Leveraging Publicly Available Data and Prediction Models to Minimize Future Cyber Vulnerabilities During COTS-based System Design
Open AccessAddressing cybersecurity vulnerabilities is an essential component in thwarting cyber-attacks. Failure to apply patches and resolve vulnerabilities has contributed to many high-profile breaches and loss of profits. To mitigate this problem, current cybersecurity standards advocate the use of periodic scans to detect and resolve vulnerabilities which requires continual patch management, a costly and time-consuming approach that occurs post system design and implementation. This study proposes a quantitative method to evaluate the cybersecurity vulnerability of similar COTS-based solutions at the onset of the system design phase by leveraging publicly available vulnerability data. The approach shifts cybersecurity consideration earlier in the system life cycle, providing decision makers with quantitative measures of the risks associated with product choices. Decision makers can utilize the information to choose designs that minimize the likelihood of future vulnerabilities in both number and severity, resulting in reduced sustainment costs. Unlike existing studies that focused on forecasting vulnerability counts, this paper emphasizes the use of cumulative severity scores aggregated at the solution/system level. The method is illustrated in this study via a hypothetical design effort involving COTS-based solutions for a web application system. Time series analysis was performed to select the solution with the lowest projected cyber vulnerability. Historical actuals were used to validate the forecasts, demonstrating the proposed method’s applicability.
- All rights reserved
Notice to Authors
If you are the author of this work and you have any questions about the information on this page, please use the Contact form to get in touch with us.