20.500.12556/RUL-104388 Proaktivno obvladovanje tveganj v informacijskih sistemih Obvladovanje varnostnih tveganj je eden večjih izzivov v sodobnih informacijskih sistemih. Grožnje pogosto prihajajo preko svetovnega spleta in jih je težko predvideti. Napadalci so tako lahko vedno korak pred nami in ukrepanje zgolj na osnovi znanih incidentov ni zadostno. S stalnim aktivnim odkrivanjem in odstranjevanjem ranljivosti v programski opremi lahko dosežemo precej višjo raven varnosti. Kadar je v sistemu prisotno večje število ranljivosti, se moramo odločati, kateri bomo dali prednost pri odstranjevanju. S proaktivnim pristopom, kjer predvidevamo, katere ranljivosti bodo v praksi bolj verjetno izkoriščene, lahko zagotovimo najvišjo raven varnosti. Najpogosteje uporabljena metoda določanja prioritet, ki temelji na oceni CVSS (Common Vulnerability Scoring System), je pogosto tarča kritik zaradi slabe učinkovitosti. Zgolj na osnovi ocene CVSS namreč ne moremo sklepati o verjetnosti izkoriščanja. Eden ključnih izzivov na tem področju je torej prepoznati indikatorje izkoriščanja. Ker je izkoriščanje ranljivosti v osnovi človeška grožnja, je pri predvidevanju izkoristljivih ranljivosti smiselno upoštevati značilnosti tipičnih napadalcev. Opredelili smo več metod določanja prioritet, ki to upoštevajo. Učinkovitost metod želimo med seboj primerjati glede na uspešnost pri omejevanju tveganja. V ta namen smo razvili model vrednotenja, ki omogoča takšne primerjave. Predlagane metode določanja prioritet, ki upoštevajo človeške grožnje, smo primerjali z najbolj priljubljenimi obstoječimi metodami. Ob tem smo uporabili podatke o ranljivostih iz javno dostopnih podatkovnih zbirk. Eksperimentalni rezultati kažejo, da so metode določanja prioritet, ki upoštevajo značilnosti napadalcev, v splošnem učinkovitejše od obstoječih metod. Učinkovitost se je potrdila tudi na nekaterih realnih primerih informacijskih sistemov v praksi. Managing security risks is one of the major challenges in modern information systems. Threats often come via the World Wide Web and are therefore difficult to predict. Thus, attackers can always be a step ahead of us and reactive approach based on known security incidents is not sufficient. A much higher security level can be achieved by active detection and neutralization of software vulnerabilities. When a large number of vulnerabilities are present in the system, they have to be prioritized for removal according to their severity. With a proactive approach, where we foresee which vulnerabilities will be more likely exploited in practice, the highest level of security can be assured. A widely used prioritization policy based upon a CVSS (Common Vulnerability Scoring System) score is frequently criticised for bad effectiveness. The main reason is that the CVSS score alone is not a good predictor of vulnerability exploitation in the wild. One of the key challenges in this area is therefore to identify the indicators of exploitation. Since the exploitation of vulnerability is basically a human threat, it is reasonable to take into account the characteristics of typical attackers. We propose several methods for setting priorities that take this into account. Methods have to be compared according to their effectiveness in risk mitigation. To this end, we have developed a valuation model that allows such comparisons. Proposed methods, which take into account human threats, were compared with the most popular existing methods. In the experiment we used vulnerability data from publicly available databases. Experimental results show that methods which take into account the characteristics of attackers are generally more effective than existing methods. The effectiveness was also confirmed in some real cases of information systems in practice. tveganje grožnja ranljivost napadalec kvantitativna ocena metoda določanja prioritet risk threat vulnerability threat agent quantitative assessment prioritization policy true false false Slovenski jezik Angleški jezik Doktorsko delo/naloga 2018-10-05 16:25:02 2018-10-05 16:25:10 2022-08-17 03:43:41 0000-00-00 00:00:00 2018 0 0 0000-00-00 NiDoloceno NiDoloceno NiDoloceno 0000-00-00 0000-00-00 0000-00-00 1970-01-01 19686 Dobrovoljc_Andrej_-_Proaktivno_obvladovanje_tveganj_v_informacijskih_sistemih.pdf Dobrovoljc_Andrej_-_Proaktivno_obvladovanje_tveganj_v_informacijskih_sistemih.pdf 1 C7652FD08A1E243BFA7A7BE922E380E3 810fff466536e7ea16c79e71b7175b6a8855ffb1aad153f31356001e30b90892 fbba8c4c-a1b5-11eb-a523-00155dcfd717 https://repozitorij.uni-lj.si/Dokument.php?lang=slv&id=114911 Fakulteta za računalništvo in informatiko 0 0 0