Quantifying medical device cybersecurity risk with CVSS BTE

Area of Science:

• Cybersecurity
• Information Security
• Medical Device Security

Background:

• The Common Vulnerability Scoring System (CVSS) is the industry standard for assessing cybersecurity vulnerability severity.
• Current practices often misuse CVSS by relying solely on the Base Score, neglecting contextual Threat and Environmental metrics.
• This limited approach leads to suboptimal prioritization, particularly in safety-critical sectors like healthcare.

Purpose of the Study:

• To conduct the first large-scale application of the full CVSS 4.0 Base, Threat, and Environmental (BTE) scoring.
• To evaluate the impact of BTE scoring on vulnerability prioritization within a dataset of medical device vulnerabilities.
• To explore the automation potential for Threat and Environmental metric compilation.

Main Methods:

• Large-scale application of CVSS 4.0 BTE scoring to a comprehensive dataset of medical device vulnerabilities.
• Partial automation of the Threat metric group using structured data sources.
• Semi-automatic compilation of Environmental metrics using defined environmental profiles (e.g., home vs. hospital care).

Main Results:

• CVSS 4.0 BTE scoring significantly alters vulnerability prioritization compared to Base Score alone.
• Threat metrics can be partially automated, streamlining the assessment process.
• Environmental profiles facilitate semi-automatic compilation of Environmental metrics, enhancing contextual risk assessment.

Conclusions:

• Full CVSS 4.0 BTE scoring provides a more accurate and actionable representation of cybersecurity risk.
• The methodology enhances prioritization, especially crucial for safety-critical domains such as healthcare.
• Automation strategies for Threat and Environmental metrics show promise for practical implementation.