Scribd Logo
Hochladen

Willkommen bei Scribd!

  • CRM Proposal: Extended OWASP Risk Rating Methodology (ORRM) : University of Twente

    Hochgeladen von

    owais800
    82 Ansichten1 Seite
    This document proposes enhancements to the OWASP Risk Rating Methodology (ORRM) framework for estimating risk associated with running web applications. It suggests: 1) standardizing the names and descriptions of likelihood and factor fields, 2) adding importance coefficients to factors to reduce information loss from averaging, and 3) determining importance coefficients from community feedback and incident data to continuously improve accuracy. The ORRM currently averages fields to determine likelihood and impact levels, but the proposed enhancements aim to make the risk estimates more informative and tailored.

    Originalbeschreibung:

    CRM

    Originaltitel

    Crm Proposal

    Copyright

    © © All Rights Reserved

    Verfügbare Formate

    PDF, TXT oder online auf Scribd lesen

    Stufen Sie dieses Dokument als nützlich ein?

    Sind diese Inhalte unangemessen?

    Dieses Dokument melden
    This document proposes enhancements to the OWASP Risk Rating Methodology (ORRM) framework for estimating risk associated with running web applications. It suggests: 1) standardizing the names and descriptions of likelihood and factor fields, 2) adding importance coefficients to factors to reduce information loss from averaging, and 3) determining importance coefficients from community feedback and incident data to continuously improve accuracy. The ORRM currently averages fields to determine likelihood and impact levels, but the proposed enhancements aim to make the risk estimates more informative and tailored.

    Copyright:

    © All Rights Reserved
    Als PDF, TXT herunterladen oder online auf Scribd lesen
    Markieren Sie unangemessene Inhalte
    82 Ansichten1 Seite

    CRM Proposal: Extended OWASP Risk Rating Methodology (ORRM) : University of Twente

    Hochgeladen von

    owais800
    This document proposes enhancements to the OWASP Risk Rating Methodology (ORRM) framework for estimating risk associated with running web applications. It suggests: 1) standardizing the names and descriptions of likelihood and factor fields, 2) adding importance coefficients to factors to reduce information loss from averaging, and 3) determining importance coefficients from community feedback and incident data to continuously improve accuracy. The ORRM currently averages fields to determine likelihood and impact levels, but the proposed enhancements aim to make the risk estimates more informative and tailored.

    Copyright:

    © All Rights Reserved
    Als PDF, TXT herunterladen oder online auf Scribd lesen
    Markieren Sie unangemessene Inhalte
    von 1

    CRMProposal:ExtendedOWASPRiskRatingMethodology(ORRM)

    OwaisAhmed,SantiagoAragn,
    VladyslavCherednychenko,MohammedHabib
    UniversityofTwente

    WeaimtoanalyzetheOWASPRiskRatingMethodology(ORRM)proposedin[1].The
    methodologypresentsaframeworktoestimateriskassociatedwithrunningwebapplication.
    ORRMtriestostriketherightbalancebetweenusabilityanddetailnessinordertotoprovide
    accurateriskestimateswhichaidsinmakinginformeddecisions.
    TheORRMapproachisbasedonthetraditionalriskmodel:

    Risk=Likelihood*Impact

    Tocomputetheseverityoftheriskitestimatesthelikelihoodofthreatagentfactors(LTF)and
    vulnerabilityfactors(LVF)andtheimpactoftechnicalfactors(ITF)andbusinessfactors(IBF)

    Eachfactoranditslikelihoodconsistofdifferentfieldsthathelptodescribesucharea,i.e.LVF
    isdescribedbyEaseofdiscovery,Easeofexploit,andIntrusiondetection.Eachofthese
    fieldscanbegradedfrom0to9,Finallytocomputeagradefactor/likelihood,allthefieldsthat
    describethefactors/likelihoodareaveragedandthenmappedtothesethreecategories:

    LikelihoodandImpactLevels
    0to<3

    LOW

    3to<6

    MEDIUM

    6to9

    HIGH

    WewouldliketohighlightthreepossibleenhancementsthatcanbeappliedtotheORRM
    framework.
    Thefieldsdescribingthelikelihoodandfactorscouldhavemorestandardizednames
    anddescriptions,i.e.FAIRconceptscouldbeused[2].
    Theaverageofallthefactorsdescribinglikelihoodandimpactproducesahuge
    informationloss.Moreover,therearefactorsthatbyitsownnatureshouldcontribute
    moretotheriskthanothers,i.e.forsomeapplicationtheLossofaccountabilityisnot
    asimportantastheLossofavailability.Thus,weproposetoaddanimportance
    coefficient(IC)toeachofthefields.
    TocontributetotheOWASPcommunityweproposetocomputetheICofeachfield
    basedonthefeedbackgivenbythecommunity,i.e.adatabasecontainingweb
    applicationtypesandcoefficientsused.Moreover,ifacompanyXusedasetof
    coefficientsSandafteranincidenttheestimatedriskdiffersfromthereality,Xcanbe
    fedintothedatabasesystemwiththisinformationandusingbayesianprobabilityamore
    accuratesetofcoefficientsScanbecomputed.
    [1]OWASPRiskRatingMethodology.Availableat:
    https://www.owasp.org/index.php/OWASP_Risk_Rating_Methodology

    [2]JackA.Jones,(2005)AnIntroductiontoFactorAnalysisofInformationRisk(FAIR)RiskManagementInsight

    Das könnte Ihnen auch gefallen