# Vulnerability Management Models Using a Common Vulnerability Scoring System
###### Abstract  
Vulnerability prioritization is an essential element of the vulnerability management process in data communication networks. Accurate prioritization allows the attention to be focused on the most critical vulnerabilities and their timely elimination; otherwise, organizations may face severe financial consequences or damage to their reputations. In addition, the large amounts of data generated by various components of security systems further impede the process of prioritizing the detected vulnerabilities. Therefore, the detection and elimination of critical vulnerabilities are challenging tasks. The solutions proposed for this problem in the scientific literature so far--e.g., PatchRank, SecureRank, Vulcon, CMS, VDNF, or VEST--are not sufficient because they do not consider the context of the organization. On the other hand, commercial solutions, such as Nessus, F-Secure, or Qualys, do not provide detailed information regarding the prioritization procedure, except for the scale. Therefore, in this paper, the authors present an open-source solution called the Vulnerability Management Center (VMC) in order to assist organizations with the vulnerability prioritization process. The VMC presents all calculated results in a standardized way by using a Common Vulnerability Scoring System (CVSS), which allows security analysts to fully understand environmental components' influences on the criticality of detected vulnerabilities. In order to demonstrate the benefits of using the the open-source VMC software developed here, selected models of a vulnerability management process using CVSS are studied and compared by using three different, real testing environments. The open-source VMC suite developed here, which integrates information collected from an asset database, is shown to accelerate the process of removal for the critical vulnerabilities that are detected. The results show the practicability and efficacy of the selected models and the open-source VMC software, which can thus reduce organizations' exposure to potential threats. 20 August 2021 17 September 2021 19 September 2021  
that the fast detection of vulnerabilities and correct prioritization are constantly discussed; for example, in [2; 3; 4], the vulnerability of buildings to seismic activity was investigated through combinations of the buildings' geometric features, social vulnerabilities, as a result of the impact of the COVID-19 pandemic, were detected [5], and impacts on areas such as critical infrastructure were assessed [6]. In order to address the issues mentioned above, Asset Management (AM) and Vulnerability Management (VM) were developed. Both of these processes have been discussed in the literature [7; 8]. However, their implementation is still a challenge for a large number of organizations [9; 10], since most of them follow a gradual risk mitigation philosophy, which is focused on mitigating and fixing vulnerabilities within a specified time interval. Consequently, such organizations focus mainly on repairing 90% of the most critical vulnerabilities within two weeks from detection; thus, the vulnerability management process is limited solely tasks of metrics. However, in most cases, a potential attacker will not focus on the vulnerabilities that have been fixed, but on the remaining 10%. Studies such as [11] have discussed and highlighted the importance of the response time for new threats and the significance of a prompt and accurate vulnerability prioritization. In this contribution, the authors have developed a distributed system--the Vulnerability Management Center (VMC) 1.1-RC-2 [12]--which is a fully scalable software that operates in a container environment and is prepared to support the efficient handling of an increasing amount of data. The VMC performs an automatic calculation of the CVSS environmental score [13].