# Towards a Security Stress-Test for Cloud Configurations

arXiv: https://arxiv.org/abs/2205.14498 · HTML: https://mlsanity.com/paper/2205.14498/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 May 2022.

## Built on by (most cited first, 1 of 1)

- [A set of semantic data flow diagrams and its security analysis based on ontologies and knowledge graphs](https://mlsanity.com/paper/2303.11198/) (2023)

## Abstract (arXiv)

Securing cloud configurations is an elusive task, which is left up to system administrators who have to base their decisions on ``trial and error'' experimentations or by observing good practices (e.g., CIS Benchmarks). We propose a knowledge, AND/OR, graphs approach to model cloud deployment security objects and vulnerabilities. In this way, we can capture relationships between configurations, permissions (e.g., CAPSYSADMIN), and security profiles (e.g., AppArmor and SecComp), as first-class citizens. Such an approach allows us to suggest alternative and safer configurations, support administrators in the study of what-if scenarios, and scale the analysis to large scale deployments. We present an initial validation and illustrate the approach with three real vulnerabilities from known sources.