top of page
< Önceki

A quantitative CVSS-based cyber security risk assessment methodology for IT systems

Yazarlar:

Yayınlanma Tarihi:

Dergi:

Sayfalar:

Yayıncı:

Özet:

M Ugur Aksu, M Hadi Dilek, E İslam Tatlı, Kemal Bicakci, H Ibrahim Dirik, M Umut Demirezen, Tayfun Aykır

2017/10/23

2017 International Carnahan Conference on Security Technology (ICCST)

1-8

IEEE

IT system risk assessments are indispensable due to increasing cyber threats within our ever-growing IT systems. Moreover, laws and regulations urge organizations to conduct risk assessments regularly. Even though there exist several risk management frameworks and methodologies, they are in general high level, not defining the risk metrics, risk metrics values and the detailed risk assessment formulas for different risk views. To address this need, we define a novel risk assessment methodology specific to IT systems. Our model is quantitative, both asset and vulnerability centric and defines low and high level risk metrics. High level risk metrics are defined in two general categories; base and attack graph-based. In our paper, we provide a detailed explanation of formulations in each category and make our implemented software publicly available for those who are interested in applying the proposed …

Makaleyi İndir

bottom of page