# Efficient Algorithm for Providing Live Vulnerability Assessment in Corporate Network Environment
## 1 Introduction  
Companies, governments and ordinary citizens notice the increasing importance of cybersecurity in daily life. During the first half of 2020, about 9799 new vulnerabilities were reported [1]. This indicates the increase of 34% in comparison with the same time span in 2019. The researchers active in the field of cybersecurity believe that in 2020 the number of detected vulnerabilities will reach another record value. Furthermore, due to the ongoing Covid-19 pandemic [1] and related increased use of internet services, the cybersecurity issues have the potential to affect a much larger, than in previous years, part of the human population. Consequently, the identification and prioritization of vulnerabilities becomes a critical issue for a company that offers internet services [1, 2]. Vulnerability Management (VM) and Vulnerability Assessment (VA) are the proactive security layers against threats which commercial companies may face. In addition, they present a challenge for many organizations [3]. The first issue related to vulnerability management is the time passing between vulnerability identification and elimination. As [PERSON] explains, \"most organizations follow a philosophy of gradual risk reduction, with vulnerability and patch management policies focused on mitigating and patching a percentage of vulnerabilities in a given time frame, for example, remediate90% of high severity vulnerabilities within two weeks of discovery. This reduces vulnerability management to a pure metrics exercise, where risk is expressed as a numerical value that can be reduced.\" [4]. The fact is that in 90% of all cases a potential adversary is not going to be focused on the patched or remediated vulnerabilities but on the remaining 10%. [PERSON] and [PERSON] discuss in [5] the importance of the time reaction to new threats, stress the importance of quick vulnerability prioritization and patch, and show how short reaction time results in maximization of the effort required to breach the lines of defense. Other important points related to VM are [3]:  
* there is no successful VM without effective communication,
* insufficient resources allocated to remediate the detected vulnerabilities, will cause vulnerability accumulation,
* fixing only \"high\" and \"critical\" vulnerabilities is not enough. The above points stem from the fact that all vendors [6; 7; 8; 9] provide their own methods of vulnerability prioritization without informing the end-user about the details of the decision making process. The unfamiliarity with prioritization algorithms may adversely affect the process of fixing the vulnerabilities since the companies that use particular software suite are left relying on unknown prioritization algorithms. In this contribution authors have developed a distributed system--Vulnerability Management Centre (VMC) [10]--operating in a scalable, containerized environment. VMC allows the CVSS Environmental score to be calculated in an automatic manner. The developed VMC collects automatically information on vulnerabilities from publicly accessible sources. Then, VMC gathers information regarding vulnerabilities present in the system and integrates this data with the data obtained from the inventory database. Thus VMC is able to normalize accrued information and perform environmental calculations taking the relevant variables into consideration, e.g., Target Distribution (\(T_{D}\)) or Confidentiality, Integrity and Accessibility (CIA) triad. In addition, due to application of Smart Data algorithms [11; 12] the developed VMC is capable of presenting results almost in real time to stakeholders. The small delay depends on computational resources available and the amount of data coming from a vulnerability scan. Thus, the developed VMC is vastly superior to standard systems whereby a monthly report is sent to the stakeholders each month based on previous month's data.