Enterprise risk assessment based on compliance reports and vulnerability scoring systems

Mohammed Noraden Alsaleh; Ehab Al-Shaer

doi:10.1145/2665936.2665941

Enterprise risk assessment based on compliance reports and vulnerability scoring systems

Mohammed Noraden Alsaleh
, Ehab Al-Shaer

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

5 Scopus citations

Abstract

The risk of cyberattacks have become increasingly daunting as most of our socioeconomic activities have gone cyberbased. Comprehensive automated risk management is becoming necessity in today's dynamic networks. In this paper, we present an objective metric to assess the risk of cyberattacks on organizations' networks based on the security compliance reports. Our model considers various risk factors, including vulnerabilities distribution, dependency between them, and network configuration. We take advantage of Security Content Automation Protocol (SCAP) languages and measurement and scoring systems to study vulnerabilities and compute the system exposure. We also describe an evaluation plan to validate the presented metric.

Original language	English
Title of host publication	SafeConfig 2014 - Proceedings of the 2014 ACM Cyber Security Analytics, Intelligence and Automation Workshop, Co-located with CCS 2014
Publisher	Association for Computing Machinery
Pages	25-28
Number of pages	4
Edition	November
ISBN (Print)	9781450331470
DOIs	https://doi.org/10.1145/2665936.2665941
State	Published - 3 Nov 2014
Externally published	Yes
Event	2014 ACM Cyber Security Analytics, Intelligence and Automation Workshop, SafeConfig 2014 - Co-located with CCS 2014 - Scottsdale, United States Duration: 3 Nov 2014 → …

Publication series

Name	Proceedings of the ACM Conference on Computer and Communications Security
Number	November
Volume	2014-November
ISSN (Print)	1543-7221

Conference

Conference	2014 ACM Cyber Security Analytics, Intelligence and Automation Workshop, SafeConfig 2014 - Co-located with CCS 2014
Country/Territory	United States
City	Scottsdale
Period	3/11/14 → …

Bibliographical note

Publisher Copyright:
Copyright 2014 ACM.

Keywords

Attacks
CVSS
Compliance
Configuration management
Risk assessment
Vulnerability

ASJC Scopus subject areas

Software
Computer Networks and Communications

Access to Document

10.1145/2665936.2665941

Cite this

Alsaleh, M. N., & Al-Shaer, E. (2014). Enterprise risk assessment based on compliance reports and vulnerability scoring systems. In SafeConfig 2014 - Proceedings of the 2014 ACM Cyber Security Analytics, Intelligence and Automation Workshop, Co-located with CCS 2014 (November ed., pp. 25-28). (Proceedings of the ACM Conference on Computer and Communications Security; Vol. 2014-November, No. November). Association for Computing Machinery. https://doi.org/10.1145/2665936.2665941

Alsaleh, Mohammed Noraden ; Al-Shaer, Ehab. / Enterprise risk assessment based on compliance reports and vulnerability scoring systems. SafeConfig 2014 - Proceedings of the 2014 ACM Cyber Security Analytics, Intelligence and Automation Workshop, Co-located with CCS 2014. November. ed. Association for Computing Machinery, 2014. pp. 25-28 (Proceedings of the ACM Conference on Computer and Communications Security; November).

@inproceedings{51160b376bf0493b898709e4d1cb1214,

title = "Enterprise risk assessment based on compliance reports and vulnerability scoring systems",

abstract = "The risk of cyberattacks have become increasingly daunting as most of our socioeconomic activities have gone cyberbased. Comprehensive automated risk management is becoming necessity in today's dynamic networks. In this paper, we present an objective metric to assess the risk of cyberattacks on organizations' networks based on the security compliance reports. Our model considers various risk factors, including vulnerabilities distribution, dependency between them, and network configuration. We take advantage of Security Content Automation Protocol (SCAP) languages and measurement and scoring systems to study vulnerabilities and compute the system exposure. We also describe an evaluation plan to validate the presented metric.",

keywords = "Attacks, CVSS, Compliance, Configuration management, Risk assessment, Vulnerability",

author = "Alsaleh, \{Mohammed Noraden\} and Ehab Al-Shaer",

year = "2014",

month = nov,

day = "3",

doi = "10.1145/2665936.2665941",

language = "English",

isbn = "9781450331470",

series = "Proceedings of the ACM Conference on Computer and Communications Security",

publisher = "Association for Computing Machinery",

number = "November",

pages = "25--28",

booktitle = "SafeConfig 2014 - Proceedings of the 2014 ACM Cyber Security Analytics, Intelligence and Automation Workshop, Co-located with CCS 2014",

edition = "November",

}

Alsaleh, MN & Al-Shaer, E 2014, Enterprise risk assessment based on compliance reports and vulnerability scoring systems. in SafeConfig 2014 - Proceedings of the 2014 ACM Cyber Security Analytics, Intelligence and Automation Workshop, Co-located with CCS 2014. November edn, Proceedings of the ACM Conference on Computer and Communications Security, no. November, vol. 2014-November, Association for Computing Machinery, pp. 25-28, 2014 ACM Cyber Security Analytics, Intelligence and Automation Workshop, SafeConfig 2014 - Co-located with CCS 2014, Scottsdale, United States, 3/11/14. https://doi.org/10.1145/2665936.2665941

Enterprise risk assessment based on compliance reports and vulnerability scoring systems. / Alsaleh, Mohammed Noraden; Al-Shaer, Ehab.
SafeConfig 2014 - Proceedings of the 2014 ACM Cyber Security Analytics, Intelligence and Automation Workshop, Co-located with CCS 2014. November. ed. Association for Computing Machinery, 2014. p. 25-28 (Proceedings of the ACM Conference on Computer and Communications Security; Vol. 2014-November, No. November).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Enterprise risk assessment based on compliance reports and vulnerability scoring systems

AU - Alsaleh, Mohammed Noraden

AU - Al-Shaer, Ehab

PY - 2014/11/3

Y1 - 2014/11/3

N2 - The risk of cyberattacks have become increasingly daunting as most of our socioeconomic activities have gone cyberbased. Comprehensive automated risk management is becoming necessity in today's dynamic networks. In this paper, we present an objective metric to assess the risk of cyberattacks on organizations' networks based on the security compliance reports. Our model considers various risk factors, including vulnerabilities distribution, dependency between them, and network configuration. We take advantage of Security Content Automation Protocol (SCAP) languages and measurement and scoring systems to study vulnerabilities and compute the system exposure. We also describe an evaluation plan to validate the presented metric.

AB - The risk of cyberattacks have become increasingly daunting as most of our socioeconomic activities have gone cyberbased. Comprehensive automated risk management is becoming necessity in today's dynamic networks. In this paper, we present an objective metric to assess the risk of cyberattacks on organizations' networks based on the security compliance reports. Our model considers various risk factors, including vulnerabilities distribution, dependency between them, and network configuration. We take advantage of Security Content Automation Protocol (SCAP) languages and measurement and scoring systems to study vulnerabilities and compute the system exposure. We also describe an evaluation plan to validate the presented metric.

KW - Attacks

KW - CVSS

KW - Compliance

KW - Configuration management

KW - Risk assessment

KW - Vulnerability

UR - https://www.scopus.com/pages/publications/84937547594

U2 - 10.1145/2665936.2665941

DO - 10.1145/2665936.2665941

M3 - Conference contribution

AN - SCOPUS:84937547594

SN - 9781450331470

T3 - Proceedings of the ACM Conference on Computer and Communications Security

SP - 25

EP - 28

BT - SafeConfig 2014 - Proceedings of the 2014 ACM Cyber Security Analytics, Intelligence and Automation Workshop, Co-located with CCS 2014

PB - Association for Computing Machinery

T2 - 2014 ACM Cyber Security Analytics, Intelligence and Automation Workshop, SafeConfig 2014 - Co-located with CCS 2014

Y2 - 3 November 2014

ER -

Alsaleh MN, Al-Shaer E. Enterprise risk assessment based on compliance reports and vulnerability scoring systems. In SafeConfig 2014 - Proceedings of the 2014 ACM Cyber Security Analytics, Intelligence and Automation Workshop, Co-located with CCS 2014. November ed. Association for Computing Machinery. 2014. p. 25-28. (Proceedings of the ACM Conference on Computer and Communications Security; November). doi: 10.1145/2665936.2665941

Enterprise risk assessment based on compliance reports and vulnerability scoring systems

Abstract

Publication series

Conference

Bibliographical note

Keywords

ASJC Scopus subject areas

Access to Document

Fingerprint

Cite this