A quantitative CVSS-based cyber security risk assessment methodology for IT systems

Aksu M. U., Dilek M. H., Tatli E. I., Bicakci K., Dirik H. I., Demirezen M. U., ...More

2017 International Carnahan Conference on Security Technology, ICCST 2017, Madrid, Spain, 23 - 26 October 2017, vol.2017-October, pp.1-8 identifier

  • Publication Type: Conference Paper / Full Text
  • Volume: 2017-October
  • Doi Number: 10.1109/ccst.2017.8167819
  • City: Madrid
  • Country: Spain
  • Page Numbers: pp.1-8
  • Keywords: attack graphs, cyber security risks, risk assessment, risk metrics, vulnerability management
  • Istanbul Technical University Affiliated: No


© 2017 IEEE.IT system risk assessments are indispensable due to increasing cyber threats within our ever-growing IT systems. Moreover, laws and regulations urge organizations to conduct risk assessments regularly. Even though there exist several risk management frameworks and methodologies, they are in general high level, not defining the risk metrics, risk metrics values and the detailed risk assessment formulas for different risk views. To address this need, we define a novel risk assessment methodology specific to IT systems. Our model is quantitative, both asset and vulnerability centric and defines low and high level risk metrics. High level risk metrics are defined in two general categories; base and attack graph-based. In our paper, we provide a detailed explanation of formulations in each category and make our implemented software publicly available for those who are interested in applying the proposed methodology to their IT systems.