Data-Driven Threat Analysis for Ensuring Security in Cloud Enabled Systems

Area of Science:

• Computer Science
• Information Security
• Cloud Computing

Background:

• Cloud computing offers significant business advantages like flexibility and scalability.
• However, cloud environments face complex security threats across data, applications, infrastructure, and services.
• Existing threat modeling methods struggle to analyze and prioritize data-specific risks in cloud systems.

Purpose of the Study:

• To introduce a novel data-driven threat analysis (d-TM) approach for cloud-based systems.
• To address the limitations of current methods in analyzing and prioritizing data-related threats.
• To provide a systematic framework for cloud security threat assessment.

Main Methods:

• The proposed data-driven threat analysis (d-TM) integrates data from management, control, and business levels.
• It analyzes threats across three data phases: storage, processing, and transmission.
• The approach maps attack surfaces from user agents to cloud service providers based on threat layers.

Main Results:

• The d-TM approach identified four critical threats among seven potential risks in a cloud use case.
• Threats primarily targeted management and business data.
• Specific focus was placed on data in the processing and transit phases.

Conclusions:

• The novel d-TM approach effectively identifies and prioritizes data-centric threats in cloud environments.
• This method enhances the security of cloud services by providing a holistic data perspective.
• d-TM offers a systematic way to manage cloud security risks, particularly concerning data.