A Multi-factor Assessment Mechanism to Define Priorities on Vulnerabilities affecting Healthcare Organizations

A key aspect on any risk assessment process is the identification and analysis of vulnerabilities associated to the target organization, its assets, services and devices. Considering that not all vulnerabilities are equally dangerous, and organizations cannot afford to blindly define strategies against the hundreds of newly discovered vulnerabilities, they must define priorities during the vulnerability management process. In addition, while many organizations base their prioritization of vulnerability management on scores such as the Common Vulnerability Scoring System (CVSS), a high portion of vulnerabilities associated to malware are scored with low or medium severity on the CVSS scale, which suggest that focusing only on CVEs which score high or critical would be a mistake. We propose in this paper a multi-factor assessment mechanism to define priorities of vulnerabilities affecting Healthcare Organizations. The mechanism helps classifying vulnerabilities based on their score and assigning priorities for their treatment.