A quantitative CVSS-based cyber security risk assessment methodology for IT systems

Aksu, M. Ugur; Dilek, M. Hadi; Tatli, Emi̇n İslam; Biçakcı, Kemal; Dirik, H. Ibrahim; Demirezen, Mustafa Umut; Aykir, Tayfun

doi:10.1109/ccst.2017.8167819

Cited by 59 publications

(31 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Zhang [11] proposed the use of conditional probability when performing the risk assessment based on CVSS v3. Aksu [12] defined the risk metrics based on CVSS v3 to calculate the risk of an IT system, similar to vulnerability score calculated under CVSS v3. The above methodologies of risk assessment were mainly proposed for traditional computer networks.…”

Section: Related Workmentioning

confidence: 99%

Vulnerability Modelling for Hybrid IT Systems

Ur-Rehman

Gondal

Kamruzzuman

et al. 2019

2019 IEEE International Conference on Industrial Technology (ICIT)

View full text Add to dashboard Cite

Common vulnerability scoring system (CVSS) is an industry standard that can assess the vulnerability of nodes in traditional computer systems. The metrics computed by CVSS would determine critical nodes and attack paths. However, traditional IT security models would not fit IoT embedded networks due to distinct nature and unique characteristics of IoT systems. This paper analyses the application of CVSS for IoT embedded systems and proposes an improved vulnerability scoring system based on CVSS v3 framework. The proposed framework, named CVSS IoT , is applied to a realistic IT supply chain system and the results are compared with the actual vulnerabilities from the national vulnerability database. The comparison result validates the proposed model. CVSS IoT is not only effective, simple and capable of vulnerability evaluation for traditional IT system, but also exploits unique characteristics of IoT devices.

show abstract

Section: Related Workmentioning

confidence: 99%

Vulnerability Modelling for Hybrid IT Systems

Ur-Rehman

Gondal

Kamruzzuman

et al. 2019

2019 IEEE International Conference on Industrial Technology (ICIT)

View full text Add to dashboard Cite

show abstract

“…The CVSS is supported by the National Vulnerability Database (NVD) of the United States. All CVE vulnerabilities in the NVD contain the basic value of the CVSS [21]. The quantification of the DAS attack probability is closely related to the evaluation indexes of vulnerabilities for all parts of a DAS and plays an important auxiliary role in the quantification of an attack process in the DAS.…”

Section: Cvssmentioning

confidence: 99%

Quantitative Model of Attacks on Distribution Automation Systems Based on CVSS and Attack Trees

Kang

Huang

et al. 2019

Information

View full text Add to dashboard Cite

This study focuses on the problem of attack quantification in distribution automation systems (DASs) and proposes a quantitative model of attacks based on the common vulnerability scoring system (CVSS) and attack trees (ATs) to conduct a quantitative and systematic evaluation of attacks on a DAS. In the DAS security architecture, AT nodes are traversed and used to represent the attack path. The CVSS is used to quantify the attack sequence, which is the leaf node in an AT. This paper proposes a method to calculate each attack path probability and find the maximum attack path probability in DASs based on attacker behavior. The AT model is suitable for DAS hierarchical features in architecture. The experimental results show that the proposed model can reduce the influence of subjective factors on attack quantification, improve the probability of predicting attacks on the DASs, generate attack paths, better identify attack characteristics, and determine the attack path and quantification probability. The quantitative results of the model's evaluation can find the most vulnerable component of a DAS and provide an important reference for developing targeted defensive measures in DASs. these attack quantification results can also provide an important reference for security technicians to implement the DAS defense system.Quantification of the probability of an attack on a DAS directly affects the in-depth analysis of the system's security. Wang et al. [9] proposed a multilevel analysis and modeling method for a power system's communication network. Their case study showed that this method can be used to evaluate the static and dynamic relationships among power networks. Kateb et al. [10] developed an optimal structure tree method for risk assessment in a wide-area power system that can minimize the spread of network attacks. The authors in [9,10] provided a well-optimized evaluation of a specific power network. However, these evaluation neither reflected the attacker's behavior in terms of quantification of the probability of an attack nor provided suggestions for the protection of specific parts of the power system. The authors in [11] and the authors in [12] presented an attack assessment framework based on Bayes attributes-a stochastic game model and a fast modeling method for input data, respectively-which included network connection relationship and vulnerability information. However, the proposed methods were found to be inefficient when applied in DASs due to DAS architecture complexity and expansibility, and they could not generate attack path. The authors in [13] proposed a method for modeling network attacks with a multilevel-layered attack tree (MLL-AT), presented a description language based on the MLL-AT for attacks, and quantified the leaf nodes. This attack tree (AT) was found to be able to accurately model the attacks, especially multilevel network attacks, and can be used to assess system risks. However, the research is mainly based on cyberattacks, and there is no physical attacks involved. Besides, th...

show abstract

“…Similarly to estimate the network security, the CVSS and Attack graph approach is adopted in [5,6]. For cybersecurity assessment the authors in [7,8] implement CVSS. M Aslam et al introduces a security auditing and certification system namely ASArP which is also used CVSS for highlighting the impact of each misconfigured components of the system [9].…”

Section: Motivation and Related Workmentioning

confidence: 99%

Common Vulnerability Scoring System for SDN Environment

Deb¹,

Roy²

2019

IJEAT

View full text Add to dashboard Cite

The identification of component vulnerability is an important criterion for securing the networks and it is an open issue for Software Defined Network (SDN). The First.org provides an open tool namely Common Vulnerability Scoring system for identification of component vulnerability, but there is no distinctive correspondence between CVSS and SDN. With this paper, we try to identify such correspondence so that it will help network researchers to determine the network vulnerability and improve the SDN security soon. This paper also includes a comparison between the last three CVSS versions. For this comparison, one can understand what are the new features CVSS incorporating for identifying new vulnerabilities in the emerging environment

show abstract

A quantitative CVSS-based cyber security risk assessment methodology for IT systems

Cited by 59 publications

References 7 publications

Vulnerability Modelling for Hybrid IT Systems

Vulnerability Modelling for Hybrid IT Systems

Quantitative Model of Attacks on Distribution Automation Systems Based on CVSS and Attack Trees

Common Vulnerability Scoring System for SDN Environment

Contact Info

Product

Resources

About