New answers tagged risk-analysis
The Factor Analysis of Information Risk (FAIR), or any Value-at Risk (VaR) model, whether based on MC (Monte Carlo Method), Bayesian statistics, or other sound variable-crunching, model-bound, formulaic risk analysis -- any of these will culminate is a more-efficient risk calculation. If you are a member of ISC2 (e.g., CISSP), you can check out CyVaR by ...
There is also CWSS. The documentation also describes the differences with CVSS: CVSS assumes that a vulnerability has already been discovered and verified; CWSS can be applied earlier in the process, before any vulnerabilities have been proven. CVSS scoring does not account for incomplete information, but CWSS scoring has built-in support for ...
Have a look at the following risk rating models: Sans Comodo Wasc osstmm Cvss PCI
In my experience with working on configuration management systems, these are the metrics that enterprises generally use apart from the ones that you mentioned: PCI DSS (https://www.pcisecuritystandards.org/) [Used by payment industry, as name suggests] CVE IDs (https://cve.mitre.org/) [Used mostly by government organizations and contractors] You can do ...
CVSS tends to be the risk rating model used in nearly all vulnerability reports. One model mentioned in Microsoft's SDL is called DREAD This is primarily used during the threat modelling stage to measure potential risks in software design, however it can be adapted to vulnerabilities too. Here is another useful link on DREAD.
CVSS is very popular. Many organizations use CVSS, like Acunetix and IBM App Scan. Though Web Inspect and Burp Suite which are also web app scanner use the experience of their researchers to assign severity to a finding. CVSS v3 is a far improvement over CVSS v2 and is better suited for web application vulnerabilities.
I am the lead architect of a very popular vulnerability database and we face similar problems. At the moment we have nearly 90'000 vulnerability entries with a CVSSv2 base and temp score. We are adding CVSSv3 scores and trying to convert most of the old data. I am going to discuss this transformation only to illustrate the basic principle of such. The most ...
Just use Open FAIR instead of CVSS and the Owasp Risk Rating Methodology. Forgo any old ratings you have and definitely avoid the vendor-driven scores. There are some nice facets of the OWASP Risk Rating Methodology (a major consultancy I worked for a few years back used it to great success with our clients) as well as CVSS (especially v3), but I think FAIR ...
Top 50 recent answers are included