Collaborative Global Impact Cloud Computing Risk Assessment Framework

摘要

Currently, risk assessment is more of an art than a science. In this paper, we demonstrate how a previously proposed theoretical risk assessment framework that focuses on making risk assessment more scientific can be implemented and applied to cloud networks. Our work offers a practical risk assessment implementation for cloud networks where disparate network owners can directly measure network risks in an objective, uniform and repeatable manner across networks by allowing the network owners to collaboratively agree on risk metrics and continuously monitor their cloud networks with the same tool, which employs these agreed upon metrics. The end result is a science-based risk metric (SBRM) based on the global impact of the vulnerabilities in the network. Specifically, we demonstrate the feasibility of implementing this SBRM by: (1) imposing real vulnerabilities on realistic cloud networks built from real hardware (multi-core 3 Ghz Xeon Deterlab servers), (2) demonstrating the operational use of our risk assessment implementation to measure risk across several emulated cloud networks, and (3) describing our approach.