International Business Machines Corporation
APPLICATION SELECTION BASED ON CUMULATIVE VULNERABILITY RISK ASSESSMENT

Abstract:

Using a processor and a memory of a testing system, a set of vulnerability testing instructions is executed relative to an application, causing an output of a set of vulnerabilities from the testing system. By executing a probability model, a first probability of adverse impact corresponding to a first vulnerability in the set of vulnerabilities is computed. The first vulnerability and the first probability of adverse impact are added to a vulnerability repository. Using the first probability of adverse impact and a second probability of adverse impact, a first cumulative probability of adverse impact is calculated. Using the first cumulative probability and a first level of organizational impact corresponding to the application, a first risk category is assigned to the application. Responsive to the first risk category being lower than a second risk category, a system management application is caused to install the application in the computer system.