Normalization of Severity Rating for Automated Context-aware Vulnerability Risk Management

Abstract

In the last three years, the unprecedented increase in discovered vulnerabilities ranked with critical and high severity raise new challenges in Vulnerability Risk Management (VRM). Indeed, identifying, analyzing and remediating this high rate of vulnerabilities is labour intensive, especially for enterprises dealing with complex computing infrastructures such as Infrastructure-as-a-Service providers. Hence there is a demand for new criteria to prioritize vulnerabilities remediation and new automated/autonomic approaches to VRM. In this paper, we address the above challenge proposing an Automated Context-aware Vulnerability Risk Management (AC-VRM) methodology that aims: to reduce the labour intensive tasks of security experts; to prioritize vulnerability remediation on the basis of the organization context rather than risk severity only. The proposed solution considers multiple vulnerabilities databases to have a great coverage on known vulnerabilities and to determine the vulnerability rank. After the description of the new VRM methodology, we focus on the problem of obtaining a single vulnerability score by normalization and fusion of ranks obtained from multiple vulnerabilities databases. Our solution is a parametric normalization that accounts for organization needs/specifications.

Automated Patch Management: An Empirical Evaluation Study

“…Today, we lack the tools that automatically conduct the four stages, identification, classification, evaluation, and remediation in the VRM process. In [4]- [6], we proposed Automated Context-aware Vulnerability Risk Management (ACVRM) to improve the VRM procedure by 1) reducing the labor-intensive tasks of security experts in patch prioritization; 2) customizing the patch prioritization for a given organization by learning about the organization's assets and the vulnerabilities that affect these assets; 3) automating VRM procedure to reduce processing time.…”

“…Figure 1. In phase 1, described in [4], [6], we collected the publicly known vulnerabilities from multiple Vulnerability Databases (VD) and normalized the severity score for each vulnerability based on the selected vulnerability management mode by the organization. The collected data identifies existing vulnerabilities in the organization's assets.…”

Automated Context-Aware Vulnerability Risk Management for Patch Prioritization

“…To answer the above research question, we introduced the concept of automated context-aware vulnerability risk management (ACVRM) [6,7]. ACVRM facilitates the customization of the VRM process for a given organization by learning about the organization's assets and the vulnerabilities that affect these assets.…”

“…In our previous studies [6,7], we identified that the selection of what vulnerability database (VD) to use plays an essential role in the VRM procedure and the information on an organization's assets should support VD choice. Indeed, the vulnerability severity score comes from a VD, and there are several types of VD, from national [8] to vendor [9,10], and even application-specific [11].…”

Normalization Framework for Vulnerability Risk Management in Cloud

“…Firstly, we proposed a VDs Normalization Framework (VDNF) that could be integrated in the vulnerability management process. The VDNF is a refinement and implementation of what envisioned in [13]. VDNF is intended as a tool to improve the classification and evaluation phases in VRM while dealing with multiple VDs as a source.…”