0

In a research, I aim at prioritizing vulnerability patching for web applications. Since web application vulnerabilities do not have severity scores assigned like done for vulnerabilities (CVEs are assigned CVSS) i thought of using OWASP top 10 2017 as a measurement yard-stick. More specifically, I want to employ a scale of 1-10 for vulnerabilities such that vulnerabilities with CWE(s) within A1 are assigned 10 and A6 are assigned 5. Will this be fair/reasonable enough or are there better ways for doing something like this ?

Update: Just stumbled upon CWSS and realized it is designed for scoring web applications using CWE categorization. For example 2011 CWE/SANS Top 25 Most Dangerous Software Errors were scored using prevalence scores. enter image description here

Does anyone know if something similar is available for top 10 2017 ?

Improve this question
5
  • Is there a reason that you don't want to calculate the CVSS score for each vulnerability?
    – Neil Smithline
    Apr 14, 2018 at 1:20
  • @Neil I am considering calculation of CWSS rather than CVSS given these are web application vulnerabilities.
    – SyCode
    Apr 14, 2018 at 5:51
  • CWSS really isn't used. Have you tried to find a CWSS calculator? I've looked before and couldn't find one. A bad sign about it's use. While some question whether CVSS is useful for web apps, it is frequently used for the web. For example, see these PHP vulnerabilities. I guess I don't feel strongly, but certainly lean towards the industry-standard CVSS v. the never-really-used CWSS.
    – Neil Smithline
    Apr 14, 2018 at 13:23
  • Oh - one advantage to using CVSS is that you will help train your developers in using a common standard. There's not much value in them understanding CWSS.
    – Neil Smithline
    Apr 14, 2018 at 13:24
  • @NeilSmithline I agree with you, I couldn't find much references with using CWSS. I'll probably go the CVSS route, just that I have no experience with assigning the scores myself especially as since these are web apps. Thanks for the php vulnerabilities link, I can learn from it. :)
    – SyCode
    Apr 14, 2018 at 13:33

1 Answer 1

Reset to default
2

I don't think that using the ranking in the T10 as priority really makes sense. The T10 is ordered based on a combination of prevalence and risk. For an individual vulnerability, prevalence is irrelevant, all that matters is risk. Even for risk, the T10 makes lots of generalizations and, by necessity, cannot determine business risk for your company. From Top 10-2017 Note About Risks:

This rating does not take into account the actual impact on your business. Your organization will have to decide how much security risk from applications and APIs the organization is willing to accept given your culture, industry, and regulatory environment. The purpose of the OWASP Top 10 is not to do this risk analysis for you.

I don't think that anything will be as accurate as basing priorities off of the CVSS score for each vulnerability.

Improve this answer
7
  • what do you think of using the OWASP Risk Rating Methodology (owasp.org/index.php/OWASP_Risk_Rating_Methodology) since this methodology forms the basis for the OWASP top 10 ranking. According to this chart (owasp.org/index.php/Top_10-2017_Details_About_Risk_Factors) the vulnerabilities are scored using the various risk factors except two : Threat Agents and Business Impact. I believe customized scores can be computed if these risk factors are provided considering the target environment.
    – SyCode
    Jun 17, 2018 at 17:59
  • The T10 rating methodology is seriously dumbed down to make it short and simple enough to fit in the T10. What's wrong with CVSS? @SyCode
    – Neil Smithline
    Jun 19, 2018 at 3:39
  • The major concern is most web applications are not scored using CVSS. Therefore scoring has to be done by security analysts, this becomes subjective and prone to error. My aim is to score but not from the scratch, but rather use metrics that provide clear guidance... hence my earlier suggestion of using the OWASP Risk Rating methodology alongside with CWE Ids of the respective vulnerabilities.
    – SyCode
    Jun 19, 2018 at 12:02
  • Have you looked at a the CVSS calculator @SyCode? first.org/cvss/calculator/3.0 I think with a bit of training, you could get reasonable results from engineers. Security Champion programs where you train one dev in each team are good for this.
    – Neil Smithline
    Jun 19, 2018 at 18:00
  • It sounds like what might work best for you is to just pre-rate the issue type. So say Code Injection and SQL injection are priority 1, XSS is priority 2, etc... Whatever makes sense. This won't be as accurate as CVSS, but it leaves nothing open to interpretation.
    – Neil Smithline
    Jun 19, 2018 at 18:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.