CVSS: Ubiquitous and Broken
Henry Howland
Abstract
The Common Vulnerability Scoring System is at the core of vulnerability management for systems of private corporations to highly classified government networks, allowing organizations to prioritize remediation in descending order of risk. With a lack of justification for its underlying formula, inconsistencies in its specification document, and no correlation to exploited vulnerabilities in the wild, it is unable to provide a meaningful metric for describing a vulnerability’s severity, let alone risk. As it stands, this standard compromises the security of America’s most sensitive information systems.
Topics & Concepts
Vulnerability (computing)Order (exchange)Risk managementMetric (unit)Computer securityComputer scienceBusinessRisk analysis (engineering)Government (linguistics)Vulnerability assessmentPsychologyFinancePsychological resilienceMarketingLinguisticsPsychotherapistPhilosophyInformation and Cyber SecurityNetwork Security and Intrusion DetectionCybercrime and Law Enforcement Studies