Strategic, Tactical, Technical, and Operational Requirements of Executive Organizations for Developing Cyber Security Vulnerability Calculator

Vulnerability analysis is of particular importance as a point of entry into the system and gaining unauthorized access by the attacker. As a result, one of the basic steps in creating the security of organizations is to be aware of the vulnerabilities in information technology systems and planning to fix these vulnerabilities. Also, one of the most important indicators of cyber security is the existence of an organizational gem (coordinated incident response groups) in the executive bodies of the country, which is responsible for preventing, dealing with, and dealing with all security incidents that occur in the space of information production and exchange. One of the requirements for creating an organizational gem in executive bodies is to have a vulnerability management unit and as a result, the existence of a deficiency calculator. In this article, in order to adapt the CIS security controller, we cover this issue by applying two new variables in the basic and environmental criteria of CVSS. These criteria are as follows: the amount of time it takes to detect unauthorized access resulting from a vulnerability in the network and the amount of time it takes to block detected unauthorized access. In order to more accurately assess the severity of the vulnerabilities in the environment, the third version of the conventional vulnerability scoring system (CVSS) according to one of the critical components in cyber defense, i.e. the duration of vulnerability detection and cutting off the unauthorized access resulting from them was developed, and then the performance of the tool was evaluated by examining the vulnerability severity of CVE-2019-1690 and CVE-2019-1758 in order to evaluate the impact and performance of the first controller. The results show the proposed metrics lead to higher performance. The developed CVSS tool is capable of more accurate evaluation of vulnerabilities and providing a suitable score according to the most important CIS control, i.e. creation and management of authorized and unauthorized equipment warehouse. Using the proposed tool Organizations can limit and effectively correct cyber threats more quickly. The proposed method is able to reduce the existing challenges in the field of cyber security of organizations.