Method for estimating a risk score arising from a vulnerability in a computer asset

Abstract

The invention relates to a method for estimating a risk score arising from a vulnerability in an IT asset, comprising a first step (1) of estimating a criticality score, taking into account the possible attack vector. The method according to the invention is particular in that it comprises the following steps: - a second step (2) of estimating a threat score, taking into account an exploitability score determined by searching a database to see if a proof of concept for exploiting said vulnerability exists, if an exploit kit is published, or if exploitation has already occurred; - a third step (3) of estimating an impact score of said IT asset, taking into account a criticality score of said asset in terms of confidentiality, integrity, and availability; - calculation of said risk score as being proportional to the product of the criticality score, the threat score, and the impact score. Figure for the abstract: Fig 1