and other solutions related to cybersecurity in the maritime environment. Subsequently, we analyse the way in which cybersecurity challenges specific to systems and equipment in this particular environment are addressed, identifying the main cybersecurity weaknesses and needs in the maritime environment that are not completely addressed. Based on this analysis, we then propose the structure of POSEIDON, a comprehensive framework for managing cybersecurity in maritime environments that addresses the identified gaps. This cybersecurity management framework takes into account existing proposals and is complemented by a set of new elements to provide a comprehensive approach to addressing the weaknesses identified.

The Information Security Management Systems (ISMS) are global and risk-driven processes that allow companies to develop their cybersecurity strategy by defining security policies, valuable assets, controls, and technologies for protecting their systems and information from threats and vulnerabilities. Despite the implementation of such management infrastructures, incidents or security breaches happen. Each incident has associated a level of severity and a set of mitigation controls, so in order to restore the ISMS, the appropriate set of controls to mitigate their damage must be selected. The time in which the ISMS is restored is a critical aspect. In this sense, classic solutions are efficient in resolving scenarios with a moderate number of incidents in a reasonable time, but the response time increases exponentially as the number of incidents increases. This makes classical solutions unsuitable for real scenarios in which a large number of incidents are handled and even less appropriate for scenarios in which security management is offered as a service to several companies. This paper proposes a solution to the incident response problem that acts in a minimal amount of time for real scenarios in which a large number of incidents are handled. It applies quantum computing, as a novel approach that is being successfully applied to real problems, which allows us to obtain solutions in a constant time regardless of the number of incidents handled. To validate the applicability and efficiency of our proposal, it has been applied to real cases using our framework (MARISMA).

The increasing digitisation of Government services poses critical challenges in cybersecurity. Existing security frameworks, despite their proliferation, often fail to effectively integrate interoperability and secure data exchange, nor do they present adaptive risk management, or strategic cybersecurity governance, exposing sensitive information and critical infrastructures to escalating cyber threats. This research addresses this gap by proposing the GAUCHO (Government adaptive unified cybersecurity holistic orchestration) framework, a holistic model that integrates an adaptive risk management methodology based on MARISMA, an interoperability scheme for secure data exchange based on X-Road, and a strategic cybersecurity governance component. The proposal, resulting from a systematic literature review, aims to offer a comprehensive solution for the protection of e-Governments, with a focus on the citizen, sustainability, and regulatory compliance. The GAUCHO framework is presented as a solution with which it seeks to safeguard digital Government environments.

Purpose: The purpose of this paper is that of linking security requirements for web services with security patterns, both at the architectural and the design level, obtaining in a systematic way a web services security software architecture that contains a set of security patterns, thus ensuring that the security requirements of the internet‐based application that have been elicited are fulfilled. Additionally, the security patterns are linked with the most appropriate standards for their implementation.Design/methodology/approach: To develop secure WS‐based applications, one must know the main security requirements specified that applications have to fulfil and find appropriate security patterns that assure, through combination or relationships between them, the fulfilment of the implicated security requirements. That is why a possible link or connection between requirements and patterns will have to be found, attempting to select for a determined security requirement the best security patterns that solve this requirement, thus guaranteeing the security properties for internet‐based applications.Findings: Using security patterns, that drive and guide one towards a secure development as well as towards security software architecture, one can be sure that this design based on these patterns fulfils and guarantees the most important security requirements of the internet‐based applications through the design and implementation of security solutions that provide reliable security services.Practical implications: Security architecture for internet‐based applications and web services can be designed considering the security requirement types that it must fulfil and using the most appropriate security patterns.Originality/value: This paper proposes a relationship between security requirements that can be specified for internet‐based applications and the possible security patterns that can be used in the design and implementation of the secure system based on the internet, guaranteeing that these security requirements are fulfilled.