1. Explore CVE

  • Pick a particular application that you use daily, and search on cve.mitre.org (CVE List) with its name.
  • Create a spreadsheet, listing matching vulnerabilities.
  • Tip: find a software with lots of vulnerabilities, for interesting study.

2. Explore CWE

  • On the previous spreadsheet which you created, analyze the trend of vulnerability by time, type, etc.
  • What kind of insight can you draw from the analysis?
  • You may contrast it with another software (of similar type, different language, etc.)

3. Use CVSS

  • On the previous spreadsheet which you created, use CVSS to prioritize mitigation of particular set of vulnerabilities over others.
  • Which vulnerabilities are considered most important?
  • If you have multiple vulnerabilities with same CVSS score, propose a tie-breaking rule.
  • Create a top 10 list of vulnerabilities.

4. Use CAPEC

  • On the previous spreadsheet which you created, associate CAPEC ID with top 10 vulnerabilites.
  • Create one-page executive summary, which describes impact of those vulnerabilities and persuades your customers to upgrade.
  • Send resulting document and spreadsheet to us via e-mail.

Deliverables

  • Answer to Question 2.2 and 3.2
  • Executive Summary
  • Vulnerabilities list spreadsheet

Submission Format

[studentID].zip
 ├ analysis-insight.pdf
 ├ executive-summary.pdf
 └ vulnerabilities-list.xlsx
  • Your name, student ID, and laboratory must be in your report.
  • Submit to cybersec-2020＠is.naist.jp.
  • Both Japanese and English are acceptable.

Deadline

05 June 2020 23:59:59

(There will be no further extension.)