Security risk analysis as a service

New features proposed in emerging cloud computing, such as multi-tenancy, raises many security challenges against the full adoption of the new paradigm. A critical aspect of the security issues in cloud computing is the limited knowledge of cloud users regarding technical security mechanism for identifying and protecting services from potential risks. In this paper, we propose a framework for security risk analysis that is capable of analyzing the security of virtual machines(VMs), finding the critical vulnerabilities and then producing a set of security recommendations for use by the cloud deployer. Our framework reduces the need for users to possess technical knowledge in handling possible security risk and allows analysis to be charged as a service. This paper develops a Security Risk Analysis as a Service (SRAaaS) framework that assesses all VMs and cloud services against possible attacks using attack graphs to represent and analyze the system.