A Novel Model for Vulnerability Analysis through Enhanced Directed Graphs and Quantitative Metrics

TL;DR

This paper introduces a new model combining directed graphs and quantitative metrics to analyze vulnerabilities in industrial components over time, aiding in prioritization and security assessment.

Contribution

The paper proposes a novel vulnerability analysis model using directed graphs and CVSS-based metrics, applied to industrial devices for improved security management.

Findings

Vulnerabilities mainly stem from memory buffer issues in libssl.

The model effectively tracks vulnerabilities throughout a device's lifespan.

Generated new security requirements and test cases from analysis.

Abstract

Industrial components are of high importance because they control critical infrastructures that form the lifeline of modern societies. However, the rapid evolution of industrial components, together with the new paradigm of Industry 4.0, and the new connectivity features that will be introduced by the 5G technology, all increase the likelihood of security incidents. These incidents are caused by the vulnerabilities present in these devices. In addition, although international standards define tasks to assess vulnerabilities, they do not specify any particular method. Having a secure design is important, but is also complex, costly, and an extra factor to manage during the lifespan of the device. This paper presents a model to analyze the known vulnerabilities of industrial components over time. The proposed model is based on two main elements: a directed graph representation of the internal structure of the component, and a set of quantitative metrics that are based on international security standards; such as, the Common Vulnerability Scoring System (CVSS). This model is applied throughout the entire lifespan of a device to track vulnerabilities, identify new requirements, root causes, and test cases. The proposed model also helps to prioritize patching activities. To test its potential, the proposed model is applied to the OpenPLC project. The results show that most of the root causes of these vulnerabilities are related to memory buffer operations and are concentrated in the \textit{libssl} library. Consequently, new requirements and test cases were generated from the obtained data.