Designing utility functions for game-theoretic cloud security assessment: a case for using the common vulnerability scoring system

In recent years, cloud computing has emerged as a key computing paradigm because of its ubiquitous, convenient and scalable on-demand access to a shared pool of computing resources. Although the use of the cloud has many advantages, a great number of security threats exist affecting assets that are present in a cloud environment. In order to mitigate these threats, frameworks have been developed to asses the security of an organisation, based on analysing risks to critical assets. However, these frameworks are not yet sufficiently developed to specifically address risks in cloud environments. In this paper, we advocate the use of game theory to improve the security assessment of cloud environments, in particular the risk analysis step in OCTAVE. We extend previous game-theoretic models for security risk assessment within cloud environments by designing cost and benefit functions that are to a large extent informed by the Common Vulnerability Scoring System (CVSS).