论文标题
探索性研究脆弱性链接失明术语和生存能力
An Exploratory Study into Vulnerability Chaining Blindness Terminology and Viability
论文作者
论文摘要
研究人员假定，要将链接失明的概念和无法将漏洞联系在一起的漏洞管理计划（VMP）的概念，研究人员假定了新的术语。提出了脆弱性链接失明的术语，以了解脆弱性管理和可用于联合使用的脆弱性背后的根本问题。总体问题在于，由于脆弱性优先级和补救的复杂性，它和网络安全专业人员很难确定被束缚的脆弱性（Abomhara＆Køien，2015; Felmetsger等，2010）。具体的问题是，基于有限的专业知识和对脆弱性链的意识，无法将多个漏洞联系起来（Tang等，2017）。这项研究的人口仅限于美国境内IT和安全领域内的一个焦点小组。样本量由一个由8-10 IT和网络安全专业人员组成的焦点组组成。研究问题的重点是参与者是否知道连锁失明或脆弱性链接，以及脆弱性链接失明是否适用于描述这种现象。通过顶级，折衷和二级编码数据分析出现了几个主题。这些主题包括网络安全计划中的复杂性，脆弱性管理中的新概念，以及对未知的恐惧以及安全符合技术的何处。 关键字：连锁失明，脆弱性链接，脆弱性链接失明，脆弱性管理
To tie together the concepts of linkage blindness and the inability to link vulnerabilities together in a Vulnerability Management Program (VMP), the researcher postulated new terminology. The terminology of vulnerability chaining blindness is proposed to understand the underlying issues behind vulnerability management and vulnerabilities that can be used in combination. The general problem is that IT and cybersecurity professionals have a difficult time identifying chained vulnerabilities due to the complexity of vulnerability prioritization and remediation (Abomhara & Køien, 2015; Felmetsger et al., 2010). The specific problem is the inability to link and view multiple vulnerabilities in combination based on limited expertise and awareness of vulnerability chaining (Tang et al., 2017). The population of this study was limited to one focus group, within the IT and Security fields, within the United States. The sample size consisted of one focus group comprised of 8-10 IT and cybersecurity professionals. The research questions focused on if participants were aware of linkage blindness or vulnerability chaining, as well as if vulnerability chaining blindness would be applicable to describe the phenomenon. Several themes emerged through top-level, eclectic, and second-level coding data analysis. These themes included complexity in cybersecurity programs, new concepts in vulnerability management, as well as fear of the unknown and where security meets technology. Keywords: linkage blindness, vulnerability chaining, vulnerability chaining blindness, vulnerability management
