• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>IEEE International Conference on Autonomic Computing and Self-Organizing Systems Companion >Normalization of Severity Rating for Automated Context-aware Vulnerability Risk Management
【24h】

Normalization of Severity Rating for Automated Context-aware Vulnerability Risk Management

机译：自动化的上下文感知漏洞风险管理的严重性等级标准化

获取原文
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

In the last three years, the unprecedented increase in discovered vulnerabilities ranked with critical and high severity raise new challenges in Vulnerability Risk Management (VRM). Indeed, identifying, analyzing and remediating this high rate of vulnerabilities is labour intensive, especially for enterprises dealing with complex computing infrastructures such as Infrastructure-as-a-Service providers. Hence there is a demand for new criteria to prioritize vulnerabilities remediation and new automated/autonomic approaches to VRM.In this paper, we address the above challenge proposing an Automated Context-aware Vulnerability Risk Management (ACVRM) methodology that aims: to reduce the labour intensive tasks of security experts; to prioritize vulnerability remediation on the basis of the organization context rather than risk severity only. The proposed solution considers multiple vulnerabilities databases to have a great coverage on known vulnerabilities and to determine the vulnerability rank. After the description of the new VRM methodology, we focus on the problem of obtaining a single vulnerability score by normalization and fusion of ranks obtained from multiple vulnerabilities databases. Our solution is a parametric normalization that accounts for organization needs/specifications.
机译：在过去的三年中，发现的漏洞数量前所未有地增加，其严重程度和严重程度排名很高，这给漏洞风险管理（VRM）带来了新的挑战。确实，识别，分析和补救这种高漏洞率是非常费力的，特别是对于处理诸如基础架构即服务提供商之类的复杂计算基础架构的企业而言。因此，需要新的标准来优先考虑漏洞修复的优先级以及采用新的VRM自动化/自动方法。在本文中，我们解决了上述挑战，提出了一种自动化的上下文感知漏洞风险管理（ACVRM）方法，其目的是：减少工作量安全专家的繁重任务;根据组织环境而不是仅根据风险严重性来确定漏洞修复的优先级。提出的解决方案考虑了多个漏洞数据库，可以很好地覆盖已知漏洞并确定漏洞等级。在对新的VRM方法进行描述之后，我们将重点讨论通过规范化和融合从多个漏洞数据库获得的等级来获得单个漏洞评分的问题。我们的解决方案是一种参数归一化，可以解决组织的需求/规范。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号