Security Quantification of Complex Attacks in Infrastructure as a Service Cloud Computing

It is a truism to single out the inherent security issues of cloud computing as the main hurdle to its adoption. Particularly, infrastructure clouds are composed of multiple components and applications where vulnerabilities are regularly discovered. We propose a probabilistic security quantification method, which allows quantifying the security level of a given Infrastructure as a Service cloud environment. We translate the vulnerable IaaS environment into a vulnerability tree that we built basing on fault tree analysis, which is a well established modeling tool. The analysis of the vulnerability tree leads us to the security quantification formula.