Application of quantitative security measurement model for prioritisation of vulnerability mitigation: a real case study. (2016)

• Record Type: Journal Article
• Authors: Tripathi, Anshu; Singh, Umesh Kumar
• Is Part Of: International journal of information and computer security. Volume 8:Number 4(2016)
• Page Start: 309
• Page End: 329
• Publication Date: 2016
• Subjects: quantitative security measurement -- security metrics -- vulnerability mitigation -- case study -- security management -- network security -- campus networks; Computer security -- Periodicals; Information systems management -- Security measures -- Periodicals; Computer networks -- Security measures -- Periodicals; Information technology -- Security measures -- Periodicals; 005.805
• Languages: English
• ISSNs: 1744-1765

Abstract

Vulnerability mitigation is one of the key processes of proactive security management. Increase in complexity of IT systems and sophistication of attacks accompanied with rising rate of vulnerability evolution necessitate prioritisation of vulnerability mitigation. In this direction, a metric-based quantitative security measurement model (QSMM) was proposed in Tripathi and Singh (2013) that measures relative risk level of vulnerabilities and hosts in a network. Objective of the model is to assist system administrator in automated and reasonable decision making for mitigation of vulnerabilities present in a network. In order to evaluate the performance and effectiveness of the proposed model in realistic network, the model was applied in network of MIT campus. MIT campus network was used as the testbed to demonstrate the efficacy of model. This work presents a detailed account of this real case study and further, results are analysed.