Threat Modeling for Services in Cloud

Cloud computing offers various services ranging from infrastructure to computation, software and application. These services have gained popularity in both public and enterprise domains, and they process large amount of user data with varying privacy levels. However, due to the dynamic nature of cloud services, many enterprise level security policies, standards and practices cannot be implemented in cloud which leads to different security threats. These threats can be exploited by various attackers to compromise the cloud services. In this paper threat modeling for cloud services has been done by considering various attackers such as hackers, malicious administrators, malicious users and service providers. After describing possible threats to cloud services from these attackers, methodologies to exploit those threats have been presented. Moreover, the generalization of threat model has been done to determine the threats related to a specific service functionality for various attackers in cloud.