Risk Score Estimation of Vulnerabilities Within VulnOS2 Using AlienVault Based on MITRE ATT&CK Model

Various vulnerabilities can weaken a computer network system. In dealing with these vulnerabilities, several tools are used to identify vulnerabilities so that in the future some preventive measures can be taken. This study compares the risk of vulnerabilities in VulnOS2. Vulnerabilities are identified from the vulnerability scan using AlienVault. The risk of vulnerabilities is then calculated using the risk estimation formula. The risk score estimation for vulnerability is classified into the MITRE ATT&CK matrix. The result shows that the highest risk score estimation is owned by Drupal Core Critical Remote Code Execution vulnerability which the risk score estimation is 202.5 and the lowest one is in SSH Weak Encryption Algorithms Supported which the risk score estimation is 26. Those vulnerabilities are classified in the ATT&CK Enterprise matrix to define in which ATT&CK Enterprise matrix categories the attack in vulnerabilities took place.