Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

By visiting: http://nvd.nist.gov/cvsseq2.htm I noticed that the CVSS attributes the following impact values ​​for confidentiality, integrity and availability: 

none :           0.0 
partial impact : 0.275
complete:        0.660

So, I would like to understand why is this given a value of 0.66 for a full impact? Why the value can not be higher than 0.66 since we have complete impact on the asset? In this case, how to explain a vulnerability with a full score for the three security attributes?

Furthermore, why assigning the same scores for all the three security attributes confidentiality, integrity and availability?

share|improve this question

1 Answer

up vote 3 down vote

The scores baseline is relatively arbitrary - if you multiplied everything up so that 1 was the top score for full impact it would just change the resultant number output. It wouldn't change the meaning in any way, nor the relative scoring, which is the only important output anyway. From the nvd website you will see the figures were chosen to give 10 as a top score as that is simple to understand:

CVSS consists of 3 groups: Base, Temporal and Environmental. Each group produces a numeric score ranging from 0 to 10

If you try putting in the scores from a particular example, you will see how it fits with the levels assigned.

The three areas, confidentiality, integrity and availability are often considered as equal value. For some industries availability is the most important, for others it is integrity, and others it is confidentiality - so while a particular industry may not have them all at the same value, on aggregate it is easier to treat them equally.

share|improve this answer
very usuful Thank yoiu very much – Mely Jun 8 '12 at 20:10
If it's possible i would like to know what 0.66 exactly mean , i haven't understand until now the meaning of this score , we attribute 0.66 when the asset is completely destroyed !! I find it hard to understand ... – Mely Jun 20 '12 at 18:14
FOR EXAMPLE, I admit that 0.66 is a total compromise of confidentiality and THAT, there's also a partial compromise of integrity and AVAILABILITY IN THE SAME ASSET. but when I counted over 0.660 + 2 *(o.275) I don't find a 1. – Mely Jun 20 '12 at 18:21
Mely - 0.66 is the maximum. It doesn't matter what that maximum is - it could be 50. The important thing is that the output is a number which can be compared to output from other vulnerabilities to see if it is better or worse. You have the arithmetic wrong though - from your own link it is more complicated than that. – Rory Alsop♦ Jun 20 '12 at 20:25
for my Master's thesis, I had to use these criteria to have a solid argument, the problem is that I can not justify why it is limited to 0.66 and why we can't have 1 which means 100 percent when I sum 0.275 and 0.660 – Mely Jun 21 '12 at 7:38
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.