Cloud Enterprise Dynamic Risk Assessment (CEDRA): a dynamic risk assessment using dynamic Bayesian networks for cloud environment

• Main Authors: Al-Begain, K. (Author), Behbehani, D. (Author), Komninos, N. (Author), Rajarajan, M. (Author)
• Format: Article
• Language: English
• Published: Springer Science and Business Media Deutschland GmbH 2023
• Subjects: Bayesian networks; Cloud environments; Cloud risk assessment; Cloud-computing; COVID-19; Decision making; Digital strategies; Dynamic Bayesian Network; Dynamic Bayesian networks; Dynamic risk assessments; Enterprise dynamics; Finance; Financial loss; Losses; Quantitative risk analysis; Quantitative risk-analysis; Risk analysis; Risk assessment; Risks assessments
• Online Access: View Fulltext in Publisher; View in Scopus

 Cloud computing adoption has been increasing rapidly amid COVID-19 as organisations accelerate the implementation of their digital strategies. Most models adopt traditional dynamic risk assessment, which does not adequately quantify or monetise risks to enable business-appropriate decision-making. In view of this challenge, a new model is proposed in this paper for assignment of monetary losses terms to the consequences nodes, thereby enabling experts to understand better the financial risks of any consequence. The proposed model is named Cloud Enterprise Dynamic Risk Assessment (CEDRA) model that uses CVSS, threat intelligence feeds and information about exploitation availability in the wild using dynamic Bayesian networks to predict vulnerability exploitations and financial losses. A case study of a scenario based on the Capital One breach attack was conducted to demonstrate experimentally the applicability of the model proposed in this paper. The methods presented in this study has improved vulnerability and financial losses prediction. © 2023, The Author(s).