Estimating risk levels for vulnerability categories using CVSS. (1st January 2012)

• Record Type: Journal Article
• Authors: Tripathi, Anshu; Singh, Umesh Kumar
• Is Part Of: International journal of internet technology and secured transactions. Volume 4:Number 4(2012)
• Page Start: 272
• Page End: 289
• Publication Date: 2012-01-01
• Subjects: vulnerability -- CVSS score -- vulnerability category -- risk level -- security measurement; Internet -- Security measures -- Periodicals; Computer security -- Periodicals; Information systems management -- Security measures -- Periodicals; Computer networks -- Security measures -- Periodicals; Information technology -- Security measures -- Periodicals; 005.805
• Languages: English
• ISSNs: 1748-569X

Abstract

Objective and automated means for security measurement are becoming essential for security management. The security level of any system can be measured in terms of risk level posed by the presence of vulnerabilities in it. The process can be further improved, if well classified vulnerability datasets are used. With classified vulnerability data, multiple vulnerabilities of same genre can be addressed simultaneously that in turn increases objectivity and scope of security management. In this paper, we proposed an approach to measure severity level of vulnerability categories and develop metrics to estimate risk levels of vulnerability categories. The proposed approach re-evaluate and unify risk levels of vulnerabilities present in a vulnerability category based on vulnerability characteristics, vulnerability population, availability of patches and age of vulnerability to estimate risk level of category. Developed metrics are applied on real vulnerability data repository by NVD and risk levels estimated for 23 vulnerability categories under which NVD classify vulnerability data.