Automated Context-Aware Vulnerability Risk Management for Patch Prioritization

Article Computer Science, Interdisciplinary Applications

SmartPatch: A patch prioritization framework☆

Geeta Yadav et al.

Summary: This paper presents a method for modeling vulnerability patch prioritization in complex and interdependent systems such as Industrial Control Systems (ICSs). The proposed method, SmartPatch, integrates system modeling, risk management, and game theory to determine a strategic and efficient patch prioritization strategy that reduces the impact of possible attacks. The paper also introduces a security metric called Residual Impact Score (RIS) to analyze the impact of vulnerabilities on the system. A case study of a complex SCADA chain in a smart grid system is used to validate the applicability of SmartPatch.

COMPUTERS IN INDUSTRY (2022)

Add to Collection

Article Computer Science, Artificial Intelligence

Prioritizing vulnerability patches in large networks

Amir Olswang et al.

Summary: This article explores the prioritization of security vulnerability patching and proposes a Network Topology Vulnerability Score (NTVS) method for ranking vulnerabilities. It also suggests a new abstracted presentation of the network to enhance the comprehension of NTVS scores. The results show that patching vulnerabilities prioritized by NTVS leads to a faster decrease in available attack paths towards critical assets, and the proposed visualization is considerably better than current commercial tools.

EXPERT SYSTEMS WITH APPLICATIONS (2022)

Add to Collection

Article Engineering, Multidisciplinary

Vulnerability Selection for Remediation: An Empirical Analysis

Ankit Shah et al.

Summary: This paper investigates two different approaches to vulnerability selection and compares their results using real data. The research findings can be used to optimize the vulnerability remediation process in Cyber-Security Operations Centers.

JOURNAL OF DEFENSE MODELING AND SIMULATION-APPLICATIONS METHODOLOGY TECHNOLOGY-JDMS (2022)

Add to Collection

Proceedings Paper Computer Science, Information Systems