Cloud Adversarial Vectors, Exploits, and Threats (CAVEaT™): An Emerging Threat Matrix for Industry Collaboration

An array of threat-based cybersecurity models and associated knowledge bases exist to inform cloud security practitioners. However, the rapid development of cloud technologies and service offerings creates a knowledge lag that prevents the timely delivery of security solutions. The industry needs a threat-informed framework that addresses the unique and emerging risks of cloud environments, with detailed security guidance to ensure meaningful implementation of detection and mitigation capabilities. CSA and the MITRE Corporation have established the Cloud Adversarial, Vectors, Exploits, and Threats (CAVEaT™) collaboration to bring this guidance to the cloud security practitioner. 

This publication explores today’s available frameworks with relevance to cloud systems, including CVE, CWE, MITRE ATT&CK, and CAPEC. It then proposes a course of action to advance the state of the art in threat-informed security by collaborating with cloud service providers, international security researchers, and leading subject matter experts.