A Risk Assessment of Web Server: Impact Classification by Loss Type

摘要

Risk assessment is required by many organizations asa basis for deciding which solutions are to beimplemented to secure systems. A variety of riskassessment techniques and tools have been developed.Concerning the usage of web server in real worldapplications, this paper proposes architecture for webserver risk assessment. The architecture is based on CVE(Common Vulnerabilities and Exposures). Regarding theconcerned components of computer security, the weightedimpact is classified into confidentiality, integrity andavailability. The developed tool used in this paper collectsthe related information via Hypertext Transfer Protocol(HTTP). The web server error risk is calculated from thecollected information. The last part of this paper is thecomparison of the risk value of web server under thedifferent domains in Thailand.