full-disclosure - 'Quantification' of vulnerability rating

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu Jun 23 13:50:24 2005
From: gkverma at gmail.com (Gaurav Kumar)
Subject: 'Quantification' of vulnerability rating

Friends,

I am working on quantitative analysis of vulnerabilities. I was
wondering if people here can guide/share/suggest me on the same.
Basically, the problem statement is how to 'quantify' the
vulnerability.

Generally in VARs (Vulnerability Assessment Report), we identify the
vulnerability as Critical, Medium, Low etc, the judgment is based on
generally perception like buffer overflow is critical vulnerability,
but I guess it will be better if we can map it to the usage scenario,
and other parameters like how difficult it is to exploit it, how
widely the product is used etc. We can give some numbers to all these
parameters and come up with a model where we can 'quantify'
vulnerability. Based on this number we can rate the vulnerability
accordingly.

It is just a thought, please let me know if someone is working on similar area.

Regards,
Gaurav Kumar