Authors:
Roland Plaka
;
Mikael Asplund
and
Simin Nadjm-Tehrani
Affiliation:
Department of Computer and Information Science, Linköping University, Sweden
Keyword(s):
Vulnerability, Prioritization, Topology, Exploitable Path.
Abstract:
Modern critical infrastructures are becoming increasingly complex and exposed to cyber-attacks. As with any digitalized system, these systems suffer from vulnerabilities that threaten overall system security. As a result, eliminating vulnerabilities is imperative for security analysts to counteract potential future attacks. However, vulnerability management is time-consuming and expensive because it requires testing, verification, and validation for the patches. Therefore, there is a need to prioritize which vulnerabilities to fix first in an efficient manner. This paper introduces a patching strategy by identifying the attack path that poses the most severe system risk and the patches with the highest potential to mitigate this risk. The risk assessment is based on novel metrics incorporating dynamic exploitability, impact scores, and the network topology. The method is evaluated on a case study based on electric vehicle charging infrastructures. We collect information on vulnerabil
ities, exploits, and available patches for this domain and instantiate a realistic network model with relevant components, some of which contain vulnerabilities. Our results show that the proposed method outperforms baseline methods to reduce overall system risk.
(More)