Threat Modeling and Risk Analysis for Cloud Deployments

Abstract

Today, most of the solutions and applications are migrated to cloud platforms. All the cloud service providers (CSP) employ a shared responsibility model. This means the cloud providers are responsible for the security “of the cloud” and the customers are responsible for the security “in the cloud.” Based on research it is stated that 95% of cloud security breaches are because of user misconfigurations. Cloud security almost entirely depends on the consumers configuring and using the cloud platform. Thus, it is important to understand the threat landscape of cloud implementations, the risks involved, and ways to remediate them. One of the earliest and most important processes is threat modeling. This process helps in analyzing the cloud architecture, identifying security threats, evaluating risks, and prioritizing remediation efforts. This chapter describes how to apply some of the popular threat modeling frameworks to access cloud architectures.