From Software Business Community

Evaluating software vulnerabilities

Vulnerabilities in software, or more specifically security vulnerabilities are evaluated using the Common Vulnerability Scoring System (CVSS). CVSS is an industry standard for assessing the severity of software vulnerabilities. It attempts to establish a measure of how much concern a vulnerability warrants, compared to other vulnerabilities, so efforts can be prioritized. The score is based on a series of metrics (see below).

Metrics

The CVSS assessment measures three areas of concern:

1. Base Metrics for qualities intrinsic to a vulnerability.
2. Temporal Metrics for characteristics that evolve over the lifetime of vulnerability.
3. Environmental Metrics for characteristics of a vulnerability that depend on a particular implementation or environment.

Base Metrics

1. Is the vulnerability exploitable remotely (as opposed to only locally).
2. How complex must an attack be to exploit the vulnerability?
3. Is authentication required to attack?
4. Does the vulnerabilty expose confidential data?
5. Can attacking the vulnerability damage the integrity of the system?
6. Does it impact availability of the system?

Temporal Metrics

1. How complex (or how long will it take) to exploit the vulnerability.
2. How hard (or how long) will it take to remediate the vulnerability.
3. How certain is the vulnerability's existence.

Environmental Metrics

1. Potential to cause collateral damage.
2. How many systems (or how much of a system) does the vulnerability impact.
3. Security Requirement(CIA)

Links

• the Forum of Incident Response Teams FIRST CVSS site
• National Vulnerability Database NVD CVSS site
• Security-Database online CVSS 2.0 calculator
• All software vulnerabilities records at the NVD site

References