Vulnerability management using a formalized description

Abstract

The article considers the main stages of vulnerability management and the problems arising in risk assessment and decision making during vulnerability management in the information and telecommunications system. It is assumed that modern techniques are not sufficient for effective vulnerability management. There is a need for creating a risk assessment system to improve decision-making procedures. The comparison of the formalized and informal description of the information and telecommunication system is described. The conclusion from the comparison results is that the formalized description has a number of advantages, so it is necessary that it should be built based on a formalized description of the information and telecommunication system. When adding qualitative vulnerability assessments (such as Common Vulnerability Scoring System vulnerabilities), this system will be unambiguous, clear, flexible, and easy to use. An additional advantage of such a system is the ability to automate assessment and decision-making processes, which will eliminate human influence and minimize the subjective factor in the management of vulnerabilities in the information and telecommunications system. Such a system will not exclude the influence of the security administrator, but will help him in decision-making, risk assessment, reduce the likelihood of errors, will help new staff in choosing decisions.