Research of information security database vulnerabilities

Authors

  • Александр Григорьевич Корченко National Aviation University
  • Светлана Владимировна Казмирчук National Aviation University
  • Алиреза Арджомандифард National Aviation University
  • Татьяна Валерьевна Панивко National Aviation University

DOI:

https://doi.org/10.18372/2410-7840.18.10847

Keywords:

database vulnerabilities, vulnerabilities assessment, information system, information security, analysis of database vulnerabilities

Abstract

Existing public database vulnerabilities store a variety of data about known vulnerabilities of information systems resources. Descriptions of vulnerabilities contain both precondition and assessment, describing the result of the realization of attacks that exploit these vulnerabilities. Often experts involved in research for the condition of information systems security, think of a choice of relevant databases. These bases, on certain criteria, can effectively be used to build a variety of assessment systems of the information security state, such as risk assessment systems. In this connection, it was examined a wide range of relevant databases and defined the criteria what enables to carry out a comparative analysis. This will provide an opportunity to enhance the effectiveness of rating the security state of information systems resources.

Author Biographies

Александр Григорьевич Корченко, National Aviation University

Dr Eng (Information security), pro-fessor, laureate of the State Prize of Ukraine in Science and Technology, Head of IT-Security Academic Department, National Aviation University, Senior Researcher of the Na-tional Academy of SS of Ukraine.

Светлана Владимировна Казмирчук, National Aviation University

PhD in Eng., Associate Professor of IT-Security Academic Department, National Aviation University

Алиреза Арджомандифард, National Aviation University

postgraduate student of IT-Security Academic Department, National Aviation University

Татьяна Валерьевна Панивко, National Aviation University

postgraduate student of IT-Security Academic Department, National Aviation University

References

Банк данных угроз безопасности информации [Электронный ресурс] / Федеральной службой по техническому и экспортному контролю России – Москва, 2016 – Режим доступа: World Wide Web. – URL: http://bdu.fstec.ru/.

Белобородов А.Ю. Применение баз данных уязвимостей в задачах исследования безопасности про-граммных средств / А.Ю. Белобородов, А.В. Горбенко // Вісник Харківського національного технічного університету сільського господарства імені Петра Василенка. – 2015. – Вип. 165. – С. 83-85.

Компания Positive Technologies: Оценка уязвимостей CVSS 3.0 [Электронный ресурс] / HABRAHABR Сообщество IT-специалистов – Москва, 2016 – Режим доступа: World Wide Web. – URL: https://habrahabr.ru/ company/ pt/blog / 266485/.

Малюк А.А. Один из подходов к оценке рисков информационной безопасности в облачных средах / А.А. Малюк, А.В. Царегородцев, Е.В. Макаренко // Безопасность информационных технологий. – 2014. – № 4. – С. 68-74.

Порядок проведення робіт із створення комплек-сної системи захисту інформації в інформаційно-телекомунікаційній системі, НД ТЗІ 3.7-003-05, Державна служба спеціального зв'язку та захисту інформації України, 2005, 11 с.

Урзов А.Ю. Модель защищенной информаци-онной системы на основе автоматизации процессов управления и мониторинга угроз безопасности / А.Ю. Урзов, С.К. Варлатая // Доклады ТУСУРа. – 2013. – № 2 (28). – С. 142-146.

Федорченко А.В. Исследование открытых баз уязвимостей и оценка возможности их применения в системах анализа защищенности компьютерных сетей / А. В. Федорченко, А. А. Чечулин, И.В. Котенко // Информационно-управляющие системы. – 2014. - №5 (72). – С. 72-79.

Федорченко А.В. Построение интегрированной базы уязвимостей / А.В. Федорченко, А.А. Чечулин, И.В. Котенко // Известия высших учебных заведений. Приборостроение. 2014. – Т.57. – №11. – С. 62-67.

Харченко В.С. Формирование подмножеств уязвимостей доступности коммерческих Веб-сервисов / В.С. Харченко, Алаа Мохаммед Абдул-Хади, Ю.Л. Поночовный // Системи обробки інформації. – 2013. – випуск 7 (114). – C. 112-115.

A Complete Guide to the Common Vulnerability Scoring System. Version 2.0 [Electronic resource] / Forum of Incident Response and Security Teams – Morrisville, 2016 – Access mode: World Wide Web. – URL: http://www.first.org/cvss/v2/guide.

Common Vulnerability Scoring System v3.0: User Guide [Electronic resource] / Forum of Incident Response and Security Teams – Morrisville, 2016 – Access mode: World Wide Web. – URL: http://www.first.org/cvss/user-guide.

CWE™ International in scope and free for public use [Electronic resource] / MITRE – Bedford, 2016 – Access mode: World Wide Web. – URL: http://cwe.mitre.org/index.html.

IBM X-Force Exchange [Electronic resource] / IBM Corporation – New York, 2016 – Access mode: World Wide Web. – URL: https:// exchange. xforce. ibmcloud.com/ vulnerabilities/109429.

Information technology. Security techniques. Information security management systems. Requirements: ISO/IEC 27001:2013, International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), 2013, 34 р.

National Vulnerability Database [Electronic re-source] / National Institute of Standards and Technology – Gaithersburg, 2016 – Access mode: World Wide Web. – URL: https://nvd.nist.gov/home.cfm.

Open Sourced Vulnerability Database [Electronic resource] / Open Security Foundation – Lafayette, 2016 – Access mode: World Wide Web. – URL: https:// http://osvdb.org/

Security and Privacy Controls for Federal Information Systems and Organizations [Rebecca M. Blank, Pat-rick D. Gallagher] : National Institute of Standards and Technology Special Publication 800-53r4 – Falls Church : Natl. Inst. Stand. Technol, 2013. – 462 p.

Vulnerabilities [Electronic resource] / SecurityFocus - Mountain View, 2016 - Access mode: World Wide Web. – URL: http://www.securityfocus.com/-53r4 – Falls Church : Natl. Inst. Stand. Technol, 2013. – 462 p.

Vulnerability Notes Database [Electronic resource] / United States Computer Emergency Readiness Team - Murray Lane, 2016 - Access mode: World Wide Web. – URL: https://www.kb.cert.org/vuls/#

X-Force – команда исследователей и разработчиков IBM Internet Security Systems (ISS) [Электрон-ный ресурс] / IBM Corporation – New York, 2016 – Режим доступа: World Wide Web. – URL: https://www.ibm.com/ru/services/iss/research.html

Downloads

Published

2016-09-26

Issue

Vol. 18 No. 3 (2016)

Section

Articles

License

Authors who publish with this journal agree to the following terms:

  1. Authors retain copyright and grant the journal right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.

  2. Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.

  3. Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) prior to and during the submission process, as it can lead to productive exchanges, as well as earlier and greater citation of published work (See The Effect of Open Access).