Assessing Systemic Risk to Cloud‐Computing Technology as Complex Interconnected Systems of Systems

Yacov Y. Haimes, Barry M. Horowitz, Zhenyu Guo, Eva Andrijcic and Joshua Bogdanor

Systems Engineering, 2015, vol. 18, issue 3, 284-299

Abstract: This paper presents a methodology for modeling cloud‐computing technology (CCT), its users, and, most important, would‐be malicious intruders as complex interdependent and interconnected systems of systems (S‐o‐S). The paper posits and demonstrates that due to the inherent structure of CCT as S‐o‐S, users of public CCT are at a higher risk of unlawful intrusion than users of non‐CCT systems. At the same time, the flexibility and the agility of CCT S‐o‐S provide advantages relative to most non‐CCT S‐o‐S. The need is for the CCT community to employ these advantages as an integral part of its cyber security strategy. Our analysis builds on the following theory and methodology: we consider CCT and its users as complex interconnected hardware and software subsystems that interact as S‐o‐S through shared states, resources, and subsystems, which are connected in series (rather than in parallel, as is the case for most non‐CCT systems); exploiting the serial connectivity of CCT S‐o‐S, we use fault‐tree analysis to demonstrate the resulting unreliability of CCT S‐o‐S; building on the published literature, we incorporate Pareto‐optimal frontiers to compare the risks faced by security‐conscious users of CCT (e.g., large corporations) versus those faced by cost‐conscious users (e.g., small or startup companies); and we show that users of CCT as S‐o‐S are at a higher risk than users of non‐CCT systems for certain assumptions and types of cyber attacks. The paper is structured as follows: Part A outlines the characteristics of CCT S‐o‐S, addresses the inherent vulnerability of CCT S‐o‐S to cyber intrusion and attack, and provides a brief literature review; Part B offers a rationale for modeling CCT as interconnected and interdependent S‐o‐S; Part C demonstrates, through the use of fault‐tree analysis, the higher risk faced by CCT and its users as complex S‐o‐S; Part D presents an economic analysis of the security of CCT as S‐o‐S; and Part E offers conclusions and lessons learned.

Date: 2015
References: View references in EconPapers View complete reference list from CitEc
Citations: View citations in EconPapers (1)

Downloads: (external link)
https://doi.org/10.1002/sys.21303

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:wly:syseng:v:18:y:2015:i:3:p:284-299

Access Statistics for this article

More articles in Systems Engineering from John Wiley & Sons
Bibliographic data for series maintained by Wiley Content Delivery ().