Evaluating the Data Inconsistency of Open-Source Vulnerability Repositories
2021 (English)In: ARES 2021: The 16th International Conference on Availability, Reliability and Security, Association for Computing Machinery (ACM) , 2021, p. 1-10, article id 86Conference paper, Published paper (Refereed)
Abstract [en]
Modern security practices promote quantitative methods to provide prioritisation insights and support predictive analysis, which is supported by open-source cybersecurity databases such as the Common Vulnerabilities and Exposures (CVE), the National Vulnerability Database (NVD), CERT, and vendor websites. These public repositories provide a way to standardise and share up-to-date vulnerability information, with the purpose to enhance cybersecurity awareness. However, data quality issues of these vulnerability repositories may lead to incorrect prioritisation and misemployment of resources. In this paper, we aim to empirically analyse the data quality impact of vulnerability repositories for actual information technology (IT) and operating technology (OT) systems, especially on data inconsistency. Our case study shows that data inconsistency may misdirect investment of cybersecurity resources. Instead, correlated vulnerability repositories and trustworthiness data verification bring substantial benefits for vulnerability management.
Place, publisher, year, edition, pages
Association for Computing Machinery (ACM) , 2021. p. 1-10, article id 86
Keywords [en]
Cybersecurity, Data Inconsistency, Vulnerability Analysis
National Category
Computer Systems Information Systems
Identifiers
URN: urn:nbn:se:bth-22663DOI: 10.1145/3465481.3470093Scopus ID: 2-s2.0-85113197148ISBN: 978-1-4503-9051-4 (print)OAI: oai:DiVA.org:bth-22663DiVA, id: diva2:1640506
Conference
4th International Workshop on Cyber Threat Intelligence Management (CyberTIM 2021), August 17 – August 20, 2021, held in conjunction with ARES 2021: The 16th International Conference on Availability, Reliability and Security, Vienna, Austria, August 17 - 20, 2021
Note
©2021 Copyright held by the owner/author(s). Publication rights licensed to ACM.
2022-02-242022-02-242022-02-24Bibliographically approved