A Risk Assessment Study: Encircling Docker Container Assets on IaaS Cloud Computing Topology.pdf

International Conference of Cloud and Internet of Things 2023 - Portugal, slide

1. For the Glory of the Nation
6th Conference on Cloud and Internet of Things
March 20-22, 2023
A Risk Assessment Study:
Encircling Docker
Container Assets on IaaS
Cloud Computing
Topology
Mohammad Hafiz Hersyah
Nara Institute of Science and
Technology

2. For the Glory of the Nation
Cloudis
synonymously
embedded in
virtualization
technology and one
of the most
versatile pioneers
that have brought
focal points on the
global stage
Container orchestration is a veritable
case of how to secure and
manages a lifecycle that is
able to provide automation
in deploying multiple tasks.
The ultimate aspect
for business customers
is the provision of
guarantees to certify
an exceptional level of
IT security for numerous
IT components
Introduction

3. For the Glory of the Nation
Thearticulateutilizationofdocker
containerassetsinCloudComputing
isonestrategicpivotalaspectofthe
underlyingrationaleforcustomersto
conjectureontheirventures.
Introduction

4. For the Glory of the Nation
Introduction (2)
Thefurtherdevelopmentoftheseinformation- basedtechniquesmeans
thegreaterextentofenterprisesconstitutesapproachestoboost
efficiencyandcompetitiveness.However,[4-7]quarreledthatsuch
advancementwouldengageattacktechniquesthatescorttosecurity
breachesinovertakingitsresourcestoconductillegalactivities.
Q. Hong et al., ”An information security risk assessment method based on conduct effect and dynamic threat,” 2017 8th IEEE International
Conference on Software Engineering and Service Science (ICSESS), 2017, pp. 782-786, DOI: 10.1109/ICSESS. 2017.8343029.
M. T. Riaz, M. Shah Jahan, K. S. Arif, and W. Haider Butt, ”Risk Assessment on Software Development using Fishbone Analysis,” 2019
International Conference on Data and Software Engineering (ICoDSE), 2019, pp. 1-6, DOI: 10.1109/ICoDSE48700.2019.9092727.
J.Menezes, C. Gusm ̃ao, and H. Moura, ”Risk factors in software development projects: a systematic literature review,” Software Quality
Journal, November 07, 2018
Klipper, S. (2011). ISO/IEC 27005. In: Information Security Risk Management. Vieweg+Teubner. https://doi.org/10.1007/97838348987083

5. For the Glory of the Nation
•Resolving a specific risk assessment calculation methodology for
docker container infrastructure.
•Administer experimentation with the proposed risk calculation
methodology and investigate the risk rating score.
•Recommends a series of Risk Treatment on Both Cloud Service
Provider and Cloud Service Customer to lower the risk rating to an
acceptable level
Contribution

6. For the Glory of the Nation
Proposed Risk
Assessment

7. For the Glory of the Nation
This section utilizes a threat group called
TeamTNT, which has targeted cloud and
containerized environments by deploying XMRig
and using RainbowMiner and lolMinerDocker
images to mine cryptocurrency
PROPOSED RISK
ASSESSMENT
EXPERIMENTATION

8. For the Glory of the Nation
Combinesassetsbycalculatingtheaverageof
theelementsofCIAscoresusingAHP
(AnalyticHierarchyProcess)andAsset
valuationusingapartialdependencymatrix.
Active Assets Value -
AAV

9. For the Glory of the Nation
AHP (Analytic Hierarchy Process) and Partial Dependency Matrix

10. For the Glory of the Nation
Active Assets Value -AAV

11. For the Glory of the Nation
Identifying threat sources is the first thing to do in
Active Threat Impact to estimate the scales in
threat impact using a portion of E-Bios Risk
Manager and CVSS (The Common Vulnerability
Scoring System) scores
Active Threat
Impact -ATI

12. For the Glory of the Nation
Active Threat
Impact -ATI

13. For the Glory of the Nation
Vulnerability in this paper assumes that the impact
and exploitability from the adversary party merge
with a summary of the average from adversary
intent (Ai), adversary capability (Ac), and
adversary targetting(At).
Active Vulnerability
Value - AVV

14. For the Glory of the Nation
Active Vulnerability Value -AVV

15. For the Glory of the Nation
RiskRating
and
Treatments
This Photoby Unknown Author is licensed under CC BY-SA

16. For the Glory of the Nation
Toreducetheriskratingtoanacceptablelevel(Low)witha
thresholdvalueof2.0,dependingontheactivethreatimpact,a
preventativeand/alsomitigationshouldbedevisedtocounterit
properly.Therisktreatmentshouldalsorefertotheriskappetite
anddecidethe”4T”activitiesthatrepresentitwiththethreat
impact:“Tolerate-Treat-Transfer–Terminate”.
Risk Rating

17. For the Glory of the Nation
Risk Treatments

18. For the Glory of the Nation