Security Risk Quantification Mechanism for Infrastructure as a Service Cloud Computing Platforms

Abstract

Cloud computing has revolutionized information technology, in that It allows enterprises and users to lower computing expenses by outsourcing their needs to a cloud service provider. However, despite all the benefits it brings, cloud computing raises several security concerns that have not yet been fully addressed to a satisfactory note. Indeed, by outsourcing its operations, a client surrenders control to the service provider and needs assurance that data is dealt with in an appropriate manner. Furthermore, the most inherent security issue of cloud computing is multi-tenancy. Cloud computing is a shared platform where users' data are hosted in the same physical infrastructure. A malicious user can exploit this fact to steal the data of the users whom he or she is sharing the platform with. To address the aforementioned security issues, we propose a security risk quantification method that will allow users and cloud computing administrators to measure the security level of a given cloud ecosystem. Our risk quantification method is an adaptation of the fault tree analysis, which is a modeling tool that has proven to be highly effective in mission-critical systems. We replaced the faults by the probable vulnerabilities in a cloud system, and with the help of the common vulnerability scoring system, we were able to generate the risk formula. In addition to addressing the previously mentioned issues, we were also able to quantify the security risks of a popular cloud management stack, and propose an architecture where users can evaluate and rank different cloud service providers.

Comprehending Security through Shannon’s Communication Model

“…However, the operation record Y′ will not always equal the operation plan X′ due to incidents from risks. Mutual information for security can be defined in the same way as (9), (10) and can be used to evaluate an operation. H Security (X′), defined in (7) or (8), is the entropy inside the operation plan, and H Security (X′|Y ′) is the entropy due to the uncertainty in the actual operation, independent from the operation plan.…”

“…Although quantitative evaluation methods on security have been proposed for specific domains such as information infrastructure [8][9][10][11], building crime prevention [12,13], energy supplies [14,15], and food security [16], these conditional quantitative evaluation metrics are domain-limited and are not suitable for a holistic evaluation of security. In addition, although various metrics for safety [17], such as STAMP or STPA, have been developed in the field of safety engineering, they assume that the main objective of these metrics is safety.…”

Cloud-Based Business Process Security Risk Management: A Systematic Review, Taxonomy, and Future Directions

“…We also excluded papers whose major contributions were centered on security risk management in the cloud, namely, "Something-as-a-Service". Examples include the following works: "A security as a service solution for the application in the cloud computing environment," by Chen et al [63], "Security in the cloud: understanding the risks of cloud as a service," by Peake [64], "On cloud security attacks: a taxonomy and intrusion detection and prevention as a service" by Iqbal et al [65], "Security risk quantification mechanism for infrastructure as a service in cloud computing platforms," by Fall et al [66]. Others include: Tang and Liu [9], Hussain and Abdul Salam [67], Senk [68], Al-Qurishi [69], Duan [70], Karadsheh [71], Elsayed and Zulkernine [72], and Benlian and Hess [73].…”