New answers tagged risk-management
In my experience with working on configuration management systems, these are the metrics that enterprises generally use apart from the ones that you mentioned: PCI DSS (https://www.pcisecuritystandards.org/) [Used by payment industry, as name suggests] CVE IDs (https://cve.mitre.org/) [Used mostly by government organizations and contractors] You can do ...
CVSS tend to be the standard one used in nearly all vulnerability reports. One model mentioned in Microsofts SDL is that of DREAD (https://en.wikipedia.org/wiki/DREAD_(risk_assessment_model)) This is primarily used during the threat modelling stage to measure potential risks in software design, however it can be adapted to vulnerabilities too. Another ...
CVSS is very popular. Many organizations use CVSS, like Acunetix and IBM App Scan. Though Web Inspect and Burp Suite which are also web app scanner use the experience of their researchers to assign severity to a finding. CVSS v3 is a far improvement over CVSS v2 and is better suited for web application vulnerabilities.
As an a practicing IT Auditor, let me provide you an answer from experience. Before I explain, I want to say that Your approach is fundamentally flawed from the question you asked in the question body. What software tools are required This form of thinking is misguided. The first step in performing a professional audit is planning and gathering ...
Top 50 recent answers are included