3 ms·

> First of all, a linear “score” like CVSS just cannot work in cybersecurity. Instead, we should have a system on the attributes of a vulnerability. This is ex

> First of all, a linear “score” like CVSS just cannot work in cybersecurity. Instead, we should have a system on the attributes of a vulnerability. This is exactly what CVSS is: a scoring system based on attributes. > In the first category, we might have attributes such as: Needs physical access to the machine, Needs to have software running on the same machine, even if in a VM, Needs to run in the same VM. This is exactly what the AV vector in CVSS is. > In the second category, we might have attributes such as: Arbitrary execution, Data corruption (loss of integrity), Data exfiltration (loss of confidentiality). This is exactly what impact metrics in CVSS are. I fear the author has a severe misunderstanding of what CVSS is and where the scores come from. There's even an entire CVSS adjustment section for how to modify a score based on your specific environment. I'd recommend playing around with the calculator a little to understand how the scores work better: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator

meander_water 2y ago
And CVSS4 has added more metrics - including an AT (Attack Requirements) field: > Are there any conditions necessary for an attack which the attacker cannot influence? https://nvd.nist.gov/vuln-metrics/cvss/v4-calculator https://nvd.nist.gov/vuln-metrics/cvss/v4-calculator
aja12 2y ago
As a pentester, who does not love CVSS[0], I found the article explaining how to replace CVSS with CVSS very amusing [0] CVSS is often poorly understood and used by internal teams so for our internal engagements, we prefer words like "minor", "medium", "major", "critical" to describe criticity and impact and "easy", "medium", "hard" to describe exploitation difficulty (which loosely translates to likelihood), and the reasoning behind all this is very similar to what CVSS does
- shagie 2y ago
  Have you ever stumbled across the PEF/REV method for classifying bugs? https://www.fincher.org/tips/General/SoftwareDevelopment/BugTracking.shtml https://www.fincher.org/tips/General/SoftwareDevelopment/Bug... The essence of it is that "PEF" is from the user's point of view - pain, effort (work around), frequency. "REV" is from the developer's point of view- risk, effort (fix), verifiability. Something that has a low PEF score and high REV score would not be practical to fix while something that is high PEF and low REV is something that should be prioritized high.

meander_water 2y ago

And CVSS4 has added more metrics - including an AT (Attack Requirements) field: > Are there any conditions necessary for an attack which the attacker cannot influence? https://nvd.nist.gov/vuln-metrics/cvss/v4-calculator https://nvd.nist.gov/vuln-metrics/cvss/v4-calculator

aja12 2y ago

As a pentester, who does not love CVSS[0], I found the article explaining how to replace CVSS with CVSS very amusing [0] CVSS is often poorly understood and used by internal teams so for our internal engagements, we prefer words like "minor", "medium", "major", "critical" to describe criticity and impact and "easy", "medium", "hard" to describe exploitation difficulty (which loosely translates to likelihood), and the reasoning behind all this is very similar to what CVSS does

shagie 2y ago
Have you ever stumbled across the PEF/REV method for classifying bugs? https://www.fincher.org/tips/General/SoftwareDevelopment/BugTracking.shtml https://www.fincher.org/tips/General/SoftwareDevelopment/Bug... The essence of it is that "PEF" is from the user's point of view - pain, effort (work around), frequency. "REV" is from the developer's point of view- risk, effort (fix), verifiability. Something that has a low PEF score and high REV score would not be practical to fix while something that is high PEF and low REV is something that should be prioritized high.