The field of transportation is vital for maintaining connectivity, facilitating trade, and ensuring the functioning of a country. In the present era, entities such as the Department of Transportation (DoT) have increasingly integrated IT technology, particularly the Internet of Things (IoT) devices, into their operations. IoT devices have become pivotal and extensively utilized in the transportation sector. However, it is important to recognize that no IoT device is exempt from potential risks. This paper aims to establish a comprehensive risk management (RM) framework and conduct a business impact analysis (BIA) with respect to safeguarding critical IoT infrastructure within a transportation-related context. Therefore, the primary objective of this research is to enhance the security and resilience of IoT devices within the transportation sector by implementing a proactive risk management approach. By prioritizing risk mitigation and developing a comprehensive plan for data protection and recovery, the DoT and other transportation entities can ensure the uninterrupted operation of their IoT infrastructure, thereby maximizing the benefits of IoT technology while minimizing potential risks.

Despite numerous advantages that cloud computing offer (e.g., Flexibility, elasticity, scalability, etc.), many potential clients are still hesitant to join the cloud due to their security and privacy concerns. Outsourcing the data to a cloud in a multitenant environment brings many security challenges including data leaks, threats, and malicious attacks. The cloud computing platform, virtual servers, and the provider's services are highly dynamic and diverse in nature, making the traditional access control mechanisms (e.g., Firewalls and VLAN etc.) less effective in controlling the unauthorized access to cloud's data and resources. Several access control policies and authorization system have been proposed in literature to defend against cloud security threats. Most of these systems are designed to work with one or more access control policies. However, little work has been done to develop generic access control architecture capable to work with most of the available access control policies. In this paper, we present a new access control architecture using a global resource management system (GRMS) to effectively handle both local and remote access requests. The introduction of GRMS makes our proposed architecture semi distributed at the expense of minimal request-response time. In addition, our proposed architecture works effectively with both peered access control module (PACM) and virtual resource manager (VRM) to protect and manage all resources and services of cloud providers from unauthorized access.

The confidentiality and verification of customer's data at the cloud service provider (CSP) side becomes a critical issue in terms of both reliability (i.e., the trust aspect) and efficiency (i.e., the ease of performing such verifications). As data owners no longer physically possess their data storage, traditional cryptographic primitives for the purpose of data security protection cannot be directly adopted. In such a scenario, the use of a third-party auditor (TPA) provides both efficiency, transparency, and the fairness in performing the required auditing tasks as well as it serves as a bridge between the cloud service users (CSUs) and the CSPs. Thus, for practical use, it seems more rational to equip the verification capabilities with public auditability, which is expected to play a more important role in achieving economies of scale for cloud computing. Although the use of TPA provides several advantages, the fact that TPA is an untrusted entity and it can turn into a malicious user or promote insider threats cannot be ignored. Thus, for a complete realistic security solution where CSUs achieve maximum cloud benefits at minimum computational cost, the auditing of TPA is required. In this paper, we develop an auditing method for CSUs/CSPs to ensure the integrity of the TPA and minimize the possibility of insider threats or malicious activities. The integrity of TPA will be verified using the time-released session keys and the service level agreement (SLA).