Estimating ToE Risk Level Using CVSS

12 years 6 months ago
Estimating ToE Risk Level Using CVSS
—Security management is about calculated risk and requires continuous evaluation to ensure cost, time and resource effectiveness. Parts of which is to make future-oriented, costbenefit investments in security. Security investments must adhere to healthy business principles where both security and financial aspects play an important role. Information on the current and potential risk level is essential to successfully trade-off security and financial aspects. Risk level is the combination of the frequency and impact of a potential unwanted event, often referred to as a security threat or misuse. The paper presents a risk level estimation model that derives risk level as a conditional probability over frequency and impact estimates. The frequency and impact estimates are derived from a set of attributes specified in the Common Vulnerability Scoring System (CVSS). The model works on the level of vulnerabilities (just as the CVSS) and is able to compose vulnerabilities into service l...
Siv Hilde Houmb, Virginia N. L. Franqueira
Added 19 May 2010
Updated 19 May 2010
Type Conference
Year 2009
Authors Siv Hilde Houmb, Virginia N. L. Franqueira
Comments (0)