Trust and Risk Assessment Model of Popular Software Based on Known Vulnerabilities

Abstract

Abstract-This paper presents a new concept of an approach to risk assessment which can be done on the basis of publicly available information about vulnerabilities. The presented approach uses also the notion of trust and implements many concepts used in so called trust and reputation management systems (which are widely used in WSN, MANET or P2P networks, but also in ecommerce platforms). The article shows first outcomes obtained from the presented model. The outcomes demonstrate that the model can be implemented in real system to make software management more quantified and objective process, which can have real and beneficial impact on institutional security. In article, however the emphasis was set not on the model itself (which can be easily changed) but on the possibility of finding useful information about vulnerabilities.

Automatic Actionable Information Processing and Trust Management towards Safer Internet of Things

“…Another not obvious application is the analysis and monitoring of the quality (in the context of cybersecurity) of vendors or their products, which may allow predicting the existence of new unknown vulnerabilities. Such a concept, although not dedicated to the IoT world, can be found in the article [ 6 ]. From the perspective of IoT devices, such prospects can be even more important and more promising.…”

A Novel Approach to National-level Cyber Risk Assessment Based on Vulnerability Management and Threat Intelligence

“…When the cracker finds a new vulnerability (so called "0-day"), they try to exploit it to generate benefits, instead of informing the vendor. Therefore, unknown vulnerabilities are associated with an enormous potential to compromise system security [1]. The vulnerability management system should support the system administrator in two areas.…”

“…Secondly, the vulnerability management system should assess the technical risks associated with the software used. This risk stems from the existing security vulnerabilities [1]. Technical vulnerability databases are very important, but they contain information about well-known vulnerabilities only (mainly those for which patches have been released).…”

“…The CVSS score may vary from 0.0 to 10.0, where values from 0.0 to 3.9 indicate a "low" level of severity, and values from 7.0 to 10.0 mean "high" or "critical" severity. The CVSS result is widely used as an indicator of the severity of vulnerabilities, but not all sources of information list it [1]. Risk calculation will be performed by each client based on the vulnerability database shared by the operational center.…”

“…In addition, new vulnerabilities are still being discovered (with new incidents and IoCs being reported as well). Therefore, risk estimation should be carried out in real-time [1]. The statements given above are true even for individual institutions, but at a higher level (for example -within a given economic sector) the task of risk assessment is significantly more complicated.…”