3 ms·

I disagree. The point is to help you prioritize based on the threat model and mitigating controls in place. If you have 20 medium vulns you need to know which

I disagree. The point is to help you prioritize based on the threat model and mitigating controls in place. If you have 20 medium vulns you need to know which one has higher complexity to exploit,remote exploitation,authentication required,etc... Ideally a vuln management program will add other in house metrics based on the asset,data and security controls and threat exposure. You have limited resources that can be allocated to testing patches,coordinating deployment,eploying them and making sure there are no adverse side effects and if there are to work with the product vendor or implement controls. CVSS is extremely valuable but more so for proioritizing than for reporting. Executive reports should beuch simpler and usually contain other details such as patch turn around time,exceptions and trends. For the example you mentioned,yes, a false sense of security is worse than no security. You also take into account things like just "telnet,but telnet isn't always used for management or confidential access"(e.g.:lots if meter readers and BAC type devices have read only telnet) vs "self signed cert for a service that probably handles sensitive data which is why it supports encryption to begin with"

rtempaccount1 7y ago
Of course each organization should have their own threat model, mitigations and the like in place. Those organizations also know not to take a CVSS base score as a gospel. However I'd suggest that many organizations are not that sophisticated and that many many organizations take CVSS score base scores as objective measures of vulnerability, and that that is dangerous. Also the point about things like "difficulty to exploit", well that's often subjective and there's no way the analyst assigning the score has a good picture of the real-world likelihood in every case, so the idea that they can assign a universal number to that is incorrect. If an organization wants to use CVSS internally and assign their scores for their environment, with a consistent set of scoring criteria, that could work (although I'd argue high/medium/low would work just as well)
- badrabbit 7y ago
  Exploitability is relative,as in compared to other bugs of a similar class. Subjwctivity is not always bad. CVSS score is better than nothing.like i said before, high/medium/low is not granular enough. How is it different than having a 3 point numerical scale? Do you disagree with the granularity? Just MS patch tuesday could be dozens of patches. If you have the process you can use cvss as a starting point for generating final risk score. If you don't CVSS provides you with some guidance as to what you should prioritize. It's meant to be an aid not a rule. In the end you should patch all vulns and prioritize as it makes sense in your environment
  - tptacek 7y ago
    CVSS scores are worse than nothing. You can make self-XSS come out high, and RCE come out low, and people routinely do both. False certainty is worse than uncertainty.
    - badrabbit 7y ago
      While I agree with your last sentence, I believe you are misunderstanding the purpose of the score. It is meant to facilitate your risk assesment. Taking your example, A lot of people think RCE is automatically bad and XSS not so much(but yeah,self-XSS is mostly low sev). If the vuln is regarding a bug where theoretically RCE might be possible but there are no known exploits then it should have a lower exploitability score than unauthenticated XSS on a login page right? Similarly, naive people might think DoS isn't so bad but service disruption can be a lot worse than RCE on the asset,data and threat model. CVSS is meant to guide those people so they prioritize based on a standard score rather than intuition. Threat model is another thing,if you expect attackers that can rapidly develop exploits after discovery then you would increase/adjust the exploitability score yourself (and the score does change over time as exploits are made public). I guess my perspective is that hygeine is hygeine,either you have it or not.all vulns should be remediated regardless if any scores. I have been responsible to give guidance to IT ops teams on prioritizing patches and this helps,but you have to understand the purpose and meaning behind the scores. It can certainly be misunderstood and I am sure there are many improvement opportunities like what you mentioned but the alternative is to expect resource limited staff to read and understand every vuln (including how specific complex attacks can be pulled off). And even if that was possible,how does someone manage said staff validate things are being prioritized and properly? How do you get an external auditor to properly assess your practices if you interpret every vuln autonomously without any well established and understood priority structure. I mean you can change the score according to your opinion all you want but at least you can say "Because of _____ I am increasing the exploitability score" as opposed to "I dont think it's so bad so I'll score it n". Maybe I just have a different perspective. Haven't heard of OSVDB in a long time but it exists too. Most orgs need something to feel this need.
      - 7y ago

rtempaccount1 7y ago

Of course each organization should have their own threat model, mitigations and the like in place. Those organizations also know not to take a CVSS base score as a gospel. However I'd suggest that many organizations are not that sophisticated and that many many organizations take CVSS score base scores as objective measures of vulnerability, and that that is dangerous. Also the point about things like "difficulty to exploit", well that's often subjective and there's no way the analyst assigning the score has a good picture of the real-world likelihood in every case, so the idea that they can assign a universal number to that is incorrect. If an organization wants to use CVSS internally and assign their scores for their environment, with a consistent set of scoring criteria, that could work (although I'd argue high/medium/low would work just as well)

badrabbit 7y ago
Exploitability is relative,as in compared to other bugs of a similar class. Subjwctivity is not always bad. CVSS score is better than nothing.like i said before, high/medium/low is not granular enough. How is it different than having a 3 point numerical scale? Do you disagree with the granularity? Just MS patch tuesday could be dozens of patches. If you have the process you can use cvss as a starting point for generating final risk score. If you don't CVSS provides you with some guidance as to what you should prioritize. It's meant to be an aid not a rule. In the end you should patch all vulns and prioritize as it makes sense in your environment
- tptacek 7y ago
  CVSS scores are worse than nothing. You can make self-XSS come out high, and RCE come out low, and people routinely do both. False certainty is worse than uncertainty.
  - badrabbit 7y ago
    While I agree with your last sentence, I believe you are misunderstanding the purpose of the score. It is meant to facilitate your risk assesment. Taking your example, A lot of people think RCE is automatically bad and XSS not so much(but yeah,self-XSS is mostly low sev). If the vuln is regarding a bug where theoretically RCE might be possible but there are no known exploits then it should have a lower exploitability score than unauthenticated XSS on a login page right? Similarly, naive people might think DoS isn't so bad but service disruption can be a lot worse than RCE on the asset,data and threat model. CVSS is meant to guide those people so they prioritize based on a standard score rather than intuition. Threat model is another thing,if you expect attackers that can rapidly develop exploits after discovery then you would increase/adjust the exploitability score yourself (and the score does change over time as exploits are made public). I guess my perspective is that hygeine is hygeine,either you have it or not.all vulns should be remediated regardless if any scores. I have been responsible to give guidance to IT ops teams on prioritizing patches and this helps,but you have to understand the purpose and meaning behind the scores. It can certainly be misunderstood and I am sure there are many improvement opportunities like what you mentioned but the alternative is to expect resource limited staff to read and understand every vuln (including how specific complex attacks can be pulled off). And even if that was possible,how does someone manage said staff validate things are being prioritized and properly? How do you get an external auditor to properly assess your practices if you interpret every vuln autonomously without any well established and understood priority structure. I mean you can change the score according to your opinion all you want but at least you can say "Because of _____ I am increasing the exploitability score" as opposed to "I dont think it's so bad so I'll score it n". Maybe I just have a different perspective. Haven't heard of OSVDB in a long time but it exists too. Most orgs need something to feel this need.
    - 7y ago