A Software Vulnerability Management Framework for the Minimization of System Attack Surface and Risk

Current Internet of Things (IoT) systems comprise multiple software systems that are deployed to provide users with the required functionalities. System architects create system blueprints and draw specifications for the software artefacts that are needed; subsequently, either custom-made software i...

Full description

Saved in:
Bibliographic Details
Published inElectronics (Basel) Vol. 12; no. 10; p. 2278
Main Authors Sotiropoulos, Panagiotis, Mathas, Christos-Minas, Vassilakis, Costas, Kolokotronis, Nicholas
Format Journal Article
LanguageEnglish
Published Basel MDPI AG 18.05.2023
Subjects
Architecture
Cybersecurity
Data security
Integer programming
Internet of Things
Java
Linux
Methods
Open source software
Operating systems
Public domain
Software engineering
Software reliability
Specifications
Taxonomy
User requirements
Greece
Online AccessGet full text

Cover

More Information
Summary:Current Internet of Things (IoT) systems comprise multiple software systems that are deployed to provide users with the required functionalities. System architects create system blueprints and draw specifications for the software artefacts that are needed; subsequently, either custom-made software is developed according to these specifications and/or ready-made COTS/open source software may be identified and customized to realize the overall system goals. All deployed software however may entail vulnerabilities, either due to insecure coding practices or owing to misconfigurations and unexpected interactions. Moreover, software artefacts may implement a much broader set of functionalities than may be strictly necessary for the system at hand, in order to serve a wider range of needs, and failure to appropriately configure the deployed software to include only the required modules results in the further increase of the system attack surface and the associated risk. In this paper, we present a software vulnerability management framework which facilitates (a) the configuration of software to include only the necessary features, (b) the execution of security-related tests and the compilation of platform-wide software vulnerability lists, and (c) the prioritization of vulnerability addressing, considering the impact of each vulnerability, the associated technical debt for its remediation, and the available security budget. The proposed framework can be used as an aid in IoT platform implementation by software architects, developers, and security experts.
ISSN:2079-9292
2079-9292
DOI:10.3390/electronics12102278