Multi-criteria Decision Making Model for Vulnerabilities Assessment in Cloud Computing regarding Common Vulnerability Scoring System

Vulnerability is associated with the probability of resistance of actions of a threat. A vulnerability exists when a force of threat exceeds the capacity of resistance. Virtualization and its exclusive architecture have numerous features and advantages over non-conventional virtual machines. However, this new uniqueness creates new vulnerabilities and attacks on a cloud system. Assessing the security of software services on Cloud is complex because the security depends on the vulnerability of infrastructure, platform and software services. In 2017, over 14,000 new vulnerabilities were disclosed, so, a key question for administrators is which vulnerabilities to prioritize. The Common Vulnerability Scoring System (CVSS) is often used to decide which vulnerabilities pose the greatest risk. CVSS V3 creates a metric for each vulnerability and establishes a very broad definition of vulnerabilities, therefore, multi-criteria decision making (MCDM) is necessary to making a choice of the best alternative from among a finite set of decision alternatives in terms of multiple criteria. We propose a model for the evaluation and prioritization of vulnerabilities in cloud architectures based on the Common Vulnerability Scoring System and multi-criteria decision making.

I. Introduction

Cloud computing (CC) refers to applications delivered as services over the Internet and, hardware and software in the data centers that provide those services [1]. While there are a number of definitions of “CC” we adopted National Institute of Standards and Technology (NIST) definition: “A model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g. networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction” [2]. CC is a special technological paradigm that may revolutionize how organizations use Information and communication technology (ICT) by facilitating the delivery of all technology as a service [3]. Since the popularization of the term in 2006, cloud computing has evolved to become the top technology priority for organizations worldwide [4]. ICT improvements render CC both an effective and cost-efficient platform for Small and medium-sized enterprises (SMEs) [5]. The majority of studies have focused on large organizations, with little attention paid to SMEs. [6].