How to assess the risks of cloud malware