Development and Validation of a Risk-Based Vulnerability Management Framework for Systems Operation of Pangasinan State University

Abstract

This capstone project focuses on the development and validation of a Risk-Based Vulnerability Management Framework (VMF) for the systems operations of Pangasinan State University (PSU), Binmaley Campus. The study addresses the critical need for a structured, context-aware security governance engine to replace the institution's reactive, point-in-time vulnerability management practices. Grounded in the Design Science Research Methodology (DSRM), the framework integrates dynamic threat intelligence from the Exploit Prediction Scoring System (EPSS) and the CISA Known Exploited Vulnerabilities (KEV) catalog to prioritize vulnerabilities based on actual exploitation likelihood rather than static technical severity scores alone. The research assessed the current status of vulnerability management practices across four pillars: asset identification, vulnerability assessment, remediation, and monitoring. Findings revealed significant operational gaps including a 197-day structural detection lag, fragmented asset visibility, and alert fatigue among IT practitioners due to CVSS-only prioritization. The developed framework features four interoperable modules: a Vulnerability Knowledge Base for intelligence consolidation, an Automated Scanning Engine for continuous discovery, a Context-Aware Prioritization Module utilizing Vulnerability Management Chaining (VMC) logic, and a Standardization Layer for automated remediation workflows. Validation was conducted through a dual-track approach involving cybersecurity experts who evaluated technical functionality and completeness using Lawshe's Content Validity Ratio (CVR), and IT practitioners who assessed usability and applicability through the Technology Acceptance Model (TAM). Results yielded perfect CVR scores of 1.0 for functionality and completeness, with practitioners strongly agreeing on the framework's usability and applicability. The validated framework provides an 18-fold efficiency improvement in remediation workflows, significantly reducing the urgent vulnerability workload while maintaining coverage of weaponized threats to mission critical academic and administrative databases.