Vulnerability Management Models Using a Common Vulnerability Scoring System
Vulnerability prioritization is an essential element of the vulnerability management process in data communication networks. Accurate prioritization allows the attention to be focused on the most critical vulnerabilities and their timely elimination; otherwise, organizations may face severe financia...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2021-09-01
|
| Series: | Applied Sciences |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2076-3417/11/18/8735 |
| _version_ | 1797520296890073088 |
|---|---|
| author | Michał Walkowski Jacek Oko Sławomir Sujecki |
| author_facet | Michał Walkowski Jacek Oko Sławomir Sujecki |
| author_sort | Michał Walkowski |
| collection | DOAJ |
| description | Vulnerability prioritization is an essential element of the vulnerability management process in data communication networks. Accurate prioritization allows the attention to be focused on the most critical vulnerabilities and their timely elimination; otherwise, organizations may face severe financial consequences or damage to their reputations. In addition, the large amounts of data generated by various components of security systems further impede the process of prioritizing the detected vulnerabilities. Therefore, the detection and elimination of critical vulnerabilities are challenging tasks. The solutions proposed for this problem in the scientific literature so far—e.g., PatchRank, SecureRank, Vulcon, CMS, VDNF, or VEST—are not sufficient because they do not consider the context of the organization. On the other hand, commercial solutions, such as Nessus, F-Secure, or Qualys, do not provide detailed information regarding the prioritization procedure, except for the scale. Therefore, in this paper, the authors present an open-source solution called the Vulnerability Management Center (VMC) in order to assist organizations with the vulnerability prioritization process. The VMC presents all calculated results in a standardized way by using a Common Vulnerability Scoring System (CVSS), which allows security analysts to fully understand environmental components’ influences on the criticality of detected vulnerabilities. In order to demonstrate the benefits of using the the open-source VMC software developed here, selected models of a vulnerability management process using CVSS are studied and compared by using three different, real testing environments. The open-source VMC suite developed here, which integrates information collected from an asset database, is shown to accelerate the process of removal for the critical vulnerabilities that are detected. The results show the practicability and efficacy of the selected models and the open-source VMC software, which can thus reduce organizations’ exposure to potential threats. |
| first_indexed | 2024-03-10T07:54:46Z |
| format | Article |
| id | doaj.art-06b8379657894a83bab271984e0db2d9 |
| institution | Directory Open Access Journal |
| issn | 2076-3417 |
| language | English |
| last_indexed | 2024-03-10T07:54:46Z |
| publishDate | 2021-09-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Applied Sciences |
| spelling | doaj.art-06b8379657894a83bab271984e0db2d92023-11-22T11:57:26ZengMDPI AGApplied Sciences2076-34172021-09-011118873510.3390/app11188735Vulnerability Management Models Using a Common Vulnerability Scoring SystemMichał Walkowski0Jacek Oko1Sławomir Sujecki2Department of Telecommunications and Teleinformatics, Wroclaw University of Science and Technology, 50-370 Wroclaw, PolandDepartment of Telecommunications and Teleinformatics, Wroclaw University of Science and Technology, 50-370 Wroclaw, PolandDepartment of Telecommunications and Teleinformatics, Wroclaw University of Science and Technology, 50-370 Wroclaw, PolandVulnerability prioritization is an essential element of the vulnerability management process in data communication networks. Accurate prioritization allows the attention to be focused on the most critical vulnerabilities and their timely elimination; otherwise, organizations may face severe financial consequences or damage to their reputations. In addition, the large amounts of data generated by various components of security systems further impede the process of prioritizing the detected vulnerabilities. Therefore, the detection and elimination of critical vulnerabilities are challenging tasks. The solutions proposed for this problem in the scientific literature so far—e.g., PatchRank, SecureRank, Vulcon, CMS, VDNF, or VEST—are not sufficient because they do not consider the context of the organization. On the other hand, commercial solutions, such as Nessus, F-Secure, or Qualys, do not provide detailed information regarding the prioritization procedure, except for the scale. Therefore, in this paper, the authors present an open-source solution called the Vulnerability Management Center (VMC) in order to assist organizations with the vulnerability prioritization process. The VMC presents all calculated results in a standardized way by using a Common Vulnerability Scoring System (CVSS), which allows security analysts to fully understand environmental components’ influences on the criticality of detected vulnerabilities. In order to demonstrate the benefits of using the the open-source VMC software developed here, selected models of a vulnerability management process using CVSS are studied and compared by using three different, real testing environments. The open-source VMC suite developed here, which integrates information collected from an asset database, is shown to accelerate the process of removal for the critical vulnerabilities that are detected. The results show the practicability and efficacy of the selected models and the open-source VMC software, which can thus reduce organizations’ exposure to potential threats.https://www.mdpi.com/2076-3417/11/18/8735Common Vulnerability Scoring Systemvulnerability managementcybersecurity |
| spellingShingle | Michał Walkowski Jacek Oko Sławomir Sujecki Vulnerability Management Models Using a Common Vulnerability Scoring System Applied Sciences Common Vulnerability Scoring System vulnerability management cybersecurity |
| title | Vulnerability Management Models Using a Common Vulnerability Scoring System |
| title_full | Vulnerability Management Models Using a Common Vulnerability Scoring System |
| title_fullStr | Vulnerability Management Models Using a Common Vulnerability Scoring System |
| title_full_unstemmed | Vulnerability Management Models Using a Common Vulnerability Scoring System |
| title_short | Vulnerability Management Models Using a Common Vulnerability Scoring System |
| title_sort | vulnerability management models using a common vulnerability scoring system |
| topic | Common Vulnerability Scoring System vulnerability management cybersecurity |
| url | https://www.mdpi.com/2076-3417/11/18/8735 |
| work_keys_str_mv | AT michałwalkowski vulnerabilitymanagementmodelsusingacommonvulnerabilityscoringsystem AT jacekoko vulnerabilitymanagementmodelsusingacommonvulnerabilityscoringsystem AT sławomirsujecki vulnerabilitymanagementmodelsusingacommonvulnerabilityscoringsystem |