Assessing Systemic Risk to Cloud-Computing Technology as Complex Interconnected Systems of Systems

Introduction: Cloud Computing Technology (CCT) can exist in many forms and is fundamentally a complex system-of-systems. In PART II of this report, we proved theoretically through a fault tree analysis that users of cloud computing systems are more at risk than users of non-cloud computing systems, given similar system configurations. In PART III, we demonstrate the above conclusion with a physical mini-cloud computing system. Our research approach consists of two parts: 1) building a physical mini-cloud system; 2) designing experiments on the mini-cloud system to explore vulnerabilities and test intrusion methods unique to cloud computing systems. Using a mini-cloud computing system as a case study allows us to apply general conclusions on the risk to CCT associated with a specific software/hardware system that is common in industry. We implemented a small-scale private cloud computing system based on OpenStack as a case study for this project.