Підхід до комбінації методу CRAMM з методом CVSS для покращення оцінки ризику інформаційної безпеки компанії

Abstract

The report presents a proposal for improving the methodology CRAMM for assessing information security risks, taking into account the solutions presented in the methodology for assessing the vulnerabilities of the CVSS. The improvement consists in modernizing the procedure for calculating the level of vulnerability by adding the parameters of the basic metric of the CVSS methodology. This will significantly increase the accuracy of information security risk calculations when building the company's information security management system.