A Risk Model for Cloud Processes

Traditionally, risk assessment consists of evaluating the probability of fearedevents, corresponding to known threats and attacks, as well as these events severity, corresponding to their impact on one or more stakeholders. Assessingrisks of cloud-based processes is particularly difficult due to lack of historicaldata on attacks, which has prevented frequency-based identification oftypical threats and attack vectors. Also, the dynamic, multi-party natureof cloud-based processes makes severity assessment very dependent on theparticular set of stakeholders involved in each process execution. In this paper,we tackle these problems by presenting a novel, process-oriented quantitativerisk assessment methodology aimed at disclosure risks on cloud computingplatforms. Key advantages of our methodology include (i) a fully quantitativeand iterative approach, which enables stakeholders to compare alternativeversions of cloud-based processes (e.g., with and without security controls)(ii) non-frequency-based probability estimates, which allow analyzing threatsfor which a detailed history is not available (iii) support for quick visualcomparisons of risk profiles of alternative processes even when impact cannotbe exactly quantified.