Engineering Threat Modelling Tools for Cloud Computing

The rise in the use of cloud computing has also been accompanied by increasing numbers of online security incidents and concern about the overall security of cloud services. Current threat modelling methods, one of the most common ways of identifying threats to systems, are not able to provide a useful remedy to this. The manual threat modelling techniques require experts and can take too long, and the automatic tools are aimed primarily at software developers and do not apply to systems.

This thesis presents the underlying theory for Cloud-COVER (Controls and Orderings for Vulnerabilities and ExposuRes), a threat modelling tool developed to identify threats to cloud computing systems. Cloud-COVER models the system under observation, and determines the priority of threats by using a system of relative preferences provided by the tool user. Cloud-COVER also looks at how threats from individual parts of the system present a danger to other parts of the deployment, identifying ways in which beachhead based attacks can be prevented. Cloud-COVER's model is abstracted in such a way that it is extensible, allowing users to shift the model's perspective to suit their own circumstances.

This work presents a number of major and minor contributions to security and threat modelling. The main contributions of this thesis are an alternative way of ranking threats by using relative preferences, and an extensible model which analyses the way threats can propagate through systems by looking at the permissions given to connections between instances.