# A Dynamic Risk Assessment and Mitigation Model
## 5 Case Study
### Dynamic Risk Calculator and Mitigations
#### 5.4.1 Risk Scenario 1  
This section presents the dynamic risk estimations and the proposed mitigation suggestions, focusing on risk scenario 1, as shown in Table 16. Specifically, \(DVSV\) represents the dynamic vulnerability severity value, which is the outcome of the FCM model; \(DPTS\) represents the dynamic and proactive threat scores, which is the output of the Bayesian network; and \(DRA\) represents the dynamic risk assessment for the given asset (CVE).  
Following the successful dynamic risk estimations, the next step involves identifying and proposing relevant mitigation actions for the specific risk scenario. To achieve this, we utilize the information retrieved in module 1, pertaining to mitigation suggestions. Table 17 presents these results.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Asset** & **CVE** & **DVSV** & **DPTS** & **Impact** & **DRA** \\ \hline VPN & CVE-2019-11510 & 0.622 & 0.945 & 1.000 & 0.588 \\ WS1 & CVE-2017-0143 & 0.610 & 0.885 & 0.983 & 0.531 \\ DB & CVE-2021-41773 & 0.648 & 0.838 & 0.600 & 0.326 \\ \hline \hline \end{tabular}
\end{table}
Table 16: DRA—risk scenario 1.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Risk Scenario** & **VPN** & **WebS** & **WS1** & **WS2** & **DB** \\ \hline
1 & 0.945 & - & 0.885 & - & 0.838 \\
2 & 0.945 & - & - & 0.074 & 0.070 \\
3 & - & 0.935 & 0.877 & - & 0.830 \\
4 & - & 0.935 & - & 0.073 & 0.069 \\ \hline \hline \end{tabular}
\end{table}
Table 15: Proactive and dynamic threat scores—all scenarios.  
A total of five CAPECs corresponding to the detected CVEs have been identified. Additionally, it has been observed that all CVEs detected in this scenario are listed in the CISA KEV Catalog. This indicates that these vulnerabilities have been exploited in real-world scenarios and that clear remediation guidance is available. Although the complete description of the mitigation actions suggested by each CAPEC can be found on the CAPEC website, we provide a summary of the proposed actions for each identified CAPEC-ID.  
**CAPEC-126:**: _Focus on enforcing least privilege and running programs with constrained privileges. Validate and sanitize all input using an allowlist and strict checks. Use proxy communication to sanitize requests, monitor host integrity, and enforce file access permissions_  
**CAPEC-64:**: _Treat all input as malicious and validate it using an allowlist. Ensure security checks after decoding, use POST instead of GET for web forms, and validate URLs with tools like URL scan._  
**CAPEC-76:**: _Apply the principle of least privilege and validate all input to prevent unsafe file system commands. Use non-root accounts or droroof jails, and conduct pen-testing and vulnerability scans to identify weaknesses._  
**CAPEC-78:**: _Assume all input is malicious and validate it against an allowlist. Prevent unauthorized directory access by applying least privilege and rejecting suspicious data after decoding._  
**CAPEC-79:**: _Validate and sanitize all input with an allowlist and perform security checks after decoding. Use POST for web forms, reject unsafe data, and ensure file system access adheres to the least privilege principle._