Common Vulnerability Scoring System Research Articles

A framework for automating environmental vulnerability analysis of network services

The primary objective of this paper is to introduce a comprehensive framework designed to automate the assessment of environmental vulnerability status of communication protocols and networked services, within operational contexts. The proposed algorithm leverages the Common Vulnerability Scoring System version 3 (CVSS 3) metrics in conjunction with network security data. The initial step involves the establishment of a network security ontology, which serves to model the environmental attributes associated with the current security posture of communication protocol channels available within an infrastructure. The process commences with the identification and enumeration of all active communication services through a combination of diverse information gathering tools. Subsequently, active network services undergo assessment using a blend of passive scanning and active security analysis tools, which produce the environmental security score. This score can be integrated into vulnerability scoring systems such as CVSS, facilitating the fine-tuning of base CVSS scores, as well as vulnerability mitigation in real-world environments. To validate the proposed framework, we conducted testing across various networks and communication protocols within a controlled environment, thereby offering tangible illustrations for widely-utilized communication protocols.

ZIMBRA MAIL SERVER VULNERABILITIES IN RECENT YEARS

This article talks about the most dangerous Zimbra mail server vulnerabilities of 2021-2022. In addition, the terms of their use, vulnerable code parts and features are indicated. The risk of vulnerabilities is higher than 7.0 according to the Common Vulnerability Scoring System (CVSS) rating. This shows how easy it is to exploit the vulnerability and how much damage it can do to the system. Using them, attackers can perform various commands on the server itself, starting with accessing mail. If we take into account that Zimbra mail belongs to popular corporate solutions, we can see that its users are business representatives and the public sector. And the value of information in them is important not only for those individuals, but also for the state. After analyzing each vulnerability, their patches for each branch are shown.

The Impacts of Cybersecurity and AI on Businesses and Individuals

In today’s ever growing technological world, the protection of systems is needed and cybersecurity does just that. Cyber security is the field of prohibiting unauthorized users from accessing data, networks, and devices and keeping data safeguarded. AI or artificial intelligence plays a major part in this field since they can enhance the activities of humans more efficiently. Therefore, this paper deeply explores the specific positive and negative effects of cyber security and AI on businesses and individuals. This paper also dives deep into some tools of the field: CVE or common vulnerability and exposures and CVSS or common vulnerability scoring system. This leads the paper to discuss two major cyber incidents from JP Morgan and Chase and Microsoft Exchange Data Breach and the attacks used. These incidents displayed the need for a more vigorous cyber security. A few of the attacks these companies encountered and more types of attacks are explained in this paper as well. In addition, this paper informs about the specific effects cyber breaches can have on companies. This paper revealed that cybersecurity can positively affect businesses and individuals through mitigating attacks, securing data, making data accessible to only those who are allowed, and better quality of life and negative effects include high costs, more management, user inconvenience, constant new threats, and human error. The negative effects of AI include analyzing personal information, target vulnerabilities, mislead individuals, impersonate humans, and provide false information and positives include network intrusion detection products, threat hunting, vulnerability management, and data centers.

SEAG: A novel dynamic security risk assessment method for industrial control systems with consideration of social engineering

The development of information and communication technology and its wide application in industrial control systems (ICSs) has brought a growing number of security risks to ICSs. Quantifying and dynamically assessing the security risks of ICSs is of great significance to protect ICSs from cyber attacks. Current risk assessment methods, however, do not take into account social engineering (SE) attacks and the potential cyber-to-physical risks associated with cyber attacks. To address these issues, we propose a novel method for the dynamic security risk assessment of ICSs, called SEAG. Specifically, the scheme first extends and modifies three metrics in the common vulnerability scoring system to four metrics for objectively calculating the exploit probability of SE. Then, we construct the attack graph by relying on the knowledge graph that integrates three kinds of knowledge including SE knowledge, common vulnerability knowledge, and control system knowledge. In addition, we combine real time attack data that causes system performance loss with the industrial protocol function code attack detected by the intrusion detection system to accurately quantify the potential cyber-to-physical risks associated with cyber attacks. This method allows us to dynamically assess the security risks of ICSs in real time. Finally, the method is verified by one simulation testbed, which shows the effectiveness and accuracy of the proposed method for dynamic quantitative evaluating security risks of ICSs.

A new method for vulnerability and risk assessment of IoT

In this paper, we propose a generic vulnerability and risk assessment method for IoT-enabled systems. The main aim is to provide risk detection and vulnerability assessment for IoT-based systems. We present three phases of risk assessment methodology: graph construction, attack path detection, and attack path filtering for high-level attack paths. We give attack path detection, risk level computing, and attack path removing procedures to validate these phases. We represent the IoT-based network as a graphical structure. Then, we construct the topology for a given IoT-based system. The smart home system is considered as a case scenario to present a realistic instance. The National Vulnerability Database (NVD), Common Vulnerability Scoring System (CVSS), and Common Vulnerability Exposures (CVE) metrics are used to assign vulnerabilities to devices. We formulate risk factors to compute risk levels for each node, attack path, and entire graph. We use the modified Depth First Algorithm (DFS) to find all attack paths for a source and target nodes. In addition, we compute risk levels using computing procedures. Further, we filter detected attack paths considering dominance level using computational metrics. We perform the simulation on a custom Python simulator considering the designed IoT-based smart home system. We compare our proposed methods with the state of the art. According to the experimental results, the proposed methods outperform existing vulnerability-based risk assessment models regarding running time complexity and operational cost.

STRIDE threat model-based framework for assessing the vulnerabilities of modern vehicles

Modern automobiles are becoming increasingly sophisticated with enhanced features. Modern car systems have hundreds of millions of lines of code, which increase the attack surface. To address this concern, this paper proposes a new cybersecurity analysis framework that complies with the ISO/SAE 21434:2021 standard. The framework uses the Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privileges (STRIDE) threat model, the Attack Tree Analysis (ATA) approach, and the Common Vulnerability Scoring System (CVSS) as a key score exploitation matrix to rate identified potential threats. To evaluate, the framework was applied, to real-life scenarios, to examine the possible cyber threats in Advanced Driver-Assistance Systems (ADAS). To assess, a tool was implemented to automate threat impact ratings, according to safety, operational, financial, privacy, and legislative metrics. It also automates attack feasibility ratings considering attack vectors, complexity, authentication, and risk level identification based on a five-by-five risk matrix. As a result, 199 potential threats were identified and addressed in, four targeted, ADAS-related use cases. For the Lane-Keeping safety-critical use case, as an example, five security requirements were elicited as countermeasures. These results show that ADAS in modern vehicles are vulnerable to cyberattacks.

Vulnerability Identification and Assessment for Critical Infrastructures in the Energy Sector

Vulnerability identification and assessment is a key process in risk management. While enumerations of vulnerabilities are available, it is challenging to identify vulnerability sets focused on the profiles and roles of specific organizations. To this end, we have employed systematized knowledge and relevant standards (including National Electric Sector Cybersecurity Organization Resource (NESCOR), ISO/IEC 27005:2018 and National Vulnerability Database (NVD)) to identify a set of 250 vulnerabilities for operators of energy-related critical infrastructures. We have elaborated a “double-mapping” scheme to associate (arbitrarily) categorized assets, with the pool of identified Physical, Cyber and Human/Organizational vulnerabilities. We have designed and implemented an extensible vulnerability identification and assessment framework, allowing historized assessments, based on the CVSS (Common Vulnerability Scoring System) scoring mechanism. This framework has been extended to allow modelling of the vulnerabilities and assessments using the Structured Threat Information eXpression (STIX) JSON format, as Cyber Threat Intelligence (CTI) information, to facilitate information sharing between Electrical Power and Energy Systems (EPES) and to promote collaboration and interoperability scenarios. Vulnerability assessments from the initial analysis of the project in the context of Research and Technology Development (RTD) projects have been statistically processed, offering insights in terms of the assessment’s importance and distribution. The assessments have also been transformed into a dynamic dataset processed to identify and quantify correlation and start the discussion on the interpretation of the way assessments are performed.

ENHANCING SECURITY IN SOFTWARE-DEFINED NETWORKING THROUGH ROUTING TECHNIQUES EXPLORATION

In today's world, network security is a key issue of information security. Virtual Networks have become an integral part of modern IT infrastructure, which presents us with challenges in the field of security. One solution to this problem is the use of software-defined networking (SDN), which provides a means to control and manage network traffic. However, as with any technology, SDN has its vulnerabilities that must be considered when deploying it. One of the tools that helps to take into account the vulnerabilities of network infrastructure is the Common Vulnerability Scoring System (CVSS) standard. It allows you to quantify the level of vulnerability of the infrastructure, which enables effective network protection. Analysis of the CVSS standard is an important stage in the development of a network security strategy. This paper analyzes the standards for building software-configured networks. It is noted that SDN is a modern approach to the design, construction, and operation of information communication networks. Using SDN makes it possible to directly program and dynamically manage the network, as well as to abstract the functionality of the infrastructure layer. However, the growing interest in SDN has revealed the shortcomings of their application in the fight against cybersecurity threats. The SDN architecture itself, external malicious attacks, and insufficient access control and encryption tools were found to be the main security challenges. The use of secure routing tools based on vulnerability metrics is proposed to increase the level of SDN data plane network security. According to the conducted analysis of SDN data plane vulnerabilities and the functionality of routing tools, the authors recommend using the CVSS standard to quantify the level of infrastructure vulnerability during the development and research of promising approaches to secure routing in the data plane of software-configured networks.

Improved technique for order of preference by similarity to ideal solution method for identifying key terrain in cyberspace asset layer.

Reinforcing weak cyberspace assets is an urgent requirement to defend national cybersecurity. Cyberspace key terrain (CKT) is a theory recently proposed for sensing cyberspace posture. Identifying CKT in the asset layer is essential for supporting cyberspace defense decisions. Existing methods ignore the influence of the multi-attribute correlation of cyberspace nodes and cyber attack mission (CAM) diversity, which restricts the recognition accuracy of CKT. To improve the accuracy of CKT identification and explore the relationship between CKT and CAM, we propose an improved cosine similarity technique for order of preference by similarity to the ideal solution (CosS-TOPSIS) method to model CKT and construct a CAM based on the MITRE adversarial tactics, techniques, and common knowledge (ATT&CK) framework to examine the influence of different weighted CAM on modeling CKT. Based on the vulnerability value calculation method of the cyber system in the common vulnerability scoring system version 3.1 (CVSS 3.1), we evaluated the effectiveness of CosS-TOPSIS in identifying CKT using three metrics: correlation coefficient, root mean square error, and mean absolute error. Our experiments showed that, in comparison with the TOPSIS method, the accuracy of the proposed method for identifying CKT improved by 8.9%, and the root mean square error reduced by 16%; simultaneously, CAM was proven to be an essential factor in identifying CKT. The feasibility and reliability of CosS-TOPSIS in identifying CKT and the close relationship between CAM and CKT identification were demonstrated experimentally. In our work, we utilized cosine similarity and FAHP to improve the baseline method. We also introduced three indicators to evaluate the method's reliability. Drawing from ATT&CK, we recommend CAM as a tool for sensing changes in the cyberspace environment and explore its relationship with CKT. Our work has great application potential for identifying cyberspace vulnerabilities, supporting cyberspace defense, and securing national cyberspace facilities.

Quantifying the Effects of Operational Technology or Industrial Control System based Cybersecurity Controls via CVSS Scoring

This paper has examined the application of the Common Vulnerability Scoring System applied to operational technology or industrial control system-based cybersecurity controls and demonstrated that the unique considerations and aspects of these environments are more accurately captured when compared against a traditional IT based evaluation. Multiple business drivers are compelling consumer goods manufacturers to augment and connect their manufacturing systems bringing with it increases in potential for experiencing a cybersecurity incident [1]. While other business verticals are able to utilize cybersecurity standards and control documents tailored for their industry, manufacturers do not have a set of materials that directly correlate to the operational technology environments in which their systems reside [2]. Cybersecurity practitioners face additional challenges in developing an understanding of the severity of the risks within these environments due to the lack of current quantifiable methods of evaluating the risks. The findings from this research provide cybersecurity practitioners with a repeatable and extensible method to derive the operational risk present to an organization due to the technologies and business strategies employed in the pursuit of business objectives.

Automotive Cybersecurity Vulnerability Assessment Using the Common Vulnerability Scoring System and Bayesian Network Model

Automotive Cybersecurity Vulnerability Assessment Using the Common Vulnerability Scoring System and Bayesian Network Model

Common vulnerability scoring system prediction based on open source intelligence information sources

The number of newly published vulnerabilities is constantly increasing. Until now, the information available when a new vulnerability is published is manually assessed by experts using a Common Vulnerability Scoring System (CVSS) vector and score. This assessment is time consuming and requires expertise. Various works already try to predict CVSS vectors or scores using machine learning based on the textual descriptions of the vulnerability to enable faster assessment. However, for this purpose, previous works only use the texts available in databases such as National Vulnerability Database. With this work, the publicly available web pages referenced in the National Vulnerability Database are analyzed and made available as sources of texts through web scraping. A Deep Learning based method for predicting the CVSS vector is implemented and evaluated. The present work provides a classification of the National Vulnerability Database’s reference texts based on the suitability and crawlability of their texts. While we identified the overall influence of the additional texts is negligible, we outperformed the state-of-the-art with our Deep Learning prediction models.

Review and Comparison of US, EU, and UK Regulations on Cyber Risk/Security of the Current Blockchain Technologies: Viewpoint from 2023

AbstractThe first cryptocurrency was invented in 2008/09, but the Blockchain-Web3 concept is still in its infancy, and the cyber risk is constantly changing. Cybersecurity should also be adapting to these changes to ensure security of personal data and continuation of operations. This article starts with a comparison of existing cybersecurity standards and regulations from the National Institute of Standards and Technology (NIST) and the International Organisation for Standardisation (ISO)—ISO27001, followed by a discussion on more specific and recent standards and regulations, such as the Markets in Crypto-Assets Regulation (MiCA), Committee on Payments and Market Infrastructures and the International Organisation of Securities Commissions (CPMI-IOSCO), and more general cryptography (and post-quantum cryptography), in the context of cybersecurity. These topics are followed up by a review of recent technical reports on cyber risk/security and a discussion on cloud security questions. Comparison of Blockchain cyber risk is also performed on the recent EU standards on cyber security, including European Cybersecurity Certification Scheme (EUCS)—cloud, and US standards—The National Vulnerability Database (NVD) Common Vulnerability Scoring System (CVSS). The study includes a review of Blockchain endpoint security, and new technologies e.g., IoT. The research methodology applied is a review and case study analysing secondary data on cybersecurity. The research significance is the integration of knowledge from the United States (US), the European Union (EU), the United Kingdom (UK), and international standards and frameworks on cybersecurity that can be alighted to new Blockchain projects. The results show that cybersecurity standards are not designed in close cooperation between the two major western blocks: US and EU. In addition, while the US is still leading in this area, the security standards for cryptocurrencies, internet-of-things, and blockchain technologies have not evolved as fast as the technologies have. The key finding from this study is that although the crypto-market has grown into a multi-trillion industry, the crypto-market has also lost over 70% since its peak, causing significant financial loss for individuals and cooperation’s. Despite this significant impact to individuals and society, cybersecurity standards and financial governance regulations are still in their infancy, specifically in the UK.

A hybrid scoring system for prioritization of software vulnerabilities

While security experts, firms, security providers, threat analysts all around the globe are working hard to provide ironclad security for information system softwares, vulnerabilities in softwares are still being detected on a daily basis. Although it is very important to neutralize all these vulnerabilities as quickly as possible, prioritization of vulnerabilities to determine the order for resolving these vulnerabilities is an equally important step for optimization of the remediation process. Among different available techniques for prioritization of vulnerabilities, scoring the vulnerabilities is the most common practice. In this paper, we have proposed a novel hybrid technique, VIEWSS: Variable Impact-Exploitability Weightage Scoring System, which scores vulnerabilities by varying the Impact-Exploitability score ratio towards calculation of base scores. We have also discussed three popular quantitative vulnerability scoring techniques; CVSS (Common Vulnerability Scoring System), VRSS (Vulnerability Rating and Scoring System) and WIVSS (Weighted Impact Vulnerability Scoring System) by explaining the underlying metrics, scoring systems, formulas and some limitations of these techniques. The proposed technique, VIEWSS is also compared with the discussed techniques by generating scores for around 83,500 vulnerabilities reported on NVD (National Vulnerability Database) in the last five years. It is observed that our proposed technique generates the greatest number of distinct scores and also the score distribution of our technique performs well on different parameters including skewness and kurtosis. Further when these techniques were applied on a dataset containing around 12,200 ‘high-risk’ vulnerabilities extracted by cross-referencing NVD and Exploit-DB, our proposed technique outperformed all the discussed techniques in terms of identifying the threat accurately.

Automation of Quantifying Security Risk Level on Injection Attacks Based on Common Vulnerability Scoring System Metric

An injection attack is a cyber-attack that is one of The Open Web Application Security Project Top 10 Vulnerabilities. These attacks take advantage of insufficient user input validation into the system through the input surface of a Web application as that user in the browser. The company’s cyber security team must filter thousands of attacks to prioritize which attacks are considered the most dangerous to be mitigated first. This activity of filtering thousands of attacks takes much time because you have to check these attacks one by one. Therefore, a method is needed to assess how dangerous a cyber-attack is that enters an organization’s or company’s server. Injection attack detection can be done by analyzing the request data in the web server log. Our research attempts to perform quantification modeling of the variations of two types of injection attacks, SQL Injection (SQLi) and Cross-Site Scripting (XSS), using Common Vulnerability Scoring System Metrics (CVSS). CVSS metrics are generally used to calculate the level of dangerous weakness in the system. This metric is never used to calculate the level of how dangerous an attack is. The modeling that we have made shows that SQLi and XSS attacks have many variations in levels ranging from low to high levels. We discovered that when classified with Common Weakness Enumeration Database, SQLi and XSS attacks CVE values would have high-level congruence with almost 94% value between one another vector on CVSS.

Attack Path Detection for IIoT Enabled Cyber Physical Systems: Revisited

In this paper, we propose a generic vulnerability and risk assessment method for IIoT-enabled critical systems. We focus on reducing risk factors and vulnerable structures in order to provide security issues for the IIoT and enabled complex systems. In addition to the existing risk assessment and related methods, we represent the IIoT-enabled network topology as a directed graph, and we develop an attack tree-based approach using graph theory. We assume that each device is a potential critical node due to the existing vulnerabilities, which are defined in the National Vulnerability Database (NVD), and we establish directed relations between nodes, considering cyber and physical interactions. We improve existing attack path-identifying methods using the Depth First Search (DFS) algorithm to find all the paths from the source to the target nodes. In the generated topology, each node has the pre-assigned Common Vulnerability Scoring System (CVSS) scores acting as a weight. We also implement the Floyd-Warshall algorithm to identify path risk levels. Finally, we assess the identified vulnerable paths from varying source and target pairs via path and node-reducing procedures, considering risk thresholds. We perform our simulation on a custom Python simulator, considering the transportation and supply sectors. We compare our results with the previous ones. Simulation results show that our proposed methods and procedures outperform existing risk assessment and filtering methods in terms of running time and attack path identification and filtering.

Uji Vulnerability Assessment Dalam Mengetahui Tingkat Keamanan Web Aplikasi Sistem Informasi Laporan Diskominfo Dan Sandi Aceh

Along with the increasing need for information systems in the Districts/Cities of Aceh Province in supporting the development process of a region, the penetration test and evaluation of the system has been delayed. This is due to the limited number of experts in the province as well as the level of dependence on human resources in Districts/Cities who have limited capacity in terms of testing information systems. Therefore, with the presence of the latest web application information system at Diskominfo and Sandi Aceh, it requires system testing to determine the feasibility level of publication of the information system. The testing technique in this study used the VAPT Life Cycle method. Where the VAPT Life Cycle will identify, describe, assess vulnerabilities based on the CVSS (Common Vulnerability Scoring System) and provide solutions for handling vulnerabilities. The vulnerability discovery process in this study uses the Nessus Vulnerability Scanning tool. From the findings there are 4 vulnerabilities, 1 in the high category and 3 in the medium category. This vulnerability data can be used as evaluation material to close or fix existing security holes.

Support for the Vulnerability Management Process Using Conversion CVSS Base Score 2.0 to 3.x.

COVID-19 forced a number of changes in many areas of life, which resulted in an increase in human activity in cyberspace. Furthermore, the number of cyberattacks has increased. In such circumstances, detection, accurate prioritisation, and timely removal of critical vulnerabilities is of key importance for ensuring the security of various organisations. One of the most-commonly used vulnerability assessment standards is the Common Vulnerability Scoring System (CVSS), which allows for assessing the degree of vulnerability criticality on a scale from 0 to 10. Unfortunately, not all detected vulnerabilities have defined CVSS base scores, or if they do, they are not always expressed using the latest standard (CVSS 3.x). In this work, we propose using machine learning algorithms to convert the CVSS vector from Version 2.0 to 3.x. We discuss in detail the individual steps of the conversion procedure, starting from data acquisition using vulnerability databases and Natural Language Processing (NLP) algorithms, to the vector mapping process based on the optimisation of ML algorithm parameters, and finally, the application of machine learning to calculate the CVSS 3.x vector components. The calculated example results showed the effectiveness of the proposed method for the conversion of the CVSS 2.0 vector to the CVSS 3.x standard.

An active defense model based on situational awareness and firewalls

SummaryWith the rapid development of the internet, cyberspace security issues have become increasingly prominent. The importance of constructing a cyberspace security system is self‐evident, but compared with attackers, defenders in cyberspace are in a castle‐like passive defense state in most cases. Therefore, building a reliable, accurate, timely, and active defense system is challenging. The key is to accurately focus on defense priorities, the anticipation of attackers who will likely succeed, and blocking attacks in a timely manner. In this article, we propose an active defense model based on the interaction of situational awareness and firewalls. First, by biasing the integrity, confidentiality, and availability of assets to get the score of assets, and using the Common Vulnerability Scoring System to assess the threat level of assets, we combine the two to determine the maximum system damage that the asset will suffer if it is lost, and then focus on defense. Meanwhile, log analysis of the network situational awareness platform can predict successful attackers, and then the linked firewall strategy can block these attacks in time before the attackers obtain attack gains. After that, we force the attackers to give up their attacks on the target by increasing the attack cost. We compared our model with iptables auto‐blocking and nginx auto‐blocking, and our model excelled them across the board in terms of comprehensiveness and false positive rate. The experimental results verify thar our active defense model proposed in this article can better reduce the defense cost and increase the attack cost, thus achieving the relatively defense goal.

Intelligent Vehicular Communication Using Vulnerability Scoring Based Routing Protocol

Internet of Vehicles (IoV) is an intelligent vehicular technology that allows vehicles to communicate with each other via internet. Communications and the Internet of Things (IoT) enable cutting-edge technologies including such self-driving cars. In the existing systems, there is a maximum communication delay while transmitting the messages. The proposed system uses hybrid Co-operative, Vehicular Communication Management Framework called CAMINO (CA). Further it uses, energy efficient fast message routing protocol with Common Vulnerability Scoring System (CVSS) methodology for improving the communication delay, throughput. It improves security while transmitting the messages through networks. In this research, we present a unique intelligent vehicular infrastructure communication management framework. This framework includes additional stability for both short and long-range mobile communications. It also includes built-in cooperative intelligent transport system (C-ITS) capabilities for experimental verification in real-world contexts. In addition, an energy efficient-fast message distribution routing protocol (EE-FMDRP) has been presented. This combines the benefits between both temporal and direction oriented routing methods. This has been suggested for distributing information from the origin ends to the predetermined objective in a quick, accurate, and effective manner in the event of an emergency. The critical value scale score(CVSS) employ ratings to measure the assault probability in Markov chains. Probabilities of chained transitions allow us to statistically evaluate the integrity of a group of IoV assets. Thus the proposed method helps to enhance the vehicular systems. The CAMINO with energy efficient fast protocol using CVSS (CA- EEFP-CVSS) method outperforms in terms of shortest transmission latency achieves 2.6 sec, highest throughput 11.6%, and lowest energy usage 17% and PDR 95.78%.