Pith. sign in

REVIEW 5 major objections 8 minor 83 references

TELSAFE: Security Gap Quantitative Risk Assessment Framework

T0 review · 5 major / 8 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read TELSAFE computes quantitative risk scores for standards-implementation gaps using event-tree probabilities on CVE data, replacing expert judgment with empirical frequencies.

desk verdict The framework is cleanly presented and standards-aligned, but its likelihood term is a product of CVSS attribute frequencies with no defined target event, so the quantitative risk scores are not validated estimates. read the letter →

arxiv 2507.06497 v1 pith:6GOROBP5 submitted 2025-07-09 cs.CR cs.SE

Sarah Ali Siddiqui , Chandra Thapa , Derui Wang , Rayne Holland , Wei Shao , Seyit Camtepe , Hajime Suzuki , Rajiv Shah This is my paper · ORCID
classification cs.CRcs.SE
keywords quantitativeriskassessmentsecuritygapeventtreelikelihoodmodelingCVE-drivenprobabilisticstandards-implementationtelecommunicationsCVSS
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

TELSAFE is a hybrid risk assessment framework for the vulnerabilities that arise when security standards are not fully implemented. Its central claim is that the likelihood of such a standards-implementation gap can be quantified from historical vulnerability data using event trees, without expert opinion, and combined with a confidentiality-integrity-availability impact score to yield a numeric risk score $R_\pi = P[\pi] \times \gamma_\pi$. If correct, this gives organizations a repeatable, data-driven way to prioritize remediation and to align with ISO 31000, ISO/IEC 27005, and ITU-T X.1055. The demonstration on a public CVE dataset shows the pipeline, though the authors state that the dataset was not acquired specifically as data about standards-implementation gaps.

What carries the argument

The central object is the event tree, a diagram whose paths enumerate all combinations of outcomes of $N$ events; the probability of a path is the product, or conditional product, of the outcome probabilities along it. For the CVE use case, eight likelihood-influencing parameters are treated as events, each outcome's probability is its relative frequency in the pre-processed dataset, and the impact $\gamma_\pi$ is derived from CVSS impact equations normalized to $[0,1]$. This machinery converts qualitative CVE attributes into a numeric risk score without soliciting expert weights or membership functions.

What would settle it

Take the subset of CVEs that vendors or advisories explicitly attribute to a standards-implementation gap and run Algorithm 1 on it; if the resulting risk scores do not rank known exploited gap CVEs above the general CVE population, or do not separate known-exploited from non-exploited records, then the framework is measuring generic CVE exposure rather than gap risk.

Watch

Extended reading notes

Core claim

The paper claims that a gap between a security standard's specification and its implementation can be modeled as a chain of events, and that the probability of each path can be computed from the empirical frequency of outcome values in a CVE dataset. The risk associated with a path is then the path likelihood times an impact term built from confidentiality, integrity, and availability scores: $R_\pi = P[\pi] \times \gamma_\pi$. Because all probabilities come from observed data rather than from expert-chosen membership functions, the authors argue that the framework removes expert-opinion bias and yields identical scores for every user. The framework segments risk assessment into six steps, adding context definition and separate risk-scenario-development and risk-modeling steps to the usual ISO 31000 qualitative flow.

Load-bearing premise

The framework's likelihood numbers inherit whatever the public CVE dataset measures, and that dataset was not collected as a record of standards-implementation gaps, so if it does not represent such gaps the risk scores are not measuring what TELSAFE claims to measure.

Editorial extensions

If this is right

  • Adopting TELSAFE lets an organization rank vulnerabilities by a reproducible numeric score, so two analysts given the same dataset will produce the same priorities.
  • The same six-step pipeline can be applied to any sector with CVE-style vulnerability data, including 5G/6G telecommunications, without retraining models or eliciting expert weights.
  • Risk scores computed this way can be mapped back onto ISO 31000, ISO/IEC 27005, and ITU-T X.1055 process steps, giving compliance reporting a quantitative artifact.
  • The framework is extensible to other ISO/IEC 31010 techniques, such as fault trees or Markov analysis, when a single event tree is insufficient to capture a scenario's interactions.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The absence of expert opinions covers the probability inputs, but the choice of which CVSS attributes count as likelihood-influencing events is still a modeling decision; testing sensitivity to that choice would show how much of the 'no subjectivity' claim survives.
  • Because the risk score is a product of likelihood and impact, the method implicitly treats the two as independent; replacing the product with the conditional chain of Eq. 8 would let correlated failures across CVEs be modeled and could change the rankings.
  • A direct validation route the paper leaves open is to compare TELSAFE scores with the known-exploited flag in public vulnerability data: exploited vulnerabilities should score consistently above non-exploited ones if the likelihood term is meaningful.
  • The same event-tree construction could be aimed directly at standard specifications, treating each optional security requirement as an event and measuring non-adoption rates from vendor disclosures, which would test the gap hypothesis without relying on a CVE proxy.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 8 minor

Summary. The paper proposes TELSAFE, a hybrid framework for quantitative risk assessment of gaps between security standards and their practical implementation. The framework combines qualitative steps (context definition, risk factor identification, risk analysis) with quantitative steps (risk scenario development via event trees, risk modeling, and risk evaluation). The risk score for a path is Rπ = P[π] × γπ, where P[π] is computed in Algorithm 1 as the product of empirical marginal frequencies of eight CVSS-derived attributes from a Kaggle CVE dataset, and γπ is an impact value derived from CVSS impact scores. A use case for the telecommunications industry is presented, with a stepwise comparison against a purely qualitative ISO 31000 approach for a single CVE.

Significance. The problem addressed is real: organizations need objective, repeatable, and standards-aligned quantitative risk assessment, especially for security gaps arising between standards specifications and implementations. If the framework were sound, it would be a useful contribution to the security risk assessment literature, which the paper reviews. The paper has clear strengths: it surveys academic and industry tools with a structured comparison, it aligns the process with ISO 31000, ISO/IEC 27005, and ITU-T X.1055, it provides a concrete algorithm (Algorithm 1) and a public dataset, and it explicitly acknowledges the lack of public labeled ground-truth data. However, the central quantitative claim is not supported: the computed likelihood P[π] is not a probability of any defined security event, and the risk scores are not validated against any external benchmark. As presented, the framework re-expresses CVSS/EPSS data rather than measuring standards-gap risk.

major comments (5)
  1. [Section IV-C.1, Algorithm 1, Eq. (7)] The likelihood P[π] is computed as the product of empirical marginal frequencies of eight CVSS attributes (base score, exploitability score, EPSS percentile, attack vector, attack complexity, privileges required, user interaction, scope) over the entire Kaggle corpus. This product is not the probability of any event in the risk scenario: the event tree's basic events are vulnerability metadata attributes, not 'a standards-implementation gap occurs' or 'the vulnerability is exploited.' Even if the dataset were a perfect sample of standards-gap vulnerabilities, the product of marginal attribute frequencies would only estimate the probability of observing that attribute combination in the CVE corpus; it would not estimate the likelihood of an incident or a gap-induced compromise. Section IV-A explicitly states the dataset 'has not been acquired by the source as data for gaps between standards and implementation.' Thus the mapping from P[π] to 'risk' is asserted, not derived. This construct-validity failure affects every risk score produced by the framework.
  2. [Eq. (7) / Algorithm 1 line 20] The product formula in Eq. (7) is introduced for 'events are independent,' and Algorithm 1 applies it to the eight CVSS attributes without any justification or test of independence. These attributes are not independent in general: CVSS base score is a function of exploitability and impact sub-scores, and EPSS scores are derived from CVE features, so marginal frequencies are mechanically correlated. The product of marginal empirical frequencies therefore does not even give a correct joint frequency for the attribute combination. The paper does not consider the conditional-probability form in Eq. (8), which would require estimating conditional dependencies from data.
  3. [Section IV-C.5.c] The framework is not validated. The paper states that 'the most significant challenge when devising a risk assessment framework is the unavailability of a labeled dataset, i.e., a dataset containing ground truth values for (i) risk assessment, (ii) likelihood, and (iii) impact,' and that 'conventional validation methods relying on labels or ground truth assessments may not be applicable.' However, the risk scores are deterministic transformations of the same CVSS/EPSS data used to define likelihood and impact (Eqs. 9-10 and Algorithm 1), with no external benchmark. The reported example (CVE-2024-7593: likelihood 0.568, impact 0.9782, risk 0.6, level 'Risky') is not compared against any independent measure or validated expert assessment. In the absence of validation, the numerical risk scores are untestable re-expressions of the input attributes rather than predictions of security risk.
  4. [Section IV-C.5.a and Section III-A] The claim that the framework 'eliminates the influence of expert opinion bias' is overstated. Expert judgment is still required in the qualitative steps, including context definition, risk factor identification, and risk analysis; the authors also choose the eight likelihood-influencing attributes, the event-tree structure, and the qualitative risk bands. The statement 'did not require expert opinions to assign any membership functions' is true only in a narrow sense: the framework does not use fuzzy membership functions, but subjective decisions remain in several places. This weakens the paper's positioning relative to the fuzzy-logic-based approaches it criticizes.
  5. [Section IV-A and use case] The use case does not actually demonstrate application to the telecommunications industry. The Kaggle dataset is a general CVE dataset, and Algorithm 1 is applied to the full corpus without filtering to telecom-related CVEs. The 'context' for CVE-2024-7593 is simply 'Software,' and the quantitative computation uses no telecom-specific assets, threats, or scenarios. The relevance to 5G/6G networks is asserted via the examples in Table III and the alignment with ITU-T X.1055, but it is not operationalized in the risk score computation. As a proof of concept, the use case illustrates the algorithm on generic vulnerability data, not on a telecom-specific risk assessment.
minor comments (8)
  1. [Section III-B, Definition 5] The notation for the Cartesian product definition is inconsistent: the text introduces i1y and i2y but later writes elements as i1ai2b with subscripts a, b; clarify the indexing. Also, the phrase 'i1y, y = 1, 2, ..., n1' and 'i2y' appears to have a typo in the second subscript sequence.
  2. [Table IV] CVE-1999-0199 is shown with Published Date '2020-10-06T13:15Z', which is inconsistent with a CVE published in 1999; verify the data extraction and correct the entry.
  3. [Algorithm 1, lines 21 and 23] The normalization uses γminT, γmaxT, RminT, and RmaxT but these thresholds are never defined. Specify whether they are the observed min/max over the dataset, theoretical bounds, or organization-specific parameters, and state how they are chosen.
  4. [Section IV-C.4, Table V] The table reports likelihood 0.568 and impact 0.9782 for CVE-2024-7593, but the attribute values for that CVE and the resulting marginal probabilities are not shown. Include the intermediate values so the computation is reproducible.
  5. [Section II-B] The tool name is spelled inconsistently as 'OCTA VE' and 'OCTAVE' in the text and tables; standardize the spelling throughout.
  6. [References] Several references are incomplete: [73] has no title, [44] has no author or venue, and [64] and [65] rely on blog-style sources. Complete the bibliography entries and replace non-archival sources where possible.
  7. [Section IV-C.5.b] The phrase 'balanced/unbalanced' dataset is ambiguous; clarify what balancing was performed and how it affects the computed frequencies and risk scores.
  8. [Figure 6] Figure 6 is described as a step-wise flow diagram, but the text does not clearly explain the boxes and arrows; ensure the figure is legible and self-contained, and define all abbreviations used in it.

Circularity Check

1 steps flagged · score 6.0 of 10

The computed risk score is a deterministic transform of CVSS/EPSS attribute frequencies, not an independently defined probability of a standards-gap incident.

  1. self definitional [Section IV-C.1 'Risk Scenario Development', with Algorithm 1 and Eqs. (7), (10)]
    "Each likelihood influencing parameter (eight in total) in D has been considered as an event to form an event tree for likelihood computations P [π]. Occurrences of each unique outcome of each event have been calculated to compute the probability of each outcome P [ix]."

    In the event-tree model, the 'events' are the eight CVSS/EPSS attributes themselves, and P[ix] is the relative frequency of each attribute value in the same Kaggle corpus. Therefore P[π] in Eq. (7) is, by construction, the empirical frequency of a particular CVSS attribute combination in the input dataset, not the probability of a standards-gap incident or of exploitation. The paper's own dataset section says the data 'has not been acquired by the source as data for gaps between standards and implementation,' and Section IV-C.5.c concedes there is no labeled ground truth. Consequently Rπ = P[π] × γπ (Eq.

full rationale

The quantitative chain in TELSAFE is Rπ = P[π] × γπ, where P[π] is computed in Algorithm 1 as the product of empirical marginal frequencies of CVSS/EPSS attributes from the same Kaggle dataset. No external target event—such as an incident, an exploitation, or a standards-gap failure—is modeled; the dataset is explicitly not collected as gap data, and the paper itself states that no labeled ground truth is available. Thus the central numeric output reduces, by construction, to a transformation of the input CVSS/EPSS data. The only self-citation ([6]) appears as a general citation in the introduction and is not load-bearing, and no uniqueness theorem or ansatz is imported through author citations. The qualitative phase and standards-alignment discussion provide independent content, so the circularity is partial rather than total; had the paper claimed an externally validated prediction of incidents, the score would be higher.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The core computation introduces no new physical entities. It rests on standard probability axioms, a strong independence assumption in the event-tree product, the representativeness of a general CVE dataset for standards-gap risk, and acceptance of CVSS/EPSS as risk proxies. The attribute set and risk-band thresholds are hand-chosen.

free parameters (2)
  • Choice of eight likelihood-influencing attributes
    The authors selected base score, exploitability score, EPSS percentile, attack vector, attack complexity, privileges required, user interaction, and scope for the event tree; this selection determines the likelihood and is not derived from data.
  • Risk level thresholds for qualitative bands = not specified
    Table V maps a numeric risk score of 0.6 to the band 'Risky', but the threshold values for this mapping are not defined in the paper.
assumptions (4)
  • standard math Standard probability axioms and event-tree foundations from Papazoglou [69]
    Definitions 2 through 11 and Eqs. 5 through 8 rely on standard probability theory and the cited event-tree foundation.
  • domain assumption Independence of the eight CVSS/EPSS attributes in the path probability product
    Eq. 7 and Algorithm 1 line 20 multiply marginal empirical probabilities without testing or stating independence; CVSS attributes such as attack vector and privileges required are plausibly correlated.
  • domain assumption The general CVE dataset is representative of standards-implementation gap risks
    Section IV-A acknowledges that the dataset was not acquired as gap-risk data, yet the use case treats it as the empirical basis for estimating likelihood and impact of such gaps.
  • domain assumption CVSS and EPSS scores are valid proxies for likelihood and impact
    The framework computes likelihood from CVSS/EPSS attributes and impact from CVSS impact scores, even though NIST states that CVSS score is not itself a measure of risk.

how reviews work

0 comments
Cite this review

Pith. "Pith review of TELSAFE: Security Gap Quantitative Risk Assessment Framework." pith.science (2026). https://pith.science/paper/6GOROBP5

@misc{pith2026250706497,
  author       = {Pith},
  title        = {Pith review of: TELSAFE: Security Gap Quantitative Risk Assessment Framework},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6GOROBP5}},
  note         = {Machine review of arXiv:2507.06497}
}
read the original abstract

Gaps between established security standards and their practical implementation have the potential to introduce vulnerabilities, possibly exposing them to security risks. To effectively address and mitigate these security and compliance challenges, security risk management strategies are essential. However, it must adhere to well-established strategies and industry standards to ensure consistency, reliability, and compatibility both within and across organizations. In this paper, we introduce a new hybrid risk assessment framework called TELSAFE, which employs probabilistic modeling for quantitative risk assessment and eliminates the influence of expert opinion bias. The framework encompasses both qualitative and quantitative assessment phases, facilitating effective risk management strategies tailored to the unique requirements of organizations. A specific use case utilizing Common Vulnerabilities and Exposures (CVE)-related data demonstrates the framework's applicability and implementation in real-world scenarios, such as in the telecommunications industry.

Figures

Figures reproduced from arXiv: 2507.06497 by the authors.

Figure 1
Figure 1. Potential Gaps – Standards and Implementation. [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Research Problem: Risk Assessment for Gaps between Standards’ Security Specifications and Implementation, including Use case Scenario for [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Alignment of the Proposed Risk Assessment Framework with the Existing Risk Management Standards including ISO 31000, ISO/IEC 27005, and [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Proposed Security Risk Assessment Framework - TELSAFE. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Standards’ Non-Compliance to CVE-Classification. [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: CVE-based Use Case Security Risk Assessment Framework (CVE-TELSAFE). [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

83 extracted references · 77 canonical work pages

  1. [1]

    A quantitative CVSS-based cyber security risk assessment methodology for IT systems,

    M.U. Aksu, M.H. Dilek, E.I. Tatlı, K. Bicakci, H.I. Dirik, M.U. Demirezen and T. Aykır, “A quantitative CVSS-based cyber security risk assessment methodology for IT systems,”International Carnahan Conference on Security Technology (ICCST), pp. 1–8, 2017

    2017

  2. [2]

    Information security, cybersecurity and privacy pro- tection — Guidance on managing information security risks,

    ISO/IEC 27005, “Information security, cybersecurity and privacy pro- tection — Guidance on managing information security risks,” 2022. [Online]. Available: https://www.iso.org/standard/80585.html

    2022

  3. [3]

    An integrated method for compliance and risk assessment: experiences from a case study,

    S. Esayas and T. Mahler, “An integrated method for compliance and risk assessment: experiences from a case study,” In IEEE Conference on Communications and Network Security (CNS), Florence, pp. 568– 576, 2015

    2015

  4. [4]

    Prioritizing cybersecurity risk for enterprise risk management (NISTIR 8286B),

    S. Quinn, N. Ivy, M. Barrett, G. Witte and R.K. Gardner, “Prioritizing cybersecurity risk for enterprise risk management (NISTIR 8286B),” US Department of Commerce, National Institute of Standards and Technology, 2022

    work page 2022

  5. [5]

    A threat-intelligence driven methodology to incorporate uncertainty in cyber risk analysis and enhance decision- making,

    M. Dekker and L. Alevizos, “A threat-intelligence driven methodology to incorporate uncertainty in cyber risk analysis and enhance decision- making,” Security and Privacy, vol. 7, no. 1, p.e333, 2024

    work page 2024

  6. [6]

    Ele- vating Software Trust: Unveiling and Quantifying the Risk Landscape,

    S.A. Siddiqui, C. Thapa, R. Holland, M. Shao and S. Camtepe, “Ele- vating Software Trust: Unveiling and Quantifying the Risk Landscape,”

    work page

  7. [7]

    Applying a semi-quantitative risk assessment on petroleum production unit,

    F.M. Eltahan, M. Toderas, M.S. Mansour, E.S.Z. El-Ashtoukhy, M.A. Abdou and F. Shokry, “Applying a semi-quantitative risk assessment on petroleum production unit,” Scientific Reports, vol. 14, no. 1, p. 7603, 2024

    work page 2024

  8. [8]

    Semi-Quantitative Risk Assessment: Bridging the Gap Between Qualitative and Quantitative Methods,

    M. Majka, “Semi-Quantitative Risk Assessment: Bridging the Gap Between Qualitative and Quantitative Methods,” 2024

    work page 2024

Show all 83 references
  1. [9]

    Organizational cybersecurity readiness in the ICT sector: a quanti-qualitative assessment,

    M. Neri, F. Niccolini and L. Martino, “Organizational cybersecurity readiness in the ICT sector: a quanti-qualitative assessment,” Information & Computer Security, vol. 32, no. 1, pp. 38–52, 2024

    2024

  2. [10]

    Research on the risk evaluation of enter- prises’ carbon compliance failure,

    X. Wang, Y . Xu and W. Li, “Research on the risk evaluation of enter- prises’ carbon compliance failure,” Frontiers in Ecology and Evolution, vol. 11, pp. 1152804, 2023

    2023

  3. [11]

    Risk management — Guidelines,

    ISO 31000, “Risk management — Guidelines,” 2018. [Online]. Avail- able: https://www.iso.org/iso-31000-risk-management.html

    2018

  4. [12]

    Risk management — Risk assessment techniques,

    IEC 31010, “Risk management — Risk assessment techniques,” 2019. [Online]. Available: https://www.iso.org/standard/72140.html

    2019

  5. [13]

    Risk management and risk profile guidelines for telecommunication organizations,

    ITU-T X.1055, “Risk management and risk profile guidelines for telecommunication organizations,” 2008. [Online]. Available: https://www.itu.int/itu-t/recommendations/rec.aspx?rec=9614

    2008

  6. [14]

    From 5G to 6G: A survey on security, privacy, and standardization pathways,

    M. Yang, Y . Qu, T. Ranbaduge, C. Thapa, N. Sultan, M. Ding, H. Suzuki, W. Ni, S. Abuadbba, D. Smith and P. Tyler, “From 5G to 6G: A survey on security, privacy, and standardization pathways,” ArXiv Preprint arXiv:2410.21986, 2024

    arXiv

  7. [15]

    Two protocols for improving security during the authentication and key agree- ment procedure in the 3GPP networks,

    M.M. Modiri, M. Salmasizadeh, J. Mohajeri and B.H. Khalaj, “Two protocols for improving security during the authentication and key agree- ment procedure in the 3GPP networks,” Computer Communications, vol. 211, pp. 286–301, 2023

    2023

  8. [16]

    Don’t hand it over: Vulnerabilities in the handover procedure of cellular telecommunications,

    E. Bitsikas and C. P ¨opper, “Don’t hand it over: Vulnerabilities in the handover procedure of cellular telecommunications,” In Proceedings of the 37th Annual Computer Security Applications Conference (ACSAC), pp. 900–915, 2021

    2021

  9. [17]

    Strengthening Australia’s Cyber Security Regulations and Incentives,

    Australian Government Department of Home Affairs, “Strengthening Australia’s Cyber Security Regulations and Incentives,” 2020. [Online]. Available: https://www.homeaffairs.gov.au/reports-and- pubs/files/strengthening-australia-cyber-security-regulations-discussion- paper.pdf

    2020

  10. [18]

    BASECOMP: A Comparative Analysis for Integrity Protection in Cellular Baseband Software,

    E. Kim, M.W. Baek, C. Park, D. Kim, Y . Kim and I. Yun, “BASECOMP: A Comparative Analysis for Integrity Protection in Cellular Baseband Software,” In 32nd USENIX Security Symposium (USENIX Security 23), pp. 3547–3563, 2023

    2023

  11. [19]

    European 5G security in the wild: Reality versus expectations,

    O. Lasierra, G. Garcia-Aviles, E. Municio, A. Skarmeta and X. Costa- P´erez, “European 5G security in the wild: Reality versus expectations,” In Proceedings of the 16th ACM Conference on Security and Privacy in Wireless and Mobile Networks, pp. 13–18, 2023

    2023

  12. [20]

    5Ghoul: Unleashing Chaos on 5G Edge Devices,

    M.E. Garbelini, Z. Shang, S. Luo and S. Chattopadhyay, “5Ghoul: Unleashing Chaos on 5G Edge Devices,” Technical report, Singapore University of Technology and Design (SUTD) and I2R, A* STAR, 2023. [Online]. Available: https://asset- group.github.io/disclosures/5ghoul/5ghoul.pdf

    2023

  13. [21]

    Measuring the deploy- ment of 5G security enhancement,

    S. Nie, Y . Zhang, T. Wan, H. Duan and S. Li, “Measuring the deploy- ment of 5G security enhancement,” In Proceedings of the 15th ACM Conference on Security and Privacy in Wireless and Mobile Networks, pp. 169–174, 2022

    2022

  14. [22]

    BaseSpec: Comparative Analysis of Baseband Software and Cellular Specifications for L3 Protocols,

    E. Kim, D. Kim, C. Park, I. Yun and Y . Kim, “BaseSpec: Comparative Analysis of Baseband Software and Cellular Specifications for L3 Protocols,” In Network and Distributed System Security (NDSS), 2021

    2021

  15. [23]

    FIRMWIRE: Trans- parent dynamic analysis for cellular baseband firmware,

    G. Hernandez, M. Muench, D. Maier, A. Milburn, S. Park, T. Scharnowski, T. Tucker, P. Traynor and K. Butler, “FIRMWIRE: Trans- parent dynamic analysis for cellular baseband firmware,” In Network and Distributed Systems Security Symposium (NDSS), 2022

    2022

  16. [24]

    Automata- Based Automated Detection of State Machine Bugs in Protocol Imple- mentations,

    P. Fiterau-Brostean, B. Jonsson, K. Sagonas and F. T ˚aquist, “Automata- Based Automated Detection of State Machine Bugs in Protocol Imple- mentations,” In Network and Distributed Systems Security Symposium (NDSS), 2023

    2023

  17. [25]

    Prochecker: An automated security and privacy analysis framework for 4G LTE protocol imple- mentations,

    I. Karim, S.R. Hussain and E. Bertino, “Prochecker: An automated security and privacy analysis framework for 4G LTE protocol imple- mentations,” In 2021 IEEE 41st International Conference on Distributed Computing Systems (ICDCS), pp. 773–785, 2021

    2021

  18. [26]

    DoLTEst: In- depth downlink negative testing framework for LTE devices,

    C. Park, S. Bae, B. Oh, J. Lee, E. Lee, I. Yun Y . Kim, “DoLTEst: In- depth downlink negative testing framework for LTE devices,” In 31st USENIX Security Symposium, pp. 1325–1342, 2022

    2022

  19. [27]

    C. Yu, S. Chen, Z. Wei and F. Wang, “Secchecker: Inspecting the security implementation of 5G commercial off-the-shelf (COTS) mobile devices. Computers & Security, vol. 132, p. 103361, 2023

    2023

  20. [28]

    Hart, A.L

    S. Hart, A.L. Ferrara, F. and Paci, ”Fuzzy-based approach to assess and prioritize privacy risks,“ Soft Computing, vol.24, pp. 1553–1563, 2020

    2020

  21. [29]

    A.N. Kia, F. Murphy, B. Sheehan and D. Shannon, ”A cyber risk prediction model using common vulnerabilities and exposures,“ Expert Systems with Applications, vol. 237, p. 121599, 2024

    2024

  22. [30]

    Ebere-Uneze and S

    I. Ebere-Uneze and S. Naqvi, ”Using Artificial Intelligence in Cyber Security Risk Management for Telecom Industry 4.0,“ In Proceedings of the 19th International Conference on Availability, Reliability and Security, pp. 1–7, 2024

    2024

  23. [31]

    About the RMF - NIST Risk Management Framework — CSRC,

    I. T. L. Computer Security Division, “About the RMF - NIST Risk Management Framework — CSRC,” 2016. [Online]. Available: https://csrc.nist.gov/projects/risk-management/about-rmf

    2016

  24. [32]

    Technical Standard: Risk Taxonomy,

    The Open Group, “Technical Standard: Risk Taxonomy,” 2009. [Online]. Available: https://pubs.opengroup.org/onlinepubs/9699919899/toc.pdf

    2009

  25. [33]

    [Online]

    COBIT — Control Objectives for Information Technologies — ISACA. [Online]. Available: https://www.isaca.org/resources/cobit#1

  26. [34]

    Risk Assessment with OCTA VE

    PECB, “Risk Assessment with OCTA VE.” [Online]. Available: https://pecb.com/whitepaper/risk-assessment-with-octave

  27. [35]

    Mayer and J

    N. Mayer and J. Aubert, ”A risk management framework for security and integrity of networks and services,“ Journal of Risk Research, vol. 24, no. 8, pp. 987–998, 2021

    2021

  28. [36]

    Curtis and C

    H. Curtis and C. Harpley, ”Telecommunications Sector Risk and Re- silience Profile: PESTLE and Gap Analysis,“ ANU Tech Policy Design Centre, Canberra, ACT, 2023

    2023

  29. [37]

    [Online]

    United States Nuclear Regulatory Commission (U.S.NRC), ”Probabilistic risk assessment (PRA),“ 2021. [Online]. Available: https://www.nrc.gov/reading-rm/basic-ref/glossary/probabilistic-risk- assessment-pra.html

    2021

  30. [38]

    Y . Hu, T. Parhizkar and A. Mosleh, ”Guided simulation for dynamic probabilistic risk assessment of complex systems: concept, method, and application,“ Reliability Engineering & System Safety, vol. 217, p. 108047, 2022

    2022

  31. [39]

    Maidana, T

    R.G. Maidana, T. Parhizkar, A. Gomola, I.B. Utne and A. Mosleh, ”Supervised dynamic probabilistic risk assessment: Review and compar- ison of methods,“ Reliability Engineering & System Safety, vol. 230, p. 108889, 2023

    2023

  32. [40]

    Boyer, ”Probabilistic Risk Assessment (PRA): Analytical Process for Recognizing Design and Operational Risks (No

    R.L. Boyer, ”Probabilistic Risk Assessment (PRA): Analytical Process for Recognizing Design and Operational Risks (No. JSC-E-DAA-TN74089), 2018. [Online]. Available: https://ntrs.nasa.gov/api/citations/20200001598/downloads/20200001598.pdf

    2018

  33. [41]

    Security Risk Analysis of Enterprise Networks Using Probabilistic Attack Graphs,

    A. Singhal, X. Ou, “Security Risk Analysis of Enterprise Networks Using Probabilistic Attack Graphs,” NIST Interagency Report 7788, 2011

    2011

  34. [42]

    A Quantitative Research Study on Probability Risk As- sessments in Critical Infrastructure and Homeland Security

    A.B. Lee, “A Quantitative Research Study on Probability Risk As- sessments in Critical Infrastructure and Homeland Security”, Ph.D. dissertation, Liberty University, 2022

    2022

  35. [43]

    Quantitative risk evaluation based on event tree analysis technique: Application to the design of shield TBM,

    E.S. Hong, I.M. Lee, H.S. Shin, S.W. Nam and J.S. Kong, “Quantitative risk evaluation based on event tree analysis technique: Application to the design of shield TBM,” Tunnelling and Underground Space Technology, vol. 24, no.3, pp. 269–277, 2009

    2009

  36. [44]

    Probabilistic vs. Deterministic Models in AL/ML: A detailed Explana- tion,

    “Probabilistic vs. Deterministic Models in AL/ML: A detailed Explana- tion,” [Online]. Available: https://www.alphanome.ai/post/probabilistic- vs-deterministic-models-in-ai-ml-a-detailed-explanation

  37. [45]

    Basics of Nuclear Power Plant Probabilistic Risk Assessment,

    US. NRC Office of Nuclear Regulatory Research (RES) and Elec- tric Power Research Institute (EPRI), “Basics of Nuclear Power Plant Probabilistic Risk Assessment,” 2010. [Online]. Available: https://www.nrc.gov/docs/ML1025/ML102530294.pdf?

    2010

  38. [46]

    An innovative risk assessment method- ology for medical information systems,

    A. Coronato and A. Cuzzocrea, “An innovative risk assessment method- ology for medical information systems,” IEEE Transactions on Knowl- edge and Data Engineering, vol. 34, no. 7, pp. 3095–3110, 2020

    2020

  39. [47]

    Combining Information Security Risk Management and Probabilistic Risk Assessment,

    K. Padur and R. Matulevicius, “Combining Information Security Risk Management and Probabilistic Risk Assessment,” In BIR Workshops, pp. 14–26, 2019

    2019

  40. [48]

    AFPr-AM: A novel Fuzzy-AHP based privacy risk assessment model for strategic information management of social media platforms,

    M.T. Ahvanooey, M.X. Zhu, S. Ou, H.D. Mazraeh, W. Mazurczyk, K.K.R. Choo and C. Li, “AFPr-AM: A novel Fuzzy-AHP based privacy risk assessment model for strategic information management of social media platforms,” Computers & Security, vol. 130, p. 103263, 2023

    2023

  41. [49]

    Pri- vacy risk assessment and privacy-preserving data monitoring,

    P. Silva, C. Gonc ¸alves, N. Antunes, M. Curado and B. Walek, “Pri- vacy risk assessment and privacy-preserving data monitoring,” Expert Systems with Applications, vol. 200, No. C, 2022

    2022

  42. [50]

    Pri- vacy risk assessment and privacy-preserving data monitoring,

    P. Silva, C. Gonc ¸alves, N. Antunes, M. Curado and B. Walek, “Pri- vacy risk assessment and privacy-preserving data monitoring,” Expert Systems with Applications, vol. 200, p. 116867, 2022

    2022

  43. [51]

    Challenges And Limitations Of Fuzzy Logic,

    Faster Capital, “Challenges And Limitations Of Fuzzy Logic,” [Online]. Available: https://fastercapital.com/topics/challenges-and-limitations-of- fuzzy-logic.html

  44. [52]

    The paradoxical success of fuzzy logic,

    C. Elkan, “The paradoxical success of fuzzy logic,” IEEE Expert, vol. 9, no. 4, pp. 3–8, 1994

    1994

  45. [53]

    The challenges and advantages of fuzzy systems applications A Preprint,

    M. Masoumi, S. Hossani, F. Dehghani and A. Masoumi, “The challenges and advantages of fuzzy systems applications A Preprint,” 2020

    2020

  46. [54]

    Risk assessment and analysis methods: Qualitative and quantitative,

    V . Evrin, “Risk assessment and analysis methods: Qualitative and quantitative,” ISACA Journal, vol. 2, no. 1, pp. 1–6, 2021

    2021

  47. [55]

    Risk management framework for information systems and organizations: a system life cycle approach for security and privacy,

    Joint Task Force Transformation Initiative, “Risk management framework for information systems and organizations: a system life cycle approach for security and privacy,” National Institute of Standards and Technology, Gaithersburg, MD, Tech. Rep. NIST SP 800-37r2, Dec. 2018. [...

    2018

  48. [56]

    The NIST RMF: Strengths and Weaknesses

    “The NIST RMF: Strengths and Weaknesses.” [Online]. Available: https://www.linkedin.com/pulse/nist-rmf-strengths-weaknesses-umair- khan-cissp-ccsp-sscp-5yare

  49. [57]

    Risk Management Framework: Priorities and Challenges for RMF Compliance

    “Risk Management Framework: Priorities and Challenges for RMF Compliance.” [Online]. Available: https://lazarusalliance.com/wp- content/uploads/2022/04/Priorities-and-Challenges-for-RMF- Compliance.pdf

    2022

  50. [58]

    Implementing NIST RMF? Challenges & Strategies for success

    “Implementing NIST RMF? Challenges & Strategies for success.” [Online]. Available: https://www.linkedin.com/pulse/implementing-nist- rmf-challenges-strategies-success-cyberja-wdumf

  51. [59]

    The NIST Risk Management Framework: Problems and recommendations,

    D. Maclean, “The NIST Risk Management Framework: Problems and recommendations,” Cyber Security: A Peer-Reviewed Journal, vol. 1, no. 3, pp. 207–217, Jan. 2017

    2017

  52. [60]

    Why the FAIR Model Can Be So Unfair

    D.A. Yampolskiy and J. Routh, “Why the FAIR Model Can Be So Unfair.” [Online]. Available: https://securityscorecard.com/wp- content/uploads/2024/06/BLOG-The-Fair-Model-Pros-and-Cons- Compressed.pdf

    2024

  53. [61]

    Adopting COBIT in Small and Medium-sized Enterprises (SMEs): Challenges and Opportunities

    “Adopting COBIT in Small and Medium-sized Enterprises (SMEs): Challenges and Opportunities.” [Online]. Available: https://www.linkedin.com/pulse/adopting-cobit-small-medium-sized- enterprises-smes-joel-mutiso-xpq3f

  54. [62]

    What are the key benefits and challenges of implementing CO- BIT 2019 for information systems governance?

    “What are the key benefits and challenges of implementing CO- BIT 2019 for information systems governance?” [Online]. Avail- able: https://www.linkedin.com/advice/0/what-key-benefits-challenges- implementing-cobit

  55. [63]

    IT Governance Frameworks: Understanding their Pros and Cons,

    “IT Governance Frameworks: Understanding their Pros and Cons,” Jul. 2024. [Online]. Available: https://itechgrc.com/pros-and-cons-of- different-it-governance-frameworks/

    2024

  56. [64]

    Threat Modeling Methodology: The OCTA VE Method and its Variants,

    C0rs0, “Threat Modeling Methodology: The OCTA VE Method and its Variants,” Mar. 2024. [Online]. Available: https://c0rs0.medium.com/the- octave-method-and-its-variants-octave-allegro-and-octave-s- dc49ce51a05e

    2024

  57. [65]

    OCTA VE vs FAIR Framework: A Comparative Analysis

    “OCTA VE vs FAIR Framework: A Comparative Analysis” [Online]. Available: https://www.coursesidekick.com/management/1058882

  58. [66]

    Threat Modeling Methodology: OCTA VE

    “Threat Modeling Methodology: OCTA VE.” [Online]. Available: https://www.iriusrisk.com/resources-blog/octave-threat-modeling- methodologies

  59. [67]

    Using AI to Improve Risk Man- agement: A Case Study of a Leading Telecommunications Provider,

    H. Richard, P. Dornheim and T. Weber, “Using AI to Improve Risk Man- agement: A Case Study of a Leading Telecommunications Provider,” IEEE Access, vol. 12, 2024

    2024

  60. [68]

    Clarke, T.A

    E.M. Clarke, T.A. Henzinger, H. Veith and R. Bloem, Eds., Handbook of Model Checking. Cham: Springer International Publishing, 2018. [Online]. Available: http://link.springer.com/10.1007/978-3-319-10575- 8

    2018 doi

  61. [69]

    Mathematical foundations of event trees,

    I.A. Papazoglou, “Mathematical foundations of event trees,” Reliability Engineering & System Safety, vol. 61, no. 3, pp. 169–183, 1998

    1998

  62. [70]

    [Online]

    CVSS v3.1 Equations. [Online]. Available: https://nvd.nist.gov/vuln- metrics/cvss/v3-calculator/v31/equations

  63. [71]

    A5 Event Trees,

    Bureau of Reclamation, “A5 Event Trees,” 2019. [Online]. Available: https://www.usbr.gov/ssle/damsafety/risk/BestPractices/Chapters/A5- EventTrees.pdf

    2019

  64. [72]

    Event Tree Analysis,

    M. Rausand, “Event Tree Analysis,” Norwegian University of Science and Technology (NTNU). Online]. Available: https://www.ntnu.edu/documents/624876/1277590549/chapt03- eta.pdf/6f3e1b19-4824-4812-adc8-9762d2201c22

  65. [73]

    Available: https://www.cve.org/About/Process#CVERecordLifecycle

    [Online]. Available: https://www.cve.org/About/Process#CVERecordLifecycle

  66. [74]

    Catch me if you can: An in-depth study of CVE discovery time and inconsistencies for managing risks in critical infrastructures,

    R.J. Thomas, J. Gardiner, T. Chothia, E. Samanis, J. Perrett and A. Rashid, “Catch me if you can: An in-depth study of CVE discovery time and inconsistencies for managing risks in critical infrastructures,” In Proceedings of the 2020 Joint Workshop on CPS & IoT Security and Pr...

    2020

  67. [75]

    CPE and CVE based technique for software security risk assessment,

    R. Ushakov, E. Doynikova, E. Novikova and I. Kotenko, “CPE and CVE based technique for software security risk assessment,” In 11th IEEE International Conference on Intelligent Data Acquisition and Advanced Computing Systems: Technology and Applications (IDAACS), vol. 1, pp. 35...

    2021

  68. [76]

    [Online]

    NIST, Information Technology Laboratory, National Vulnerability Database. [Online]. Available: https://nvd.nist.gov/

  69. [77]

    [Online]

    First, Common Vulnerability Scoring System v3.1: Specification Docu- ment. [Online]. Available: https://www.first.org/cvss/v3.1/specification- document

  70. [78]

    [Online]

    First, EPSS Exploit Prediction Scoring System. [Online]. Available: https://www.first.org/epss/

  71. [79]

    [Online]

    OpsMx, Enhancing CVE Risk Management: Leveraging EPSS, CVSS, and KEV . [Online]. Available: https://www.opsmx.com/blog/enhancing- cve-risk-management-leveraging-epss-cvss-and-kev/#:˜:text=Enhanced

  72. [80]

    [Online]

    SecOps Solution, Combining CVSS and EPSS to prioritize vulnerabil- ity. [Online]. Available: https://www.secopsolution.com/blog/combining- cvss-and-epss-to-prioritize-vulnerability

  73. [81]

    [Online]

    NIST, Information Technology Laboratory, National Vulner- ability Database, Vulnerability Metrics. [Online]. Available: https://nvd.nist.gov/vuln-metrics/cvss

  74. [82]

    [Online]

    NIST, Information Technology Laboratory, National Vulnerability Database, CVE-2024-7593 Detail. [Online]. Available: https://nvd.nist.gov/vuln/detail/CVE-2024-7593

    2024

  75. [2024]

    arXiv preprint arXiv:2408.02876

    arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.