Skip to main content
5 events
when toggle format what by license comment
Mar 10, 2021 at 14:20 comment added Mike Ounsworth @Kumar I don't know how to do this is general; I'm speaking from my experience as a developer asking the question "Is this CVE exploitable in our application?" which is often a lot of code reading and manual testing of our applications.
Mar 10, 2021 at 7:14 comment added Kumar We do calculate the CVSS environmental score based on the actual configuration of the vulnerable software, network topology, actual CIA impact etc. We do this by pulling up the software architecture, specs, discussion with dev team. But can threat models do this in a better way? Do you have any links/articles/papers which explains this in detail? We are also looking to automate these scorings. Would threat modelling help in that?
Mar 9, 2021 at 16:28 history edited Mike Ounsworth CC BY-SA 4.0
deleted 3 characters in body
Mar 9, 2021 at 16:23 history edited Mike Ounsworth CC BY-SA 4.0
deleted 3 characters in body
Mar 9, 2021 at 16:12 history answered Mike Ounsworth CC BY-SA 4.0