A quantitative CVSS-based cyber security risk assessment methodology for IT systems

M. Ugur Aksu; M. Hadi Dilek; E. Islam Tatli; Kemal Bicakci; H. Ibrahim Dirik; M. Umut Demirezen; Tayfun Aykir

doi:10.1109/CCST.2017.8167819

A quantitative CVSS-based cyber security risk assessment methodology for IT systems

M. Ugur Aksu, M. Hadi Dilek, E. Islam Tatli, Kemal Bicakci, H. Ibrahim Dirik, M. Umut Demirezen, Tayfun Aykir

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

59 Citations (Scopus)

Abstract

IT system risk assessments are indispensable due to increasing cyber threats within our ever-growing IT systems. Moreover, laws and regulations urge organizations to conduct risk assessments regularly. Even though there exist several risk management frameworks and methodologies, they are in general high level, not defining the risk metrics, risk metrics values and the detailed risk assessment formulas for different risk views. To address this need, we define a novel risk assessment methodology specific to IT systems. Our model is quantitative, both asset and vulnerability centric and defines low and high level risk metrics. High level risk metrics are defined in two general categories; base and attack graph-based. In our paper, we provide a detailed explanation of formulations in each category and make our implemented software publicly available for those who are interested in applying the proposed methodology to their IT systems.

Original language	English
Title of host publication	Proceedings - 2017 International Carnahan Conference on Security Technology, ICCST 2017
Editors	Javier Ortega-Garcia, Aythami Morales, Julian Fierrez, Ruben Vera-Rodriguez, Riccardo Lazzeretti
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	1-8
Number of pages	8
ISBN (Electronic)	9781538615850
DOIs	https://doi.org/10.1109/CCST.2017.8167819
Publication status	Published - 5 Dec 2017
Externally published	Yes
Event	2017 International Carnahan Conference on Security Technology, ICCST 2017 - Madrid, Spain Duration: 23 Oct 2017 → 26 Oct 2017

Publication series

Name	Proceedings - International Carnahan Conference on Security Technology
Volume	2017-October
ISSN (Print)	1071-6572

Conference

Conference	2017 International Carnahan Conference on Security Technology, ICCST 2017
Country/Territory	Spain
City	Madrid
Period	23/10/17 → 26/10/17

Bibliographical note

Publisher Copyright:
© 2017 IEEE.

Keywords

attack graphs
cyber security risks
risk assessment
risk metrics
vulnerability management

Access to Document

10.1109/CCST.2017.8167819

Cite this

Aksu, M. U., Dilek, M. H., Tatli, E. I., Bicakci, K., Dirik, H. I., Demirezen, M. U., & Aykir, T. (2017). A quantitative CVSS-based cyber security risk assessment methodology for IT systems. In J. Ortega-Garcia, A. Morales, J. Fierrez, R. Vera-Rodriguez, & R. Lazzeretti (Eds.), Proceedings - 2017 International Carnahan Conference on Security Technology, ICCST 2017 (pp. 1-8). (Proceedings - International Carnahan Conference on Security Technology; Vol. 2017-October). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/CCST.2017.8167819

Aksu, M. Ugur ; Dilek, M. Hadi ; Tatli, E. Islam et al. / A quantitative CVSS-based cyber security risk assessment methodology for IT systems. Proceedings - 2017 International Carnahan Conference on Security Technology, ICCST 2017. editor / Javier Ortega-Garcia ; Aythami Morales ; Julian Fierrez ; Ruben Vera-Rodriguez ; Riccardo Lazzeretti. Institute of Electrical and Electronics Engineers Inc., 2017. pp. 1-8 (Proceedings - International Carnahan Conference on Security Technology).

@inproceedings{c2e013dc0e7145e493ee96663d822dc5,

title = "A quantitative CVSS-based cyber security risk assessment methodology for IT systems",

abstract = "IT system risk assessments are indispensable due to increasing cyber threats within our ever-growing IT systems. Moreover, laws and regulations urge organizations to conduct risk assessments regularly. Even though there exist several risk management frameworks and methodologies, they are in general high level, not defining the risk metrics, risk metrics values and the detailed risk assessment formulas for different risk views. To address this need, we define a novel risk assessment methodology specific to IT systems. Our model is quantitative, both asset and vulnerability centric and defines low and high level risk metrics. High level risk metrics are defined in two general categories; base and attack graph-based. In our paper, we provide a detailed explanation of formulations in each category and make our implemented software publicly available for those who are interested in applying the proposed methodology to their IT systems.",

keywords = "attack graphs, cyber security risks, risk assessment, risk metrics, vulnerability management",

author = "Aksu, {M. Ugur} and Dilek, {M. Hadi} and Tatli, {E. Islam} and Kemal Bicakci and Dirik, {H. Ibrahim} and Demirezen, {M. Umut} and Tayfun Aykir",

note = "Publisher Copyright: {\textcopyright} 2017 IEEE.; 2017 International Carnahan Conference on Security Technology, ICCST 2017 ; Conference date: 23-10-2017 Through 26-10-2017",

year = "2017",

month = dec,

day = "5",

doi = "10.1109/CCST.2017.8167819",

language = "English",

series = "Proceedings - International Carnahan Conference on Security Technology",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "1--8",

editor = "Javier Ortega-Garcia and Aythami Morales and Julian Fierrez and Ruben Vera-Rodriguez and Riccardo Lazzeretti",

booktitle = "Proceedings - 2017 International Carnahan Conference on Security Technology, ICCST 2017",

address = "United States",

}

Aksu, MU, Dilek, MH, Tatli, EI, Bicakci, K, Dirik, HI, Demirezen, MU & Aykir, T 2017, A quantitative CVSS-based cyber security risk assessment methodology for IT systems. in J Ortega-Garcia, A Morales, J Fierrez, R Vera-Rodriguez & R Lazzeretti (eds), Proceedings - 2017 International Carnahan Conference on Security Technology, ICCST 2017. Proceedings - International Carnahan Conference on Security Technology, vol. 2017-October, Institute of Electrical and Electronics Engineers Inc., pp. 1-8, 2017 International Carnahan Conference on Security Technology, ICCST 2017, Madrid, Spain, 23/10/17. https://doi.org/10.1109/CCST.2017.8167819

A quantitative CVSS-based cyber security risk assessment methodology for IT systems. / Aksu, M. Ugur; Dilek, M. Hadi; Tatli, E. Islam et al.
Proceedings - 2017 International Carnahan Conference on Security Technology, ICCST 2017. ed. / Javier Ortega-Garcia; Aythami Morales; Julian Fierrez; Ruben Vera-Rodriguez; Riccardo Lazzeretti. Institute of Electrical and Electronics Engineers Inc., 2017. p. 1-8 (Proceedings - International Carnahan Conference on Security Technology; Vol. 2017-October).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - A quantitative CVSS-based cyber security risk assessment methodology for IT systems

AU - Aksu, M. Ugur

AU - Dilek, M. Hadi

AU - Tatli, E. Islam

AU - Bicakci, Kemal

AU - Dirik, H. Ibrahim

AU - Demirezen, M. Umut

AU - Aykir, Tayfun

PY - 2017/12/5

Y1 - 2017/12/5

N2 - IT system risk assessments are indispensable due to increasing cyber threats within our ever-growing IT systems. Moreover, laws and regulations urge organizations to conduct risk assessments regularly. Even though there exist several risk management frameworks and methodologies, they are in general high level, not defining the risk metrics, risk metrics values and the detailed risk assessment formulas for different risk views. To address this need, we define a novel risk assessment methodology specific to IT systems. Our model is quantitative, both asset and vulnerability centric and defines low and high level risk metrics. High level risk metrics are defined in two general categories; base and attack graph-based. In our paper, we provide a detailed explanation of formulations in each category and make our implemented software publicly available for those who are interested in applying the proposed methodology to their IT systems.

AB - IT system risk assessments are indispensable due to increasing cyber threats within our ever-growing IT systems. Moreover, laws and regulations urge organizations to conduct risk assessments regularly. Even though there exist several risk management frameworks and methodologies, they are in general high level, not defining the risk metrics, risk metrics values and the detailed risk assessment formulas for different risk views. To address this need, we define a novel risk assessment methodology specific to IT systems. Our model is quantitative, both asset and vulnerability centric and defines low and high level risk metrics. High level risk metrics are defined in two general categories; base and attack graph-based. In our paper, we provide a detailed explanation of formulations in each category and make our implemented software publicly available for those who are interested in applying the proposed methodology to their IT systems.

KW - attack graphs

KW - cyber security risks

KW - risk assessment

KW - risk metrics

KW - vulnerability management

UR - http://www.scopus.com/inward/record.url?scp=85042294127&partnerID=8YFLogxK

U2 - 10.1109/CCST.2017.8167819

DO - 10.1109/CCST.2017.8167819

M3 - Conference contribution

AN - SCOPUS:85042294127

T3 - Proceedings - International Carnahan Conference on Security Technology

SP - 1

EP - 8

BT - Proceedings - 2017 International Carnahan Conference on Security Technology, ICCST 2017

A2 - Ortega-Garcia, Javier

A2 - Morales, Aythami

A2 - Fierrez, Julian

A2 - Vera-Rodriguez, Ruben

A2 - Lazzeretti, Riccardo

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 2017 International Carnahan Conference on Security Technology, ICCST 2017

Y2 - 23 October 2017 through 26 October 2017

ER -

Aksu MU, Dilek MH, Tatli EI, Bicakci K, Dirik HI, Demirezen MU et al. A quantitative CVSS-based cyber security risk assessment methodology for IT systems. In Ortega-Garcia J, Morales A, Fierrez J, Vera-Rodriguez R, Lazzeretti R, editors, Proceedings - 2017 International Carnahan Conference on Security Technology, ICCST 2017. Institute of Electrical and Electronics Engineers Inc. 2017. p. 1-8. (Proceedings - International Carnahan Conference on Security Technology). doi: 10.1109/CCST.2017.8167819

A quantitative CVSS-based cyber security risk assessment methodology for IT systems

Abstract

Publication series

Conference

Bibliographical note

Keywords

Access to Document

Other files and links

Fingerprint

Cite this