Cyber scoring systems often disagree affecting risk prioritization
When Cyber Scoring Systems Diverge: An Empirical Comparison
Cryptography and Security
Summary
Many tools exist to score how risky computer security problems are, but they don’t always agree with each other. The authors studied four scoring systems by running them on a recreated model of a real power grid cyberattack from Ukraine. They found these scoring tools often gave very different risk ratings for the same vulnerabilities. This means which scoring system you choose could change which problems get fixed first. The authors suggest mixing scores from different systems might work better to decide where to focus cybersecurity efforts.
What this means in practice
- •For cybersecurity teams: Select or combine vulnerability scores to improve patch prioritization in critical infrastructure networks.
- •For security software developers: Design security platforms that integrate multiple scoring systems for more consistent vulnerability risk assessments.
Tested on one dataset.
Authors
Kirsi Hellsten, Joni Herttuainen, Ambrose Kam, Arlanda Johnson, David Welsh, Kimmo Kaski
Abstract
Vulnerability scoring systems underpin cyber patch prioritization and risk management, but their comparative behavior is almost always assessed in the abstract, through correlation studies in IT vulnerability databases, rather than by the operational consequences they produce when embedded in a system-level risk model. Here we present an empirical comparison of four vulnerability scoring systems, namely CVSS (Common Vulnerability Scoring System), EPSS (Exploit Prediction Scoring System), SSVC (Stakeholder-Specific-Vulnerability Categorization), and IronMiner (operationally calibrated proprietary scoring system). As a substrate for comparison, we use a reconstruction of the 2015 Ukraine Power Grid operational-technology (OT) network that provides a documented incident topology. The results show a high degree of disagreement between the scoring systems. This suggests that the choice of the scoring system could significantly influence mitigation strategies and vulnerability prioritization, implying that a composite or hybrid scoring approach could offer a more suitable solution.