# A Perfect Match: Converging and Automating Privacy and Security Impact Assessment On-the-Fly
## 4 APSIA Conceptual Architecture and Building Blocks
### Privacy Impact Scoring System
#### 4.3.1 Vulnerability Characterisation  
A vulnerability may appear either as a technical limitation of a system, or a gap in the security procedures and practices of an organisation. We base our method on dynamically detecting vulnerabilities by deploying the OpenVAS Vulnerability Assessment Scanner [48]. In this way, we create a dependence between the infrastructure's asset and their vulnerabilities. The most prominent way of quantifying the severity and the impact that a vulnerability may have on a targeting system, is the adoption of a common and vendor-independent scoring system enables the security society, and especially the risk assessors, to form a common understanding for the criticality level of vulnerabilities. In the context of distributed organisations, there is a need for privacy assessment tool to be deployed on different sites, and thus, the use of an open, independent and globally accepted scoring system is of significant importance in forming a common risk perception among the involved parties. The utilisation of CVSS contributes to the design of a unified risk assessment methodology that leaves aside the diversity of the engaged assets. In fact, depending on the domain, an organisation may utilise a wide range of legacy ICT and domain-specific devices (e.g., IoT, Industrial, Energy, healthcare devices) and applications. Inevitably, such a setup results to an extended attack surface (more vulnerabilities) against a significant amount of data processing activities of Personally Identifiable Information (PII), and thus, an increased possibility of data leakage.  
Last but not least, the adoption of CVSS enables the risk calculations can be compatible both for vulnerabilities of old and legacy ICT assets, as for new ones, and are in-line with global vulnerability repositories. It has to be stated that this is a requirement that must be satisfied by the developed privacy assessment methodology. Crucially, the adoption of CVSS guarantees that all the developed components and automated tools used for threat and vulnerability detection have a common reference point that enhances their interoperability towards the dynamic conduction of the privacy impact assessment.  
Given the above, the vulnerability characterization aims to measure the severity of the vulnerability under the traditional risk assessment perspective. Note that the  
Figure 5: Structural view of Privacy score with the contributing factors.  
vulnerability characterization is one of the contributing factors of the Score Equation (1) and is responsible for reflecting the cyber security status of the assets in the organisation.  
\[\textit{Vulnerability Characterisation}=(0.6\times Impact+0.4\times Exploitability-1.5) \times f(impact) \tag{2}\] \[Impact=10.41\times(1-(1-ConfImpact)\times(1-IntegImpact)\times(1- AvailImpcat))\] \[\textit{Exploitability}=20\times\textit{AccessComplexity}\times \textit{Authentication}\times\textit{AccessVector}\]  
\[f(impact)=\begin{cases}0&\text{impact}=0\\ 1.176&\text{otherwise}\end{cases}\]