Scholarlink

<p>The Common Vulnerability Scoring System (CVSS) is the de facto standard for assessing the severity of cybersecurity vulnerabilities. Yet, in practice, it is often misused. Most stakeholders rely solely on the so called CVSS “Base Score”, a measure of technical severity, ignoring the contextual metrics introduced in the 4.0 version: “Threat” and “Environmental”. This narrow use results in poor prioritization, especially in safety-critical domains like healthcare. In this study, we perform the first large-scale application of CVSS 4.0’s full Base, Threat, Environmental (BTE) scoring to a comprehensive dataset of medical device vulnerabilities. We show that the Threat group can be partially automated using structured data sources, while meaningful environmental profiles (e.g., home vs hospital care) allow semi-automatic compilation of the Environmental metrics. Our results confirm that BTE scoring significantly changes vulnerability prioritization, yielding a representation of risk that is both more accurate and more actionable, especially when safety is involved.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Quantifying medical device cybersecurity risk with CVSS BTE

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2025年11月28日

查看全文
  • Lorenzo Bracciale,
  • Sasha Riozzi,
  • Giorgia Panico,
  • Emanuele Raso,
  • Giuseppe Bianchi,
  • Pierpaolo Loreti

摘要

The Common Vulnerability Scoring System (CVSS) is the de facto standard for assessing the severity of cybersecurity vulnerabilities. Yet, in practice, it is often misused. Most stakeholders rely solely on the so called CVSS “Base Score”, a measure of technical severity, ignoring the contextual metrics introduced in the 4.0 version: “Threat” and “Environmental”. This narrow use results in poor prioritization, especially in safety-critical domains like healthcare. In this study, we perform the first large-scale application of CVSS 4.0’s full Base, Threat, Environmental (BTE) scoring to a comprehensive dataset of medical device vulnerabilities. We show that the Threat group can be partially automated using structured data sources, while meaningful environmental profiles (e.g., home vs hospital care) allow semi-automatic compilation of the Environmental metrics. Our results confirm that BTE scoring significantly changes vulnerability prioritization, yielding a representation of risk that is both more accurate and more actionable, especially when safety is involved.