Simple Method of Automatic Risks Assessment for Web Systems Considering Assets Sensitivity
summary
Proposes an automated risk score that combines published CVSS base scores with an automatically computed asset-sensitivity metric derived from access logs and a web crawler that extracts pages and counts login forms, parameters and unique IPs. Implements confidentiality/integrity/availability logits, tests on 18 systems from a real company, and shows ranking aligns with prior importance (positive correlation, Spearman's rho 0.82). Demonstrates clear reordering of patch priority and notes crawling and contact-form limits.
AI-written summary · about
chapters (10)
- 0:00Intro
- 1:02Overview
- 5:30Problems with CVSS-based risks assessment
- 9:42Data collection
- 11:471. Confidentiality Calculation of sensitivity of confidentiality is based on login form existence and of accesses
- 15:042-3. Availability
- 15:52Output of risk score
- 17:45Evaluation experiment
- 19:59Assets sensitivity and rank (detail)
- 21:59Case study Evaluation of risk score for each vulnerability related to web server
related talks
58mNothing to Risk but Risk Itself: Expanding Vulnerability Risk with Internet-Scale Data
39mHard to Port! - A Snapshot of the Vulnerability Landscape in 2015
43mSecurity Vulnerabilities Decomposition: Another way to look at Vulnerabilities
48mMethod of detecting vulnerability in WebApps using Machine Learning
43mThe Art of Vulnerability Management - Practical Application of Cyber Triage- 43mThe Art of Vulnerability Management - Practical Application of Cyber Triage
26mCybersecurity Risk Assessment for Safety-Critical Systems
37mPrioritizing Vulnerability Response with a Stakeholder Specific Vulnerability Categorization