Evaluating Damage Potential in Security Risk Scoring Models

A Continuous Monitoring System (CMS) model is presented, having new improved capabilities. The system is based on the actual real-time configuration of the system. Existing risk scoring models assume damage potential is estimated by systems' owner, thus rejecting the information relying in the technological configuration. The assumption underlying this research is based on users' ability to estimate business impacts relating to systems' external interfaces which they use regularly in their business activities, but are unable to assess business impacts relating to internal technological components. According to the proposed model systems' damage potential is calculated using technical information on systems' components using a directed graph. The graph is incorporated into the Common Vulnerability Scoring Systems' (CVSS) algorithm to produce risk scoring measures. Framework presentation includes system design, damage potential scoring algorithm design and an illustration of scoring computations.

@article{Weintraub2016,
  title     = {Evaluating Damage Potential in Security Risk Scoring Models},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {7},
  number    = {5},
  year      = {2016},
  publisher = {The Science and Information Organization},
  author    = {Eli Weintraub},
  doi       = {10.14569/IJACSA.2016.070547},
  url       = {https://doi.org/10.14569/IJACSA.2016.070547}
}