Strategic, Tactical, Technical, and Operational Requirements of Executive Organizations for Developing Cyber Security Vulnerability Calculator

Subject Areas : Multimedia Processing, Communications Systems, Intelligent Systems

Iman Rajabizadeh ¹ , Nasser Modiri ²

1 - Faculty of Electrical and Computer Engineering, Islamic Azad University, North Tehran Branch, Iran
2 - Department of Computer Engineering, Assistant Professor, Zanjan Branch, Islamic Azad University, Iran.

Received: 2020-12-03 Accepted : 2021-05-24 Published : 2021-09-23

Keywords: Effective Cyber Defense, vulnerability assessment, cyber threats,

Abstract :

Introduction: Vulnerability analysis is of particular importance as a point of entry into the system and gaining unauthorized access by the attacker. As a result, one of the basic steps in creating the security of organizations is to be aware of the vulnerabilities in information technology systems and planning to fix these vulnerabilities. Also, one of the most important indicators of cyber security is the existence of an organizational gem (coordinated incident response groups) in the executive bodies of the country, which is responsible for preventing, dealing with, and dealing with all security incidents that occur in the space of information production and exchange. One of the requirements for creating an organizational gem in executive bodies is to have a vulnerability management unit and as a result, the existence of a deficiency calculator.Method: In this article, in order to adapt the CIS security controller, we cover this issue by applying two new variables in the basic and environmental criteria of CVSS. These criteria are as follows: the amount of time it takes to detect unauthorized access resulting from a vulnerability in the network and the amount of time it takes to block detected unauthorized access.Findings: In order to more accurately assess the severity of the vulnerabilities in the environment, the third version of the conventional vulnerability scoring system (CVSS) according to one of the critical components in cyber defense, i.e. the duration of vulnerability detection and cutting off the unauthorized access resulting from them was developed, and then the performance of the tool was evaluated by examining the vulnerability severity of CVE-2019-1690 and CVE-2019-1758 in order to evaluate the impact and performance of the first controller. The results show the proposed metrics lead to higher performance.Discussion: The developed CVSS tool is capable of more accurate evaluation of vulnerabilities and providing a suitable score according to the most important CIS control, i.e. creation and management of authorized and unauthorized equipment warehouse. Using the proposed tool Organizations can limit and effectively correct cyber threats more quickly. The proposed method is able to reduce the existing challenges in the field of cyber security of organizations.

References:

 

• مدیری، ناصر (1396). جرم شناسی سایبری( امنیت،مدل سازی تهدیدات وجرم شناسی شبکه). انتشارات مهرگان قلم


• رجبی زاده، ایمان و ناصر مدیری . (1399) . ارائه رویکردی دفاعی برای مقابله با شناسایی تجهیزات فعال شبکه‌های کامپیوتری . پایان نامه کارشناسی ارشد . دانشگاه ازاد اسلامی واحد تهران شمال


• سعیدی، وحید و ناصر مدیری. (۱۳۹۳). ارائه رویکردی جهت ارزیابی آسیب­پذیری‌های فنی شبکه‌های محلی. دومین همایش ملی پژوهش‌های کاربردی در علوم کامپیوتر و فناوری اطلاعات. تهران. دانشگاه جامع علمی کاربردی.


• سعیدی، وحید و ناصر مدیری(۱۳۹۳). ارائه رویکردی جهت ارزیابی آسیب­پذیری‌های فنی شبکه‌های محلی.دومین همایش ملی پژوهش‌های کاربردی در علوم کامپیوتر و فناوری اطلاعات. تهران. دانشگاه جامع علمی کاربردی.


• رجبی زاده، ایمان و ناصر مدیری. (1399) . ابزار توسعه یافته امتیازدهی آسیب‌پذیری عام . http://cve-calculator.ir/cvss/


• Ramos, A., Lazar, M., Holanda Filho, R., & Rodrigues, J. J. (2017). Model-based quantitative network security metrics: A survey. IEEE Communications Surveys & Tutorials, 19(4), 2704-2734.


• ‏Zhao, X., Zhang, Y., Xue, J., Shan, C., & Liu, Z. (2020). Research on Network Risk Evaluation Method  Based on a Differential Manifold. IEEE Access, 8, 66315-66326.‏


•  The Center for Internet Cybersecurity: "Critical Security Controls .Version 7.1" . April 1, 2019.
  Available at: https://www.cisecurity.org/critical-controls.cfm .


• Qi, W., Yan, X., Bin, Q., Shuang, L. X., & Hui, Y. (2019, May). A Risk Assessment Method of Intelligent Substation Relay Protection Device Based on Severity Index. In 2019 IEEE 2nd International Conference on Electronics Technology (ICET) (pp. 381-386). IEEE.‏


• Huang, Y., Tao, C., & Wang, Z. Q. (2015). Fuzzy comprehensive evaluation model of computer network security and its application. In Applied Mechanics and Materials (Vol. 711, pp. 286-292). Trans Tech Publications Ltd.‏


• Chatterjee, S., Chaudhuri, B., Bhar, C., & Shukla, A. (2017, December). Estimation of software reliability and development cost using interval type-2 fuzzy AHP. In 2017 International Conference on Infocom Technologies and Unmanned Systems (Trends and Future Directions)(ICTUS) (pp. 682-688). IEEE.‏


• Kebande, V. R., Kigwana, I., Venter, H. S., Karie, N. M., &Wario, R. D. (2018, August). CVSS Metric-Based Analysis, Classification and Assessment of Computer Network Threats and Vulnerabilities. In 2018 International Conference on Advances in Big Data, Computing and Data Communication Systems (icABCD) (pp. 1-10). IEEE.‏


• Lei and Y. Zhang, "Vulnerability availability quantification evaluation system based on vulnerability", J. Comput. Res. Develop., vol. 54, pp. 2296-2309, Aug. 2017.


• ZHAO, X. L., ZHANG, Y. M., YA, H., ZHANG, X. H., & YANG, Y. N. (2017). Multi-Layer, Multi-Dimensional and Multi-Granularity Network Model to Measure Network Security. DEStech Transactions on Computer Science and Engineering, (cimns).‏


• Ray, S. (2019, February). A Quick Review of Machine Learning Algorithms. In 2019 International Conference on Machine Learning, Big Data, Cloud and Parallel Computing (COMITCon) (pp. 35-39). IEEE.‏


• Ray, S. (2019, February). A Quick Review of Machine Learning Algorithms. In 2019 International Conference on Machine Learning, Big Data, Cloud and Parallel Computing (COMITCon) (pp. 35-39). IEEE.‏


• Gu, Y., Li, K., Guo, Z., & Wang, Y. (2019). Semi-supervised k-means ddos detection method using hybrid feature selection algorithm. IEEE Access, 7, 64351-64365.‏


• Common vulnerability scoring system v3.0 specification document 2017 https://www.first.org/cvss/cvss-v30-specification-v1.7.pdf