关键词:
Information technology
Computer science
摘要:
To mitigate known vulnerabilities in cybersecurity, organizations are in a desperate need for critical information, such as exploit code maturity, confidence about exploits, remediation capability, and own environmental contexts. Threats need to be contextualized so that they become visible risks for remedial actions. Extant efforts need significant improvements to prevent malicious actors from exploiting exposed risks. Rigorously founded on theories, but pragmatic research is crucial for better vulnerability management efforts. The NVD (National Vulnerability Database) Data Feeds, considered the de-facto data source in the cybersecurity domain, does not unfortunately provide a complete set of vulnerability information needed by organizations. Then, organizations need to rely on cybersecurity experts and vendors to obtain the missing pieces of information. Also, it is cumbersome and often time-consuming to collect relevant information about risks and put needed knowledge all together at one place. Using the heuristics-based rules and prioritized-risks visualization, this research takes on the challenge of transforming vulnerabilities into context-aware, visible risks that organizations can handle and mitigate. First, to derive the three constituent Metric Values of CVSS Temporal Scores which are factored into calculating Temporal and Environment Scores -- Exploit Code Maturity, Remediation Level, and Report Confidence --, this study developed heuristics-based rules data-driven by analyzing NVD datasets. Then, to guide cybersecurity analysts to analyze and prioritize threats, the most appropriate visualization tool for a context was selected based on a conceptual road-map. Subsequently, vulnerabilities of IT assets of research sites were contextualized, and their CVEs (Common Vulnerabilities and Exposures) were collected. After downloading pertinent data from NVD Data Feeds, it was data-matched with the contextualized risks. Then, based on the three Temporal Metric V