37 ms·

> the ratings themselves are total horseshit and are running industry joke Any further references to this? I’d love to have something I can send around interna

by vosper 5y ago

> the ratings themselves are total horseshit and are running industry joke Any further references to this? I’d love to have something I can send around internally. The people running Tenable tend to treat these numbers as gospel.

formerly_proven 5y ago
This isn't specific to CVSS, it's the same for literally any kind of security-related rating or classification system.
ramimac 5y ago
Honestly, I'm sure there are better sources - but this might be worthwhile just for the irony: https://www.tenable.com/blog/why-you-need-to-stop-using-cvss-for-vulnerability-prioritization https://www.tenable.com/blog/why-you-need-to-stop-using-cvss...
bitexploder 5y ago
Well, just pull up a CVSS calculator and start asking yourself questions and playing with it. As a fun game we would have people independently rate bugs on our Slack, mind you these are seasoned information security consultants that have broken a lot of software, and the ratings were hilariously far apart. Ask everyone to rate it low/medium/high/critical and consensus was pretty easy to achieve. Anyway the point is the criteria are quite subjectively. What comes out seems very quantitative, but it’s basically a pile of Jello in terms of how solid it is.
beermonster 5y ago
You really should be performing your own risk assessment so you can convert this notional context-free severity rating to your own context-related impact and likelihood to give you your own company risk rating. Ratings over a certain number (to be agree with at board level - in effect your risk appetite) should be treated (risk remediated, removed, transferred to a third party etc etc). We also do this with pen test reports which suffer the same kinds of issues. Usually find that sometimes a medium is a critical for us and some times a high is a low for us - based on performing this kind of assessment.
- vosper 5y ago
  > You really should be performing your own risk assessment so you can convert this notional context-free severity rating to your own context-related impact and likelihood to give you your own company risk rating. Totally agree, and I do that - check the vulnerability description, see if we’re using that part of the library, etc… it usually works out that we’re not actually affected by whatever the alert is.

by vosper 5y ago

formerly_proven 5y ago

This isn't specific to CVSS, it's the same for literally any kind of security-related rating or classification system.

ramimac 5y ago

Honestly, I'm sure there are better sources - but this might be worthwhile just for the irony: https://www.tenable.com/blog/why-you-need-to-stop-using-cvss-for-vulnerability-prioritization https://www.tenable.com/blog/why-you-need-to-stop-using-cvss...

bitexploder 5y ago

Well, just pull up a CVSS calculator and start asking yourself questions and playing with it. As a fun game we would have people independently rate bugs on our Slack, mind you these are seasoned information security consultants that have broken a lot of software, and the ratings were hilariously far apart. Ask everyone to rate it low/medium/high/critical and consensus was pretty easy to achieve. Anyway the point is the criteria are quite subjectively. What comes out seems very quantitative, but it’s basically a pile of Jello in terms of how solid it is.

beermonster 5y ago

You really should be performing your own risk assessment so you can convert this notional context-free severity rating to your own context-related impact and likelihood to give you your own company risk rating. Ratings over a certain number (to be agree with at board level - in effect your risk appetite) should be treated (risk remediated, removed, transferred to a third party etc etc). We also do this with pen test reports which suffer the same kinds of issues. Usually find that sometimes a medium is a critical for us and some times a high is a low for us - based on performing this kind of assessment.

vosper 5y ago
> You really should be performing your own risk assessment so you can convert this notional context-free severity rating to your own context-related impact and likelihood to give you your own company risk rating. Totally agree, and I do that - check the vulnerability description, see if we’re using that part of the library, etc… it usually works out that we’re not actually affected by whatever the alert is.