A quantitative CVSS-based cyber security risk assessment methodology for IT systems

Aksu M. U., Dilek M. H., Tatli E. I., Bicakci K., Dirik H. I., Demirezen M. U., ...Daha Fazla

2017 International Carnahan Conference on Security Technology, ICCST 2017, Madrid, İspanya, 23 - 26 Ekim 2017, cilt.2017-October, ss.1-8 identifier

  • Yayın Türü: Bildiri / Tam Metin Bildiri
  • Cilt numarası: 2017-October
  • Doi Numarası: 10.1109/ccst.2017.8167819
  • Basıldığı Şehir: Madrid
  • Basıldığı Ülke: İspanya
  • Sayfa Sayıları: ss.1-8
  • Anahtar Kelimeler: attack graphs, cyber security risks, risk assessment, risk metrics, vulnerability management
  • İstanbul Teknik Üniversitesi Adresli: Hayır

Özet

© 2017 IEEE.IT system risk assessments are indispensable due to increasing cyber threats within our ever-growing IT systems. Moreover, laws and regulations urge organizations to conduct risk assessments regularly. Even though there exist several risk management frameworks and methodologies, they are in general high level, not defining the risk metrics, risk metrics values and the detailed risk assessment formulas for different risk views. To address this need, we define a novel risk assessment methodology specific to IT systems. Our model is quantitative, both asset and vulnerability centric and defines low and high level risk metrics. High level risk metrics are defined in two general categories; base and attack graph-based. In our paper, we provide a detailed explanation of formulations in each category and make our implemented software publicly available for those who are interested in applying the proposed methodology to their IT systems.