O impacto da análise de ameaças cibernéticas na classificação e tratamento de vulnerabilidades

Abstract

The number of vulnerabilities grows considerably every year, which makes the proper treatment of vulnerabilities a costly and often inefficient process. For this reason, it is important to assess vulnerabilities according to their criticality to allow prioritization of the treatment of the most critical vulnerabilities for the organization. There are some methods for assessing vulnerabilities. Among them, the Common Vulnerability Scoring System (CVSS) is the most used by software vendors. However, these methods do not analyze intrinsic factors of the organization, which can result in an inadequate categorization of the vulnerability. For instance, a vulnerability with medium severity in an important asset may lose priority to a vulnerability with high severity in an unimportant asset. Therefore, it is important to complement the vulnerability assessment through a threat analysis, where the severity of the vulnerabilities will be weighed against the importance of the cybernetic threats to the organization. This work presents an analysis of the literature that identifies the main vulnerability assessment methods, discusses their limitations, and shows how threat analysis can contribute to obtaining a more accurate categorization of vulnerabilities. This practice can be incorporated into security policies to make them more robust and adaptable to new realities. Moreover, the correct prioritization in the treatment of vulnerabilities is crucial to improving the protection of Critical Infrastructures and promoting better use of budget and personnel.