Visible to the public Biblio

Filters: Keyword is AND/OR graphs  [Clear All Filters]
2023-01-13
Minna, Francesco, Massacci, Fabio, Tuma, Katja.  2022.  Towards a Security Stress-Test for Cloud Configurations. 2022 IEEE 15th International Conference on Cloud Computing (CLOUD). :191–196.
Securing cloud configurations is an elusive task, which is left up to system administrators who have to base their decisions on "trial and error" experimentations or by observing good practices (e.g., CIS Benchmarks). We propose a knowledge, AND/OR, graphs approach to model cloud deployment security objects and vulnerabilities. In this way, we can capture relationships between configurations, permissions (e.g., CAP\_SYS\_ADMIN), and security profiles (e.g., AppArmor and SecComp). Such an approach allows us to suggest alternative and safer configurations, support administrators in the study of what-if scenarios, and scale the analysis to large scale deployments. We present an initial validation and illustrate the approach with three real vulnerabilities from known sources.