According to the Open Group’s risk taxonomy, vulnerability is the probability that an asset will be unable to resist the
actions of a threat agent. Vulnerability exists when there is a difference between the force being applied by the threat
agent, and an object’s ability to resist that force.Cloud computing causes significant changes in the vulnerability factor.
Of course, moving to a cloud infrastructure might change the attackers’ access level and motivation, as well as the
effort and risk—a fact that must be considered as future work. But, for supporting a cloud-specific risk assessment, it
seems most profitable to start by examining the exact nature of cloud-specific vulnerabilities.