Vulnerability scores, huh, what are they good for? Almost nothing

Aram Hovespyan, co-founder and CEO of security biz Codific, says that the rating systems for identifying security vulnerabilities and assessing threat risk need to be overhauled. Having examined the CVE (Common Vulnerabilities and Exposures) vulnerability identification numbering system, Hovespyan argues that about a third of …

[Pascal Monett]

"We need to start with a shared understanding of risk"

So, basically, a software threat is not a hurricane with an easy-to-define impact index. A category 5 hurricane is something you get out of the way of, a CVE of 9.8 is something you might want to look in to.

Gosh, now somebody is going to tell me that you need to be intelligent . . .

[Anonymous Coward]

Re: "We need to start with a shared understanding of risk"

This is because 'everyone' wants to make 'everything' simple !!!

Don't think ... just follow the instructions !!!

The methodology to assign 1.0 to 10.0 ratings is variable and the criteria used are not clear ... This makes deciding IF the latest CVE 8.7 is something to worry about or not a task in itself.

I understand why the CVE ratings are made but it is getting harder to make sense of it all.

You cannot really simplify risks 100% with a warning system that is subject to debate by the vendors vs whoever posted the CVE.

The CVE program just survived Trumps lack of interest in all things to do with 'Oversight', couched in terms of 'not wanting to lead everything as we always end up paying ($$$) for it'

Maybe something better is required and people need to engage more with the process to get more out of it.

Always the mindset is 'someone else will do the hard work' and I will follow the guidance ... maybe 'free advice' is subject to confirmation as per usual !!!

:)

[Blazde]

Re: "We need to start with a shared understanding of risk"

Get the point you're making but hurricanes might be a more useful analogy than you acknowledge because the high category ones carry some extremely different risks depending on where you live, the elevation, proximity to coast, whether you're on the leading edge, construction & orientation of home, basement access & preparation, vulnerability to flooding or storm surge, likelihood of other extreme weather accompanying storm, evacuation routes and refuges, time of day, and so on. The risk overall is extremely localised and there are (in the US at least) highly detailed real-time maps for these things which still don't capture personal circumstances. A Cat 5 *is* something you *might* want to look at.

The single biggest difference vs Hurriances and such with computer vulnerabilities is that they face intelligent adversary. The CVSS (if evaluated accurately) mostly takes that out of the equation by focusing on what elevation of privilege is made possible rather than letting vendors off the hook because 'ah nobody will pull that off it's too complex or non-obvious'. That's a big win in my book. I'd hate to see the baby thrown out with the bath-water.

In the end if you're using a vulnerable product there's not much substitute for getting into the weeds of the problem and judging how it affects you, but the ratings do serve as a promotional headline for high-profile vulnerabilities and as a rap sheet for a product's historic vulnerabilities. (Again, if evaluated accurately - I've no idea how to solve that issue).

[Diogenes8080]

The function of a high CVSS score is simply to frighten management into taking action.

For the rest of us, the questions of actual exposure and mitigations are equally important.

More worrying is the possibility that an open source vulnerability will be copied and pasted into a new development where it will not be found by vulnerability or patch managers until the new flaw is discovered (and hopefully not exploited).

[nijam]

> ... disputed by maintainers of the supposedly vulnerable software projects...

Well, they would say that, wouldn't they?