Application of Bayesian network in risk assessment for website deployment scenarios

Authors

  • Vu Thi Huong Giang HUST
  • Nguyen Manh Tuan Hanoi University of Science and Technology

DOI:

https://doi.org/10.54654/isj.v14i2.209

Keywords:

deployment scenario, risk assessment, CVE, Bayesian network, scenario-based risk assessment

Tóm tắt

Abstract— The rapid development of web-based systems in the digital transformation era has led to a dramatic increase in the number and the severity of cyber-attacks. Current attack prevention solutions such as system monitoring, security testing and assessment are installed after the system has been deployed, thus requiring more cost and manpower. In that context, the need to assess cyber security risks before the deployment of web-based systems becomes increasingly urgent. This paper introduces a cyber security risk assessment mechanism for web-based systems before deployment. We use the Bayesian network to analyze and quantify the cyber security risks posed by threats to the deployment components of a website. First, the deployment components of potential website deployment scenarios are considered assets, so that their properties are mapped to specific vulnerabilities or threats. Next, the vulnerabilities or threats of each deployment component will be assessed according to the considered risk criteria in specific steps of a deployment process. The risk assessment results for deployment components are aggregated into the risk assessment results for their composed deployment scenario. Based on these results, administrators can compare and choose the least risky deployment scenario.

Downloads

Download data is not yet available.

References

Nurullah Demir, Tobias Urban, Kevin Wittek and Norbert Pohlmann, "Our (in)Secure Web: Understanding Update Behavior of websites and Its Impact on Security," PAM 2021: Passive and Active Measurement pp 76-92, 2021.

Gary Stoneburner, Alice Goguen, and Alexis Feringa, “Risk Management Guide for Information Technology Systems,” NIST Special Publication 800-30, 2002.

Ines Meriah, Latifa Ben Arfa Rabai, " A Survey of Quantitative Security Risk Analysis Models for Computer Systems," Association for Computing Machinery, ICAAI, October 2018.

Huang Jiwen, Deng Zhilong, "A Bayesian Assessment Method of Network Risk," Applied Mechanics and Materials Vols 513-517 pp 1684-1687, Trans Tech Publications, Switzerland 2014.

Sun Java™ System, "Sun Java Enterprise System Deployment Planning White Paper," Sun Microsystems, Inc., 2004.

The MITRE Corporation. CVE® List https://cve.mitre.org/.

The MITRE Corporation. Common Weakness Enumeration – https://cwe.mitre.org/.

ISO/IEC 27005:2011 Information technology - Security techniques - Information security risk management.

ISO/IEC 15408-1:2009 Information technology — Security techniques — Evaluation criteria for IT security.

Serkan Ozkan. CVE details – the ultimate security vulnerability data source. https://www.cvedetails.com/.

OWASP Foundation. OWASP Top Ten. https://owasp.org/www-project-top-ten/2017/.

Armaghan Behnia, Rafhana Abd Rashid, and Junaid Ahsenali Chaudhry, "A Survey of Information Security Risk Analysis Methods," Smart Computing Review, vol. 2, no. 1, 2012.

Forum of Incident Response and Security Teams, Inc. Common vulnerability scoring system. https://www.first.org/cvss/.

The MITRE Corporation. Common weakness scoring system. https://cwe.mitre.org/.

Yu Liu and Hong Man, "Network Vulnerability Assessment using Bayesian Networks," Proceedings of SPIE Vol. 5812, 2005.

Kaixing Huang, Chunjie Zhou, Yu-Chu Tian, Weixun Tu, Yuan Peng, "Application of Bayesian Network to Data-Driven Cyber-Security Risk Assessment in SCADA Networks," 27th International Telecommunication Networks and Applications Conference (ITNAC), 2017.

S. Zhang and S. Song. "A novel attack graph posterior inference model based on bayesian network," Journal of Information Security, 2011.

Razieh Rezaee and Abbas Ghaemi Bafghi, "A Risk Estimation Framework for Security Threats in Computer Networks," Journal of Computing and Security, Volume 7, Number 1 (pp. 19-33), 2020.

NIST. National vulnerability database. https://nvd.nist.gov/.

Bayes Fusion LLC. GeNIe Modeler. https://www.bayesfusion.com/genie/.

Mouna Jouinia, Latifa Ben Arfa Rabaia and Anis Ben Aissab, "Classification of security threats in information systems," 5th International Conference on Ambient Systems, Networks and Technologies (ANT-2014).

Ines Meriah and Latifa Ben Arfa Rabai, "A Survey of Quantitative Security Risk Analysis Models for Computer Systems," ICAAI 2018.

Irad Ben-Gal, "Bayesian Networks," Encyclopedia of Statistics in Quality and Reliability, John Wiley & Sons, Ltd. 2008.

Hermawan Setiawan, Lytio Enggar Erlangga, Ido Baskoro, "Vulnerability Analysis Using The Interactive Application Security Testing (IAST) Approach For Government X Website Applications," 3rd International Conference on Infomation and Communications Technology (ICOIACT), 2020.

Pavel B. Khorev, Maxim I. Zheltov, "Assessing Information Risks When Using Web Applications Using Fuzzy Logic," International Conference on Information Technologies in Engineering Education, 2020.

Downloads

Abstract views: 192 / PDF downloads: 60

Published

2022-01-13

How to Cite

Giang, V. T. H. ., & Tuan, N. M. (2022). Application of Bayesian network in risk assessment for website deployment scenarios . Journal of Science and Technology on Information Security, 2(14), 3-17. https://doi.org/10.54654/isj.v14i2.209

Issue

Section

Papers