Security Quantification of Complex Attacks in Infrastructure as a Service Cloud Computing

Doudou Fall, Takeshi Okada, Noppawat Chaisamran, Youki Kadobayoshi, Suguru Yamaguchi

2013

Abstract

It is a truism to single out the inherent security issues of cloud computing as the main hurdle to its adoption. Particularly, infrastructure clouds are composed of multiple components and applications where vulnerabilities are regularly discovered. We propose a probabilistic security quantification method, which allows quantifying the security level of a given Infrastructure as a Service cloud environment. We translate the vulnerable IaaS environment into a vulnerability tree that we built basing on fault tree analysis, which is a well established modeling tool. The analysis of the vulnerability tree leads us to the security quantification formula.

References

  1. chow, R., Golle, P., Jakobsson, M., Shi, E., Staddon, J., Masuoka, R., and Molina, J. (2009). Controlling data in the cloud: Outsourcing computation without outsourcing control. In Cloud Computing Security Workshop. ACM Press.
  2. Mell, P., Scarfone, K., and Romanosky, S. (2007). A complete guide to the common vulnerability scoring system version 2.0. In FIRST. http://www.first.org/cvss/cvss-guide.html.
  3. Pearson, S. and Benameur, A. (2009). Privacy, security and trust issues arising from cloud computing. In 2nd international conference on cloud computing technology and science. IEEE.
  4. Ristenpart, T., Tromer, E., Shacham, H., and Savage, S. (2009). Hey you get out off my cloud: Exploring information leakage in third party compute clouds. In CCS09. ACM.
  5. Takabi, H., Joshi, J. B. D., and Ahn, G.-J. (2010). Security and privacy challenges in cloud environments. In Security and Privacy. IEEE.
  6. Vaquero, L. M., Merino, L. R., and Moran, D. (2011). Locking the sky: a survey on iaas cloud security. In In Journal Computing - Cloud Computing Volume 91 Issue 1. Springer-Verlag.
  7. Zhou, M., Zhang, R., Xie, W., Qiang, W., and A.Zhou (2010). Security and privacy in cloud computing: A survey. In 6th International Conference on semantics, Knowledge and grids.
Download


Paper Citation


in Harvard Style

Fall D., Okada T., Chaisamran N., Kadobayoshi Y. and Yamaguchi S. (2013). Security Quantification of Complex Attacks in Infrastructure as a Service Cloud Computing . In Proceedings of the 3rd International Conference on Cloud Computing and Services Science - Volume 1: CLOSER, ISBN 978-989-8565-52-5, pages 145-148. DOI: 10.5220/0004406601450148


in Bibtex Style

@conference{closer13,
author={Doudou Fall and Takeshi Okada and Noppawat Chaisamran and Youki Kadobayoshi and Suguru Yamaguchi},
title={Security Quantification of Complex Attacks in Infrastructure as a Service Cloud Computing},
booktitle={Proceedings of the 3rd International Conference on Cloud Computing and Services Science - Volume 1: CLOSER,},
year={2013},
pages={145-148},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0004406601450148},
isbn={978-989-8565-52-5},
}


in EndNote Style

TY - CONF
JO - Proceedings of the 3rd International Conference on Cloud Computing and Services Science - Volume 1: CLOSER,
TI - Security Quantification of Complex Attacks in Infrastructure as a Service Cloud Computing
SN - 978-989-8565-52-5
AU - Fall D.
AU - Okada T.
AU - Chaisamran N.
AU - Kadobayoshi Y.
AU - Yamaguchi S.
PY - 2013
SP - 145
EP - 148
DO - 10.5220/0004406601450148