Scholarly Works, Business Information Technology

Permanent URI for this collection

https://hdl.handle.net/10919/24337
Research articles, presentations, and other scholarship

Browse

Browsing Scholarly Works, Business Information Technology by Author "Baker, Wade"

Now showing 1 - 3 of 3
  • Thumbnail Image
    Improving vulnerability remediation through better exploit prediction
    Jacobs, Jay; Romanosky, Sasha; Adjerid, Idris; Baker, Wade (2020-09-14)
    Despite significant innovations in IT security products and research over the past 20 years, the information security field is still immature and struggling. Practitioners lack the ability to properly assess cyber risk, and decision-makers continue to be paralyzed by vulnerability scanners that overload their staff with mountains of scan results. In order to cope, firms prioritize vulnerability remediation using crude heuristics and limited data, though they are still too often breached by known vulnerabilities for which patches have existed for months or years. And so, the key challenge firms face is trying to identify a remediation strategy that best balances two competing forces. On one hand, it could attempt to patch all vulnerabilities on its network. While this would provide the greatest 'coverage' of vulnerabilities patched, it would inefficiently consume resources by fixing low-risk vulnerabilities. On the other hand, patching a few high-risk vulnerabilities would be highly 'efficient', but may leave the firm exposed to many other high-risk vulnerabilities. Using a large collection of multiple datasets together with machine learning techniques, we construct a series of vulnerability remediation strategies and compare how each perform in regard to trading off coverage and efficiency. We expand and improve upon the small body of literature that uses predictions of 'published exploits', by instead using 'exploits in the wild' as our outcome variable. We implement the machine learning models by classifying vulnerabilities according to high- and low-risk, where we consider high-risk vulnerabilities to be those that have been exploited in actual firm networks.
  • Thumbnail Image
    Metrics That Actually Matter for Vulnerability Management
    Baker, Wade (TAG Cyber, 2022-10)
  • Thumbnail Image
    Who’s winning in the game of attack and defend?
    Baker, Wade (Executive Media Pty Ltd, 2021-07-09)
    It’s often said that the ‘playing field’ of cyber security is heavily tilted in favour of attackers. Defenders must do everything perfectly, while attackers gain the upper hand if given the slightest opportunity. But is that an accurate depiction of the contest? Not exactly, according to recent research.