# Vulnerability Management Models Using a Common Vulnerability Scoring System
## 3 Related Work  
The authors of [20,21] highlighted the fact that, in order to prioritize vulnerability effectively, organizations should consider the value assets and the importance of vulnerabilities in a standardized way. The obstacles regarding vulnerability prioritization have been extensively discussed in the available literature [22, 23, 24, 25]. Most established companies that understand the importance of cybersecurity have implemented vulnerability management processes to large extent [10,20,22]. However, as indicated in [10,22,24, 25], each organization uses a different approach to this problem. The commercial solutions listed in [26]--e.g., F-Secure [27], Qualys [28], Rapid7 [29], and Tenable [30]--help organizationsto overcome the problem of vulnerability management, but also have some drawbacks. Namely, these solutions are very expensive for users and do not provide detailed information regarding the prioritization procedure, except for the scale. For example, Qualys uses a seven-point scale [28], Rapid7 prioritizes between 1 and 1000 [29], and Tenable uses its VPR prioritization method in which the levels are given between 1 and 10 [30]. Aside from the commercial solutions, in the literature, one can find references to other software tools, e.g., PatchRank [31], SecureRank [32], Vulcon [33], CMS [34], VDNF [35], and VEST [36]. The aim of PatchRank is to focus entirely on prioritizing updates for SCADA systems [31]. SecureRank uses a network topology and the potential interactions between servers to estimate risk [32]. Vulcon's strategy is based on two elementary metrics: Time to Vulnerability Remediation (TVR) and Total Vulnerability Exposure (TVE) [33], which occur in monthly cycles. CMS is responsible for detecting vulnerabilities by considering the correlation of an asset database with the NVD database. Therefore, there is a high probability that the tool will report vulnerabilities that do not exist or will ignore those that are present in the environment [34]. VDNF normalizes the data from various vulnerability databases and removes relevant vulnerability information about vectors corresponding to the base score, thus making it difficult for security engineers to communicate about the impacts and exploitation of vulnerabilities [35]. VEST, on the other hand, predicts how quickly a vulnerability can be exploited by an attacker [36]. Other solutions, such as those in [31; 32; 33; 35; 36], do not take into account the value of assets and have not been adjusted for the increasing amount of data in the cloud computing environment. Thus, they cannot be applied to every network infrastructure. Additionally, the presented solutions do not offer priorities for either CVSS 2.0 or CVSS 3.x, since not all vulnerabilities have been converted from CVSS 2.0 to CVSS 3.x, even though CVSS 3.x assesses the essence of vulnerabilities and estimates threats more effectively [37; 38; 39]. None of the discussed solutions prioritize the vulnerabilities detected by scanners according to an environmental assessment; thus, vulnerability management processes are performed according to the models presented in Figure 1, whereby a vulnerability scanner generates a list of detected vulnerabilities. Then, for all of the list items, base CVSS scores are calculated. Next, by using the CVSS scoring, a prioritization is performed, and finally, a team of IT technicians eliminates the detected vulnerabilities in an order congruent with the prioritization. One should also emphasize that companies use the metrics proposed by the Center for Internet Security (CIS), which were created in 2010 [40; 41] in order to measure the security of ICT infrastructures. Organizations most frequently choose a standard based on the base CVSS score of 2.0 (Figure 1) in order to meet the requirements of the CIS metrics. The authors of [20; 42; 43] showed that the base CVSS metrics alone are insufficient in the process of vulnerability prioritization and that the context of an organization should also be taken into consideration.