Cloud computing has the benefit of offering scalability and efficiency, as well as cost-effectiveness. However, the existence of security breaches exacerbates the reluctance of potential users to host their sensitive data and services on the cloud. Indeed, the intrinsic characteristics of cloud infrastructures prevent the use of traditional security policy engineering frameworks. The dynamic context in which services and applications are implemented on the cloud does not support previously developed security risk management process.

This paper proposes a novel game-theoretic model that models the trade-off between the effectiveness of the adaptive risk treatment and the cost resulting from the execution of the selected security mechanisms. The objective is to implement dynamic security policies that adapt to the dynamic nature of the cloud.