Methods for prioritizing and remediating cybersecurity vulnerabilities

Abstract

A method for prioritizing and remediating one or more cybersecurity vulnerabilities, comprising establishing a priority metric for each of the one or more cybersecurity vulnerabilities, wherein the method includes: Creating a cybersecurity attack scheme for each of the one or more cybersecurity vulnerabilities, where the cybersecurity attack scheme models various ways to uncover the cybersecurity vulnerability, the cybersecurity attack scheme includes a variety of malicious acts that can be carried out, and where the discovery of the cybersecurity vulnerability enables potential malicious damage to a specific object; Determining one or more resource metrics for each of the multitude of malicious acts of one or more cybersecurity vulnerabilities; Obtain one or more final resource metrics for each of the one or more cybersecurity vulnerabilities, based on the evaluation of each of the one or more resource metrics using a cybersecurity attack scheme iteration process; Obtain an impact metric for each of the one or more cybersecurity vulnerabilities, indicating the level of damage that can be caused by the cybersecurity vulnerability; and Calculating a priority level for each of the one or more cybersecurity vulnerabilities based on the impact metric and the one or more final resource metrics; furthermore comprehensive: a remediation step for at least one of the one or more cybersecurity vulnerabilities based on the cybersecurity priority levels of the one or more cybersecurity vulnerabilities, wherein the remediation step includes obtaining a new software module or hardware component configured to address the at least one cybersecurity vulnerability based on at least one of the several associated malicious acts, and wherein the remediation step further includes installing the new software module or hardware component into the target object; characterized by the fact that The one or more resource metrics include the following: a cost metric that represents the estimated or determined costs of carrying out the malicious act; a location metric that is assigned to a place from which the malicious act can be carried out; a scalability metric that relates to the extent to which malicious acts can be carried out on additional systems without new resources; and a capability metric associated with a skill level required by a malicious attacker to perform the malicious act; and The impact metric is based on a security impact indicator, a data sensitivity impact indicator, and a goodwill impact indicator.

Claims

[1] A method for prioritizing and remediating one or more cybersecurity vulnerabilities, comprising establishing a priority metric for each of the one or more cybersecurity vulnerabilities, the method comprising: Creating a cybersecurity attack scheme for each of the one or more cybersecurity vulnerabilities, where the cybersecurity attack scheme models different ways to uncover the cybersecurity vulnerability, wherein the cybersecurity attack scheme includes a variety of malicious acts that can be performed, and where the disclosure of the cybersecurity vulnerability enables potential malicious damage to a specific object; Determining one or more resource metrics for each of the plurality of malicious acts of one or more cybersecurity vulnerabilities; Obtaining one or more final resource metrics for each of the one or more cybersecurity vulnerabilities based on the evaluation of each of the one or more resource metrics using a cybersecurity attack scheme iteration process; Obtaining an impact metric for each of the one or more cybersecurity vulnerabilities that indicates a level of damage that can be caused by the cybersecurity vulnerability; and Calculating a priority level for each of the one or more cybersecurity vulnerabilities based on the impact metric and the one or more final resource metrics; further comprising: a remediation step for at least one of the one or more cybersecurity vulnerabilities based on the cybersecurity priority levels of the one or more cybersecurity vulnerabilities, wherein the remediation step includes obtaining a new software module or a new hardware component configured to address the at least one cybersecurity vulnerability based on at least one of the plurality of associated malicious acts, and wherein the remediation step further includes installing the new software module or the new hardware component into the target object; characterized by , that the one or more resource metrics include: a cost metric that represents the estimated or determined cost of performing the malicious act; a location metric associated with a location from which the malicious act can be performed; a scalability metric associated with the extent to which the malicious actions can be performed on additional systems without new resources; and a capability metric associated with a level of capability required for a malicious attacker to perform the malicious act; and the impact metric is based on a security impact indicator, a data sensitivity impact indicator, and a goodwill impact indicator. [2] The method of claim 1, wherein the remedial step includes installing the new software module into the target object, and wherein the remedial step further includes uploading the software module to the target object via a landline and a cellular carrier system and then performing the installing step. [3] The method of claim 2, wherein the target object is a vehicle (12), and wherein the vehicle (12) is configured to receive the software module on a telematics unit (30) integrated into the vehicle electronics (28) of the vehicle (12), and wherein the vehicle electronics (28) further includes one or more vehicle system modules (42) on which the software module is installed. [4] The method of claim 1, wherein the step of obtaining the final resource metric includes obtaining a final cost metric, a final location metric, a final scalability metric, and a final capability metric, and wherein each of the final resource metrics is assigned a numerical value, and wherein the step of calculating further includes using the numerical values ​​in the following formula to obtain the priority level of the cybersecurity vulnerability: 100 × tanh(C × R impact × R cost × R locality× R scalability × R skill ), where C represents a non-zero value, R impact stands for the impact metric, R cost stands for the final cost metric, R locality stands for the final location metric, R scalability stands for the final scalability metric and R skill represents the final capability metric. [5] The method of claim 1, wherein the impact metric is determined based on the following equation: Maximum of (safety impact , data_sensitivity impact , 9ood_will impact ) where R impact stands for the impact metric, safety impact stands for the security impact indicator, data_sensitivity impact stands for the data sensitivity impact indicator, and good_will impact stands for the goodwill impact indicator.

Images