NDLI: Comparing Vulnerability Severity and Exploits Using Case-Control Studies

Please wait, while we are loading the content...

ACM Transactions on Information and System Security (TISSEC) : Volume 18

ACM Transactions on Information and System Security (TISSEC) : Volume 17

Issue 4, April 2015

Issue 3, March 2015

Issue 2, November 2014

Issue 1, August 2014

Comparing Vulnerability Severity and Exploits Using Case-Control Studies

Rumpole: An Introspective Break-Glass Access Control Language

A Framework for Expressing and Enforcing Purpose-Based Privacy Policies

Security Analysis of Accountable Anonymity in Dissent

ACM Transactions on Information and System Security (TISSEC) : Volume 16

ACM Transactions on Information and System Security (TISSEC) : Volume 15

ACM Transactions on Information and System Security (TISSEC) : Volume 14

ACM Transactions on Information and System Security (TISSEC) : Volume 13

ACM Transactions on Information and System Security (TISSEC) : Volume 12

ACM Transactions on Information and System Security (TISSEC) : Volume 11

ACM Transactions on Information and System Security (TISSEC) : Volume 10

ACM Transactions on Information and System Security (TISSEC) : Volume 9

ACM Transactions on Information and System Security (TISSEC) : Volume 8

ACM Transactions on Information and System Security (TISSEC) : Volume 7

ACM Transactions on Information and System Security (TISSEC) : Volume 6

ACM Transactions on Information and System Security (TISSEC) : Volume 5

ACM Transactions on Information and System Security (TISSEC) : Volume 4

ACM Transactions on Information and System Security (TISSEC) : Volume 3

ACM Transactions on Information and System Security (TISSEC) : Volume 2

ACM Transactions on Information and System Security (TISSEC) : Volume 1

Comparing Vulnerability Severity and Exploits Using Case-Control Studies

Content Provider	ACM Digital Library
Author	Allodi, Luca Massacci, Fabio
Copyright Year	2014
Abstract	(U.S.) Rule-based policies for mitigating software risk suggest using the CVSS score to measure the risk of an individual vulnerability and act accordingly. A key issue is whether the ‘danger’ score does actually match the risk of exploitation in the wild, and if and how such a score could be improved. To address this question, we propose using a case-control study methodology similar to the procedure used to link lung cancer and smoking in the 1950s. A case-control study allows the researcher to draw conclusions on the relation between some risk factor (e.g., smoking) and an effect (e.g., cancer) by looking backward at the $\textit{cases}$ (e.g., patients) and comparing them with $\textit{controls}$ (e.g., randomly selected patients with similar characteristics). The methodology allows us to quantify the risk reduction achievable by acting on the risk factor. We illustrate the methodology by using publicly available data on vulnerabilities, exploits, and exploits in the wild to (1) evaluate the performances of the current risk factor in the industry, the CVSS base score; (2) determine whether it can be improved by considering additional factors such the existence of a proof-of-concept exploit, or of an exploit in the black markets. Our analysis reveals that (a) fixing a vulnerability just because it was assigned a high CVSS score is equivalent to randomly picking vulnerabilities to fix; (b) the existence of proof-of-concept exploits is a significantly better risk factor; (c) fixing in response to exploit presence in black markets yields the largest risk reduction.
Starting Page	1
Ending Page	20
Page Count	20
File Format	PDF
ISSN	10949224
e-ISSN	15577406
DOI	10.1145/2630069
Volume Number	17
Issue Number	1
Journal	ACM Transactions on Information and System Security (TISSEC)
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2014-08-15
Publisher Place	New York
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	CVSS Software vulnerability Compliance Exploitation Patching
Content Type	Text
Resource Type	Article
Subject	Computer Science Safety, Risk, Reliability and Quality

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Comparing and Evaluating CVSS Base Metrics and Microsoft Rating System

Evaluating CVSS Base Score Using Vulnerability Rewards Programs

1Comparing Vulnerability Severity and Exploits Using Case-Control Studies

Assessing vulnerability exploitability risk using software properties

Optimal release and patching time of software with warranty

Shield:vulnerability-driven network filters for preventing known vulnerability exploits

Fault severity based multi-release SRGM with testing resources

Modeling multi up-gradations of software with fault severity and measuring reliability for each release

Testing effort based modeling to determine optimal release and patching time of software

Comparing Vulnerability Severity and Exploits Using Case-Control Studies

Similar Documents

Comparing and Evaluating CVSS Base Metrics and Microsoft Rating System

Evaluating CVSS Base Score Using Vulnerability Rewards Programs

1Comparing Vulnerability Severity and Exploits Using Case-Control Studies

Assessing vulnerability exploitability risk using software properties

Optimal release and patching time of software with warranty

Shield:vulnerability-driven network filters for preventing known vulnerability exploits

Fault severity based multi-release SRGM with testing resources

Modeling multi up-gradations of software with fault severity and measuring reliability for each release

Testing effort based modeling to determine optimal release and patching time of software

Comparing Vulnerability Severity and Exploits Using Case-Control Studies