Vulnerability Prioritization: An Offensive Security Approach

Authors: Muhammed Fatih Bulut, Abdulhamid Adebayo, Daby Sow, Steve Ocepek
Published: 2022-06-22

Source: https://arxiv.org/abs/2206.11182

PDF: https://arxiv.org/pdf/2206.11182

AIにより推定されたラベル

脆弱性分析 評価手法 テスト優先順位付け

※ こちらのラベルはAIによって自動的に追加されました。そのため、正確でないことがあります。
詳細は文献データベースについてをご覧ください。

Abstract

Organizations struggle to handle sheer number of vulnerabilities in their cloud environments. The de facto methodology used for prioritizing vulnerabilities is to use Common Vulnerability Scoring System (CVSS). However, CVSS has inherent limitations that makes it not ideal for prioritization. In this work, we propose a new way of prioritizing vulnerabilities. Our approach is inspired by how offensive security practitioners perform penetration testing. We evaluate our approach with a real world case study for a large client, and the accuracy of machine learning to automate the process end to end.