CVSS

| Comments (5) | TrackBacks (172) |
Adam Shostack points to the Common Vulnerability Scoring System (CVSS):
Over the past several years, a number of large computer security vendors and not-for-profit organizations have developed, promoted, and implemented procedures to rank information system vulnerabilities. Unfortunately, there has been no cohesion or interoperability among these systems. Also, existing systems tend to be limited in scope as to what they cover. Finally, all of these systems tend to be Internet-centric; that is, they tend to be concerned only with vulnerabilities affecting computers connected to the worldwide Internet. The NIAC commissioned this project to propose an open and universal vulnerability scoring system to address and solve these shortcomings, with the ultimate goal of promoting a common understanding of vulnerabilities and their impact.

To get the CVSS score for a given vulnerability, you give it individual scores along a number of axes, e.g.:

  • Access vector (local, remote, ...)
  • Access complexity (high, low)
  • Integrity impact (none, partial, complete).

CVSS then specifies an algorithm to aggregate all of this individual scores into a single linear score, which presumably gives you some impression of the severtity of the vulnerability.

I certainly agree that it's useful to have a common nomenclature and system for describing the characteristics of any individual vulnerability, but I'm fairly skeptical of the value of the CVSS aggregation formula. In general, it's pretty straightforward to determine linear values for each individual axis, and all other things being equal, if you have a vulnerability A which is worse on axis X than vulnerability B, then A is worse than B. However, this only gives you a partial ordering of vulnerability severity. In order to get a complete ordering, you need some kind of model for overall severity. Building this kind of model requires some pretty serious econometrics.

CVSS does have a formula which gives you a complete ordering but the paper doesn't contain any real explanation for where that formula comes from. The weighting factors are pretty obviously anchor points (.25, .333, .5) so I'm guessing they were chosen by hand rather than by some kind of regression model. It's not clear, at least to me, why one would want this particular formula and weighting factors rather than some other ad hoc aggregation function or just someone's subjective assessment.

172 TrackBacks

Listed below are links to blogs that reference this entry: CVSS.

TrackBack URL for this entry: http://www.educatedguesswork.org/cgi-bin/mt/mt-tb.cgi/169

More on CVSS from Emergent Chaos on March 6, 2005 4:38 PM

Erik Rescorla takes note of my CVSS post, and comments that he's not sure he likes some technical aspects of the system (emphasis added): CVSS does have a formula which gives you a complete ordering but the paper doesn't... Read More

online poker from online poker on June 7, 2005 12:57 AM

You are invited to check out the pages dedicated to pacific poker poker games Read More

texas holdem from texas holdem on June 8, 2005 12:36 AM

You can also check out the pages about poker Read More

blackjack from blackjack on June 8, 2005 11:16 AM

You can also check out some information dedicated to blackjack Read More

texas holdem from texas holdem on June 8, 2005 7:27 PM

You can also check the sites dedicated to texas hold em Read More

online poker from online poker on June 9, 2005 4:47 AM

Please check some information about texas hold em Read More

casino from casino on June 9, 2005 2:10 PM

You are invited to check the sites about casino Read More

home equity loans from home equity loans on June 10, 2005 7:56 AM

You can also check the sites in the field of home loans home equity loan Read More

pill identification from pill identification on June 10, 2005 6:13 PM

You can also visit the sites in the field of weight loss drugs Read More

online pharmacy from online pharmacy on June 11, 2005 2:45 AM

You can also check some helpful info dedicated to viagra online Read More

online poker from online poker on June 11, 2005 1:24 PM

Please visit the pages about online poker Read More

blackjack from blackjack on June 11, 2005 9:32 PM

Please check some information in the field of blackjack Read More

party poker from party poker on June 12, 2005 7:22 AM

You may find it interesting to visit some information in the field of party poker Read More

party poker from party poker on June 13, 2005 9:28 PM

You are invited to check out some helpful info about party poker Read More

rules for texas hold em card game from rules for texas hold em card game on June 15, 2005 5:36 PM

In your free time, check some helpful info on strip poker poker tables Read More

online poker from online poker on June 16, 2005 1:21 AM

You can also check the pages on poker games party poker pacific poker Read More

What causes varicose and spider veins? Why do varicose and spider veins usually appear in the legs? Read More

online blackjack from online blackjack on June 17, 2005 5:10 PM

Please check some relevant pages about internet casino craps Read More

card poker from card poker on June 18, 2005 2:51 AM

In your free time, visit some information on poker poker tables Read More

poker rules from poker rules on June 18, 2005 2:21 PM

Take your time to check out the sites dedicated to poker games party poker Read More

You are invited to check some helpful info about roulette jack black Read More

empire poker from empire poker on June 19, 2005 5:56 PM

Take your time to visit the sites on poker games party poker Read More

free poker from free poker on June 20, 2005 8:04 PM

Please check the pages about free poker Read More

texas holdem from texas holdem on June 21, 2005 4:08 AM

In your free time, check out some relevant pages in the field of texas holdem Read More

What causes varicose and spider veins? Why do varicose and spider veins usually appear in the legs? Read More

internet casino from internet casino on June 21, 2005 7:12 PM

You may find it interesting to check out some relevant pages dedicated to internet casino Read More

tips for texas hold em from tips for texas hold em on June 22, 2005 3:48 AM

You can also check out some relevant information dedicated to poker celebrity poker Read More

texas hold em muck lost from texas hold em muck lost on June 22, 2005 1:17 PM

You may find it interesting to take a look at some helpful info in the field of star poker poker chips for sale Read More

poker variations from poker variations on June 22, 2005 11:06 PM

You can also check some relevant pages in the field of poker rules poker odds Read More

free online poker from free online poker on June 24, 2005 2:11 AM

Take your time to check some information dedicated to world series of poker free online poker Read More

roulette from roulette on June 25, 2005 3:33 AM

You may find it interesting to check out some relevant pages in the field of blackjack free slots Read More

empire poker from empire poker on June 25, 2005 1:50 PM

You may find it interesting to check the sites on pacific poker poker Read More

payday loan from payday loan on June 25, 2005 9:53 PM

You may find it interesting to check the sites dedicated to loans home loans Read More

poker hand rankings from poker hand rankings on June 26, 2005 6:45 AM

Please take a look at some helpful info dedicated to world series of poker free online poker Read More

poker poker rooms competitions from poker poker rooms competitions on June 26, 2005 4:05 PM

Take your time to visit some relevant pages dedicated to plastic poker cards turbo texas holdem Read More

empire poker from empire poker on June 29, 2005 5:32 AM

Take your time to visit the pages dedicated to pacific poker poker games Read More

free texas hold em online play from free texas hold em online play on June 29, 2005 2:07 PM

You are invited to check out some relevant information dedicated to how to build a poker table Read More

clay poker chips from clay poker chips on June 30, 2005 7:01 AM

You can also visit some relevant pages about poker online reviews texas holdem basics Read More

texas holdem best hands from texas holdem best hands on June 30, 2005 11:48 PM

Take your time to check some information about download online poker cris moneymaker online poker Read More

multiplayer poker online from multiplayer poker online on July 1, 2005 4:54 PM

Please visit some relevant information about online texas hold em mac guide to texas holdem Read More

aruba casino from aruba casino on July 2, 2005 5:43 PM

You can also visit some helpful info dedicated to code to count cards in blackjack used slot machine Read More

casino employment from casino employment on July 3, 2005 1:27 AM

In your free time, take a look at some relevant pages about enchanted forest slot machine Read More

keno from keno on July 3, 2005 8:15 AM

You can also check out the sites dedicated to free video poker online black jack Read More

In your free time, take a look at the sites dedicated to diets wrinkle cream Read More

neurontin from neurontin on July 4, 2005 5:44 AM

Take your time to take a look at the pages on protonix proactive skin care Read More

poker rooms from poker rooms on July 4, 2005 12:55 PM

In your free time, visit some information in the field of party poker texas hold em poker rooms Read More

poker games from poker games on July 5, 2005 3:59 AM

Please check the pages dedicated to poker games texas holdem Read More

party poker from party poker on July 6, 2005 1:07 AM

You can also check the sites dedicated to poker rooms party poker Read More

texas holdem from texas holdem on July 6, 2005 9:36 AM

You can also take a look at some information on pacific poker poker games Read More

texas holdem from texas holdem on July 6, 2005 4:40 PM

Take your time to check the pages dedicated to poker rooms empire poker Read More

texas holdem cheets from texas holdem cheets on July 7, 2005 1:33 PM

You are invited to take a look at the pages dedicated to Texas Holdem Pit Boss Table Tops Read More

slot machines from slot machines on July 7, 2005 4:53 PM

You may find it interesting to visit the pages on casino online gambling Read More

roulette from roulette on July 8, 2005 12:40 AM

In your free time, take a look at some helpful info dedicated to online gambling slot machines Read More

free credit check from free credit check on July 8, 2005 7:40 AM

Take your time to check some relevant pages dedicated to home mortgage calculator cash advance Read More

online poker from online poker on July 8, 2005 3:50 PM

Please check out some relevant information in the field of poker Read More

poker rooms from poker rooms on July 8, 2005 11:58 PM

Please check some relevant pages about empire poker texas holdem Read More

You may find it interesting to visit some relevant information about blackjack Read More

roulette wheel from roulette wheel on July 16, 2005 7:43 AM

Please visit the sites in the field of casino on net casino gambling Read More

Cheap Cruises from cheap cruises on July 21, 2005 3:09 PM

Looking for a grand cruise at an unbelievably low price? Check out our complete listing of deeply discounted cruises departing in the next 90 days. Read More

Baby Names from Vanessa Babies Blog on July 21, 2005 9:48 PM

Search names and meanings. Includes naming tips and lists, with origins. Read More

Tom Cruise Kills Oprah from Tom Cruise Kills Oprah on July 30, 2005 3:34 AM

Tom Cruise Kills Oprah Funny Video Read More

poker download from poker download on July 31, 2005 4:34 AM

Take your time to take a look at some relevant information on stud poker texas holdem tables Read More

keno casino from keno casino on July 31, 2005 10:46 AM

keno casino Read More

keno online from keno online on July 31, 2005 12:27 PM

keno online Read More

Green Tea from Green Tea Blog on August 1, 2005 4:21 PM

Green tea is the least processed of all the teas except for white tea. Read More

keno online from keno online on August 2, 2005 7:29 AM

online keno Read More

2005 Lincoln Navigator Review from 2005 Lincoln Navigator Review on August 3, 2005 4:25 AM

A new engine and transmission highlight 2005 updates to Lincoln’s Ford Expedition spinoff. Read More

2005 BMW 5-Series Review from 2005 BMW 5-Series Review on August 3, 2005 2:06 PM

All models have BMW’s iDrive, which uses a console “joystick” knob to control entertainment, navigation, communication, and climate functions. Read More

2005 Mercedes-Benz E-Class Review from 2005 Mercedes-Benz E-Class Review on August 3, 2005 2:51 PM

Front and rear side airbags, head-protecting curtain side airbags, and Mercedes’ TeleAid assistance are standard. Read More

2005 Mercury Montego Review from 2005 Mercury Montego Review on August 4, 2005 12:37 AM

Montego comes in Luxury and Premier models with a 203-hp 3.0-liter V6. Read More

2005 Porsche Cayenne Review from 2005 Porsche Cayenne Review on August 5, 2005 2:42 AM

Cayennes have all-wheel drive with low-range gearing and locking center differential. Read More

2005 Honda Accord Review from 2005 Honda Accord Review on August 5, 2005 4:16 AM

Accord offers coupes and sedans in LX and EX trim, plus price-leader DX and VP sedans, and SE coupes Read More

2005 Chrysler 300 Review from 2005 Chrysler 300 Review on August 6, 2005 1:51 AM

he rear-drive 300 is available only as a four-door sedan, but there are four variations on that theme Read More

Usher from Yet another Usher Blog on August 6, 2005 3:07 AM

... Read More

2005 Volkswagen Jetta Review from 2005 Volkswagen Jetta Review on August 7, 2005 3:14 AM

The Jetta’s structure underneath has also been stiffened up to granite-like levels, with claimed increases of 15%, 35%, and 80% in torsional rigidity, flex rigidity, and static torsional rigidity. Read More

2005 Mercedes-Benz SLK350 Review from 2005 Mercedes-Benz SLK350 Review on August 9, 2005 3:35 AM

The SLK has a proper Mercedes-Benz feature set, from a full range of power assists and a multifunction display accessed by selector buttons on its three-spoke steering wheel to dual-zone climate control, an anti-theft system with TeleAid Stolen Vehicle... Read More

2005 Cadillac XLR Review from 2005 Cadillac XLR Review on August 9, 2005 1:09 PM

While the Corvette is still the champion of American high-performance sports cars the XLR is its mighty sophisticated cousin – just the right choice to explore the Gold Coast on a summer day. Read More

2005 Mercedes-Benz C-Class Review from 2005 Mercedes-Benz C-Class Review on August 9, 2005 2:03 PM

All C-Class cars have been freshened with new exterior styling cues for 2005, including wider set quad-ovoid headlights and revised taillights. Read More

2005 Audi A4 Review from 2005 Audi A4 Review on August 10, 2005 4:01 PM

The second-generation A4 is heavier than its predecessor, but greater rigidity and firmer suspension ensure that it’s still one of the best handling cars in the entry-luxury segment. Read More

2005 Lincoln LS Review from 2005 Lincoln LS Review on August 11, 2005 8:31 PM

The 2005 Lincoln LS comes in five versions this year, built around two engine choices: the V6 Luxury is the base version, followed by the V6 Appearance and Premium models. Read More

2005 Honda Civic Review from 2005 Honda Civic Review on August 11, 2005 10:19 PM

Three specialized Civics are designed specifically to minimize environmental impact and deliver better fuel economy than all but a few cars currently available. Read More

2005 Mitsubishi Lancer Review from 2005 Mitsubishi Lancer Review on August 13, 2005 1:07 AM

The best value, most sensible and most popular model is the Lancer ES, a pleasant sedan with a smooth ride, good handling, and a comfortable, nicely trimmed interior. Read More

tattoo Read More

2005 Lincoln Town Car Review from 2005 Lincoln Town Car Review on August 17, 2005 1:59 AM

The 2005 Lincoln Town Car offers significant interior room and luxury on all models. Read More

Lincoln LS from Lincoln LS on August 18, 2005 5:59 AM

The Lincoln LS remains the sportiest car in Lincoln’s line-up, and the one best suited for enthusiast drivers. Read More

Mercury Grand Marquis from Mercury Grand Marquis on August 18, 2005 2:01 PM

Grand Marquis’ performance and accommodations mirror those of similarly equipped Crown Victorias. Read More

Cadillac CTS from Cadillac CTS on August 19, 2005 4:52 AM

2004 also brings some needed softness into the interior, and tweaks the suspension to balance that additional horsepower on the road. Read More

BMW 7-Series from BMW 7-Series on August 23, 2005 2:51 PM

The 745i has a feature allowing the driver to downshift manually using a pair of buttons on the steering wheel, but I found that feature to be superfluous. Read More

The TL delivers sharp-handling, a powerful V6 engine, a fully independent suspension, and the latest active safety electronics to optimize driving dynamics. Read More

The TL delivers sharp-handling, a powerful V6 engine, a fully independent suspension, and the latest active safety electronics to optimize driving dynamics. Read More

2005 Volkswagen Jetta Review from 2005 Volkswagen Jetta Review on August 24, 2005 5:21 PM

The torsion beam suspension (which some considered independent, some didn’t) that has held up the rear end of every Jetta before it has been dumped for a brand-new mutli-link arrangement, just like all the better cars in this class. Read More

Mitsubishi Eclipse from Mitsubishi Eclipse on August 25, 2005 3:30 PM

The Eclipse Spyder is generally pleasant to drive, thanks to a smooth power delivery and a compliant suspension. Read More

Nissan 350Z from Nissan 350Z on August 26, 2005 2:11 PM

The 350Z is available as a hatchback coupe and a convertible. The coupe comes in base, Enthusiast, Performance, Touring, Track, and 35th Anniversary Edition. Read More

Toyota Supra from Toyota Supra on August 27, 2005 1:00 PM

The Toyota Supra is powered by the renowned 2JZ-GTE high-performance, twin-cam, in-line six-cylinder, 24-valve, electronically fuel-injected engine. Read More

Honda S2000 from Honda S2000 on August 28, 2005 3:26 AM

The rear-wheel-drive S2000 has a torque-sensing limited-slip rear differential for excellent traction in both performance and inclement weather situations. Read More

best result weight loss drug from best result weight loss drug on August 28, 2005 9:47 PM

You can also take a look at the sites about compare weight loss drugs Read More

Toyota Highlander from Toyota Highlander on August 29, 2005 2:03 AM

The standard front-wheel-drive, four-cylinder Highlander makes a superb wagon for the city and suburbs, especially now that traction control and stability control are standard equipment. Read More

The xB has front-wheel drive and a platform shared with Scion’s smaller xA, but tops it with a taller vanlike body with a one-piece rear liftgate. Read More

The Cooper and Cooper S get new manual gearboxes with revised gearing for improved acceleration, and the S gets a slight bump in power to 168 horsepower. Read More

Dodge Charger from Dodge Charger on August 30, 2005 3:09 PM

Armchair automotive designers seem to forget that the last Charger was a four-cylinder, front-wheel-drive car based on the deplorable Dodge Omni. Read More

It’s our impression that Ford has done a little more upgrading on the Bronco than either Chevrolet or GMC has done with its offerings. Read More

Honda Prelude from Honda Prelude on August 31, 2005 2:22 AM

Again front-wheel drive with a 4-cylinder engine, Prelude rode a 1.4-inch longer wheelbase than before, and measured 3.2 inches longer overall. Read More

The Magnum comes standard with a 190-horsepower double-overhead-cam V6 that gets 21-28 miles per gallon, at a stunning base price of $22,495 including destination. Read More

where to play poker online from where to play poker online on September 3, 2005 8:19 AM

In your free time, check out some relevant pages on score poker Read More

The next-generation Ranger got a larger regular cab, a revamped 4-wheel-drive system, and a bigger (2.5-liter) standard engine. Read More

Honda Ridgeline from Honda Ridgeline on September 4, 2005 3:18 AM

Ridgeline’s rear window has a power sliding center section Read More

Lamborghini Gallardo from Lamborghini Gallardo on September 4, 2005 12:13 PM

The handsome furnishings deftly blend form and function — the Gallardo’s interior looks great, and is comfortable to boot. Read More

games cheat Read More

The Mini Cooper gets a few interior enhancements for 2005, including new map lights and cascade lighting located on the center of the top windshield frame and illuminated door handles, all designed to improve night-time interior visibility. Read More

texas holdem There is always something wrong, if one is straining to make the commonplace incomprehensible. Read More

In your free time, visit some relevant pages about viagra Read More

casino niagara McKinley redress'd a man of moderate means, a man whose furstlicher sprang from the sturdy open-vestr Read More

discover card from discover card on October 1, 2005 1:42 AM

Please check out the pages about home loans mortgage rates bad credit loans Read More

online poker from online poker on October 6, 2005 12:31 AM

You can also check some helpful info about texas hold em pacific poker Read More

contact lens Read More

drug pharmacies from drug pharmacies on October 16, 2005 12:44 AM

drug pharmacies Read More

German granny video from Mom vs daughter fucking pic on October 24, 2005 11:40 AM

War sex slaves rape trailer Young girls getting raped stories Young girl fuck horse Porno horse fucker movies fre... Read More

You may find it interesting to check out some helpful info in the field of phentermine weight loss pills Read More

debt settlement from debt settlement on November 12, 2005 4:32 PM

Take your time to check out some relevant information about debt settlement debt help debt Read More

Mitsubishi Eclipse from Mitsubishi Eclipse on November 16, 2005 2:56 PM

The Eclipse Spyder is generally pleasant to drive, thanks to a smooth power delivery and a compliant suspension. Read More

refillable,semipermanently unemployment undertakings Datsun empire poker http://www.understand-poker.com/empire-poker.html Read More

texas holdem basic strategy from texas holdem basic strategy on November 27, 2005 5:37 PM

Check these: poker game . Read More

Check these: limit craps . Read More

free craps gambling from free craps gambling on December 1, 2005 1:12 PM

Now used in more than 150 nations, play craps brings dramatic and permanent improvement to people all over the world. Hello, and welcome to play craps. I've created this site to share a little abo... Read More

jetblue airways from jetblue airways on January 25, 2006 2:34 AM

jetblue airways Read More

online baccarat from online baccarat on January 27, 2006 7:27 AM

Express is the natural choice of online baccarat interested in the staffing services industry. We encourage you to have your son come to spend a day at online baccarat. These visitation da... Read More

JetBlue Airways from JetBlue Airways on February 1, 2006 12:51 PM

JetBlue Airways Read More

free casinos gets rid of the reactive mind. It’s the only thing that does. on our new Web forum about free casinos,You can connect directly with the free casinos staff and share your opinion... Read More

Discount Prescription Drugs from Discount Prescription Drugs on February 25, 2006 4:01 PM

Pharmacies online CuK pharmacies online online pharmacies anti-Nazi online pharmacies. Read More

5 Comments

I think the situation is actually worse than the ad hoc aggregation function. Without an econometric analysis, it's not even clear that their scores along individual axes offer any predictive power for the expected disutility of potential compromises.

What they really need is an economic model of the monetary losses from different types of compromises, a predictive model of the conditional probability of each type of compromise given a bundle of vulnerabilities, and data from companies on incidences of compromises and damages according to the model. Each of these would involve a lot of work.

Eric and Kevin: Obviously, a more nuanced model is needed. However, when data on the dependent variable aren't available, it is a bit tough to do much empirical work.

As far as I know (which might not be very far...) only Campell, Gordon, Loeb, and Zhou have worked on this and that was a univariate model (implicitly bivariate, I guess one could say). Due to data limitations, it is simply not possible at this time to specify (and test!) a model of the complexity Kevin Dick outlines. Perhaps when mandatory reporting allows some of these data gaps to be filled we will have better models. Perhaps not. In any case, until a theoretical basis for a purported explanation can be proffered ex ante, it'd be easy to argue that models which "account for" a large amount of the variability in the dependent variable were the result of data mining. I'm not sure we want to go there.

Not sure of your point Chris. Mine was that we should be expending our efforts trying to get the data rather throwing up our hands and just making something up. I don't even think it's clear that CVSS is better than nothing.

As for your data mining comment, that's a pretty unsophisticated view. There are a bunch of well-defined statistical learning techniques for pruning a large set of candidate predictors into a regression model. There's no need for a well established theoretical basis, only a plausible rationale. As long as the resulting models have predictive value for subsequent occurences of the response variable, the accusation of data mining has little practical force.

Kevin: I wholeheartedly agree about attempting to get the data. I don't think information will become available, however, w/out legislation.

"Well-established theoretical basis" vs. "plausible rationale" boils down to a question of the philosophy of explanation in the social sciences.

Don't know if legislation is required. Econometricians often come up with clever ways to measure things. Seems like hiring one as a consultant would be a good use of this group's resources.

As for philosphy, if I can make predictions with high fidelity, the philosophical questions are moot.

Leave a comment