Adaptive vulnerability-based risk identification software with virtualization functions for dynamic management

Abstract

Over the years, risk management has become increasingly important for all companies, varying from large, medium-sized to micro-enterprises. The growing increase in cyber threats and the costs they cause has forced companies to consider new types of risks. This problem mainly affects medium, small, and micro-enterprises because of their limited resources or because they do not have sufficient technological knowledge. For this reason, this article studies different frameworks associated with risk management in different business areas. In addition, an open-source, automatic (plug and play) solution is proposed, which uses few resources thanks to virtualization through containerization. It takes care of identifying wired and wireless network devices. It generates a risk report with qualitative and quantitative values by reassessing the risk over time and provides mitigation if possible. Finally, a proof of concept was generated using a simulation of a medium-sized enterprise with various types of assets. As a result, we explored over 20 business days how network devices were detected and assessed without interacting with the framework, except to collect the results. It also showed how the risks evolve and increases if not addressed by the organization.