Vulnerability Management Models Using a Common Vulnerability Scoring System

Abstract

Vulnerability prioritization is an essential element of the vulnerability management process in data communication networks. Accurate prioritization allows the attention to be focused on the most critical vulnerabilities and their timely elimination; otherwise, organizations may face severe financial consequences or damage to their reputations. In addition, the large amounts of data generated by various components of security systems further impede the process of prioritizing the detected vulnerabilities. Therefore, the detection and elimination of critical vulnerabilities are challenging tasks. The solutions proposed for this problem in the scientific literature so far—e.g., PatchRank, SecureRank, Vulcon, CMS, VDNF, or VEST—are not sufficient because they do not consider the context of the organization. On the other hand, commercial solutions, such as Nessus, F-Secure, or Qualys, do not provide detailed information regarding the prioritization procedure, except for the scale. Therefore, in this paper, the authors present an open-source solution called the Vulnerability Management Center (VMC) in order to assist organizations with the vulnerability prioritization process. The VMC presents all calculated results in a standardized way by using a Common Vulnerability Scoring System (CVSS), which allows security analysts to fully understand environmental components’ influences on the criticality of detected vulnerabilities. In order to demonstrate the benefits of using the the open-source VMC software developed here, selected models of a vulnerability management process using CVSS are studied and compared by using three different, real testing environments. The open-source VMC suite developed here, which integrates information collected from an asset database, is shown to accelerate the process of removal for the critical vulnerabilities that are detected. The results show the practicability and efficacy of the selected models and the open-source VMC software, which can thus reduce organizations’ exposure to potential threats.

Support for the Vulnerability Management Process Using Conversion CVSS Base Score 2.0 to 3.x

“…A notable reduction of the final CVSS 3.x accuracy when compared with the individual components resulted from the fact that the final value of the CVSS 3.x was calculated using mathematical formulas linking the eight vector components. Finally, we note that the described ML-based solution can be applied to replace the CVSS 2.0 standard with the CVSS 3.x one during the vulnerability management process in vulnerability management centres [ 22 ]. This is important because, using the newer CVSS 3.x standard, it is possible to more accurately estimate the level of asset security, especially when taking into account the context of a particular organisation environment.…”

“…Further, it is known that the CVSS 2.0 does not provide an accurate measure of IT infrastructure security, because the Target Distribution ( ) parameter underestimates the assessment of all detected vulnerabilities. The CVSS 3.x standard, on the other hand, gives a more accurate assessment of threats’ criticality including organisation context, which directly translates into a higher level of protection against hacker attacks [ 18 , 22 ]. Summarising, there are clear benefits to using the newer 3.x standard.…”

C3S-TTP: A Trusted Third Party for Configuration Security in TOSCA-Based Cloud Services

“…For this, they rely on the evidence collected from the cloud service providers, and determine the level of trust with respect to the infrastructure of a given provider, and quantify its capability to comply with the expected security policy. The authors of [22] also evaluate the risk associated to each cloud environment based on a quantification and classification of vulnerabilities inherent to the environment. Approaches, such as [23], target orchestrating security chains, including firewalls and intrusion detection systems, in order to protect cloud resources.…”

Untitled

“…Conversely, vulnerability management includes continuous reporting, remediation, and evaluation procedures (Walkowski et al, 2021). The first step of the assessment process involves determining and categorizing the IT infrastructure's vulnerabilities.…”