Simple Method of Automatic Risks Assessment for Web Systems Considering Assets Sensitivity
Channel: FIRST
Date: 2021-06-17

Speaker: Mitsuharu Sasaki (NTT, JP)

Since the number of reported vulnerabilities in software has been increasing year by year, it is necessary to prioritize vulnerability countermeasures based on risks assessment in order to deal with the large number of vulnerabilities. According to risk model, risk has three factors (assets, threats, and vulnerabilities) and we must consider them, but risks assessment is not an easy task because it requires high skills and work costs. Therefore, analysts prioritize vulnerabilities using CVSS score. However the published CVSS scores focus on vulnerability and threat, it does not consider assets sensitivity. When vulnerabilities are assessed using CVSS scores, it is difficult to prioritize them based on their true risk, which may lead to fail to prioritize high-risk vulnerabilities or spend too much money on security countermeasures.

In this talk, we will explain a method to evaluate risk automatically by combining CVSS and assets sensitivity in order to solve this problem. Assets sensitivity bases on the viewpoints of confidentiality, integrity and availability. Proposed method automatically calculates assets sensitivity using access logs and web contents and output risk score based on Environmental Metrics in CVSS without advanced skills. We will show how to evaluate risk of vulnerabilities automatically in web systems operated by an actual company. 

About the Speaker
Mitsuharu Sasaki, CISSP, CCSP is research engineer at NTT Secure Platform Laboratories and also a member of NTT-CERT. He studied information science at Graduate School of Information Sciences, Tohoku University. He has 7 years of experience in vulnerability assessment and management. He contributes to the improvement of information-systems security for the NTT Group.