# Vulnerability Management Models Using a Common Vulnerability Scoring System
## 4 Methods
Therefore, the equation used for the calculation of the time needed to eliminate all vulnerabilities with high and medium criticality with the first model (Figure 1) is expressed as follows:  
\[T_{Base2}=T_{S}+(T_{FIX}\cdot X_{H_{\text{CVSS 2.0 Base}}})+(T_{FIX}\cdot X_{M_{\text{CVSS 2.0 Base}}})+(T_{FIX}\cdot X_{L_{\text{CVSS 2.0 Base}}}) \tag{1}\]  
where \(T_{FIX}\) is the number of work hours required to fix one vulnerability, and \(X_{H_{\text{CVSS 2.0 Base}}}\), \(X_{M_{\text{CVSS 2.0 Base}}}\), and \(X_{L_{\text{CVSS 2.0 Base}}}\) are the numbers of vulnerabilities with high, medium, and low severity, respectively, according to the base CVSS 2.0 score. For the vulnerability management model based on the base CVSS 3.x score (Figure 1), the number of critical vulnerabilities (\(X_{C}\)) was added to the equation discussed above. Consequently, the equation for the calculation of the time needed to eliminate all vulnerabilities with high and medium criticality is as follows:  
\[T_{Base3} = T_{S}+(T_{FIX}\cdot X_{\text{CVSS 3.x Base}})+(T_{FIX}\cdot X_{H_{\text{CVSS 3.x Base}}})+(T_{FIX}\cdot X_{M_{\text{CVSS 3.x Base}}})+(T_{FIX}\cdot X_{L_{\text{CVSS 3.x Base}}})\] (2) where \(X_{\text{CVSS 3.x Base}}\), \(X_{H_{\text{CVSS 3.x Base}}}\), \(X_{M_{\text{CVSS 3.x Base}}}\), and \(X_{L_{\text{CVSS 3.x Base}}}\) are the numbers of vulnerabilities with critical, high, medium, and low severity, respectively, according to the base CVSS 3.x score. In the case of the models that use the environmental assessment, the time taken for re-prioritization with the newly developed VMC software (\(T_{VMC}\)) should additionally be taken into consideration. Furthermore, the part of the equation that is responsible for the number of work hours required to fix low vulnerabilities does not have to be included, as the environmental assessment is assumed to perform the prioritization accurately and, thus, removes the risk of classifying a vulnerability with medium criticallity as a vulnerability with low criticality, which is possible when considering only the base score and not including the environmental variables. Thus, considering CVSS 2.0 environmental score (Figure 2), the following equation is obtained:  
\[T_{Env2}=T_{S}+T_{VMC}+(T_{FIX}\cdot X_{H_{\text{CVSS 2.0 Environmental}}})+(T_{FIX}\cdot X_{M_{\text{CVSS 2.0 Environmental}}}) \tag{3}\]  
where \(T_{VMC}\) is the time taken to perform the re-prioritization with the VMC software, and \(X_{H_{\text{CVSS 2.0 Environmental}}}\) and \(X_{M_{\text{CVSS 2.0 Environmental}}}\) are, respectively, the number of vulnerabilities with high and medium severity according to the CVSS 2.0 environmental score. Similarly, in the case of the model with the CVSS 3.x environmental score (Figure 2), the following equation is obtained:  
\[T_{Env3} = T_{S}+T_{VMC}+(T_{FIX}\cdot X_{\text{CVSS 3.x Environmental}})+(T_{FIX}\cdot X_{H_{\text{CVSS 3.x Environmental}}})+(T_{FIX}\cdot X_{M_{\text{CVSS 3.x Environmental}}})\] (4) \[\text{where }X_{C_{\text{CVSS 3.x Environmental}}}\text{ }X_{H_{\text{CVSS 3.x Environmental}}}\text{, and }X_{M_{\text{CVSS 3.x Environmental}}}\text{ are, respectively, the numbers of vulnerabilities with critical, high, and medium criticality according to the CVSS 3.x environmental score.  
To investigate the impact of the environmental factors on the base CVSS score, the following equation was used:  
\[d=X_{CVSS_{Base}}-X_{CVSS_{Env}} \tag{5}\]  
where \(d\) is the difference between the received scores, \(X_{CVSS_{Base}}\) is the base score obtained from the Nessus scanner, and \(X_{CVSS_{Env}}\) is the environmental score calculated with the VMC software. If a negative value is obtained for \(d\), this indicates that the environmental score has been lowered with respect to the base score; likewise, a positive value of \(d\) indicates that the environmental score is higher than the base score. In order to determine the number of changes in the vulnerability prioritization for the CVSS 2.0 and CVSS 3.x scores, all unique occurrences of the \(d\) values received were counted.