# A Dynamic Risk Assessment and Mitigation Model
## 5 Case Study
### Dynamic Risk Calculator and Mitigations
#### 5.4.2 Risk Scenario 2  
This section outlines the dynamic risk estimations and proposed mitigation actions, with a focus on risk scenario 2. Table 18 display the outputs generated by our methodology for the second risk scenario. In this scenario, while the assets remain unchanged, the attacker exploits a different CVE. Specifically, instead of targeting CVE-2017-0143 (WS1), the attacker exploits CVE-2017-8692 (WS2). The next step in this process involves determining whether the CVEs associated with the scenario are listed in the CISA KEV Catalog and identifying the corresponding CAPECs to suggest possible mitigations. This information is summarized in Table 19. \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Asset** & **CVE** & **KEV** & **CWE** & **CAPEC** \\ \hline VPN & CVE-2019-11510 & Yes & 22 & 126, 64, 76, 78, 79 \\ WS1 & CVE-2017-0143 & Yes & - & - \\ DB & CVE-2021-41773 & Yes & 22 & 126, 64, 76, 78, 79 \\ \hline \hline \end{tabular}
\end{table} 
Table 17: Risk scenario 1—KEY, CWE, CAPEC. \begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Asset** & **CVE** & **DVSV** & **DPTS** & **Impact** & **DRA** \\ \hline VPN & CVE-2019-11510 & 0.622 & 0.945 & 1.000 & 0.588 \\ WS2 & CVE-2017-8692 & 0.563 & 0.074 & 0.983 & 0.041 \\ DB & CVE-2021-41773 & 0.637 & 0.070 & 0.600 & 0.027 \\ \hline \hline \end{tabular}
\end{table} 
Table 18: Data–risk scenario 2. CVE-2017-8692 is the first identified CVE in this case study and is not listed in the CISA KEV Catalog, indicating that no patch is currently available. The CAPECs associated with CVE-2019-11510 (VPN) and CVE-2021-41773 (DB) are identical to those in risk scenario 1. Conversely, there are 12 new CAPECs associated with CVE-2017-8692 (WS2). While detailed mitigation actions for each CAPEC are provided on the CAPEC website, we present a summary of the recommended actions for each identified CAPEC-ID. **CAPEC-10** : _Do not expose environment variables to the user or use untrusted data in them. Use a language or compiler that performs automatic bounds checking and secure functions to prevent buffer overflows. Tools like Sharefuzz can be used to detect vulnerable environment variables._  
**CAPEC-10**: _Use a language or compiler with automatic bounds checking. Utilize secure functions and perform boundary checking if dangerous functions are necessary. Compiler mechanisms like StackGuard and ProPolice can help, but are not complete solutions. OS-level preventive functionality should be used as well._  
**CAPEC-123**: _Choose a language or compiler that limits buffer manipulation risks, such as Java. For languages like C, use secure functions and perform boundary checking. Tools like StackGuard and ProPolice can assist, and OS-level protections may be applied to prevent issues._  
**CAPEC-14**: _Do not install untrusted code from non-authenticated servers. Ensure client software is patched and validated for vulnerabilities before use. Perform input validation and use secure functions. Utilize canary mechanisms and OS-level protections for additional safety._  
**CAPEC-24**: _Ensure proper handling of failures in filtering or input validation to prevent malicious input from bypassing. Use a language or compiler with bounds checking, canary mechanisms, and OS-level protections, though these are not complete solutions on their own._  
**CAPEC-42**: _Keep third-party vendor patches up to date and disable unnecessary features like 7-8 bit conversion to prevent exploits. Always monitor and patch vulnerabilities in your software._  
**CAPEC-44**: _Perform bounds checking on all buffers and enforce the principle of least privilege. Use static code analysis, execute programs in lower-priulege environments, and ensure software is regularly patched to prevent attacks._  
**CAPEC-45**: _Be cautious of symbolic link vulnerabilities. Validate symlinks before accessing resources and ensure they are located in protected directories.