Towards a Security Stress-Test for Cloud Configurations. (arXiv:2205.14498v2 [cs.CR] UPDATED)

Securing cloud configurations is an elusive task, which is left up to system
administrators who have to base their decisions on “trial and error”
experimentations or by observing good practices (e.g., CIS Benchmarks). We
propose a knowledge, AND/OR, graphs approach to model cloud deployment security
objects and vulnerabilities. In this way, we can capture relationships between
configurations, permissions (e.g., CAP_SYS_ADMIN), and security profiles
(e.g., AppArmor and SecComp), as first-class citizens. Such an approach allows
us to suggest alternative and safer configurations, support administrators in
the study of what-if scenarios, and scale the analysis to large scale
deployments. We present an initial validation and illustrate the approach with
three real vulnerabilities from known sources.