  Cloud computing has been adopted widely, providing on-demand computing
resources to improve perfornance and reduce the operational costs. However,
these new functionalities also bring new ways to exploit the cloud computing
environment. To assess the security of the cloud, graphical security models can
be used, such as Attack Graphs and Attack Trees. However, existing models do
not consider all types of threats, and also automating the security assessment
functions are difficult. In this paper, we propose a new security assessment
tool for the cloud named CloudSafe, an automated security assessment for the
cloud. The CloudSafe tool collates various tools and frameworks to automate the
security assessment process. To demonstrate the applicability of the CloudSafe,
we conducted security assessment in Amazon AWS, where our experimental results
showed that we can effectively gather security information of the cloud and
carry out security assessment to produce security reports. Users and cloud
service providers can use the security report generated by the CloudSafe to
understand the security posture of the cloud being used/provided.
