Modeling the Security Ecosystem - The Dynamics of (In)Security

Abstract

The security of information technology and computer networks is effected by a wide variety of actors and processes which together make up a security ecosystem; here we examine this ecosystem, consolidating many aspects of security that have hitherto been discussed only separately. First, we analyze the roles of the major actors within this ecosystem and the processes they participate in, and the the paths vulnerability data take through the ecosystem and the impact of each of these on security risk. Then, based on a quantitative examination of 27,000 vulnerabilities disclosed over the past decade and taken from publicly available data sources, we quantify the systematic gap between exploit and patch availability. We provide the first examination of the impact and the risks associated with this gap on the ecosystem as a whole. Our analysis provides a metric for the success of the "responsible disclosure" process. We measure the prevalence of the commercial markets for vulnerability information and highlight the role of security information providers (SIP), which function as the "free press" of the ecosystem. IntroductionWith the ongoing deployment of information technology in today's economy and society, comprehending the evolution of information security at large has become much more than the mere understanding of the underlying technologies. There is

vepRisk - A Web Based Analysis Tool for Public Security Data

“…Parsers are crawlers or scrapers designed to crawl the web and extract specific information about vulnerabilities, patches and exploits from the selected data sources. Currently we have parsers for six different vulnerability data sources (National Vulnerability Database data source 3 , Security database data source 4 , CVE data source 5 , CVE Details data source 6 , Security , Cisco 12 etc.,) and exploits from Exploit database 13 (illustrated by the left-most column in Figure 2). Due to the modular structure of the data collation framework, more parsers for other security data sources can easily be added.…”

“…This analysis is inspired by the work from Frei et al [3]. It allows an analyst to check how long it would take for a vulnerability to be exploited, for it to be patched, or for an exploited vulnerability to be patched.…”

“…Examples include the work in [5] (statistical analysis and trends), [1] (application of vulnerability discovery models to vulnerability data), [2] (competing risk model using vulnerabilities, patches and exploits), [3] (analysis of trends and inter-event times between vulnerabilities, patches and exploits).…”

“…The main focus has been on the vulnerability lifecycle and studying individual vulnerability metrics. Others, such as the work from Frei et al [3] have provided analysis of multiple risk factors (vulnerabilities, exploits and patches), but they considered a particular period of time (up to 2009 in [3]). This makes it difficult for an organization to assess their current risk exposure.…”

Using CVSS to quantitatively analyze risks to software caused by vulnerabilities

“…Depending on how we view systems, software security can be measured by several possible metrics [1,2]. Through examining the number of vulnerabilities and their discovery rates, many researchers have established models to quantitatively analyze software security [3][4][5].…”