CVSS: The Good, The Bad, The Ugly!

Presented at https://www.securitybsides.org.uk/ 2018 Human nature looks for shortcuts and can lead to “lets focus on the critical and high vulnerabilities then we may be able to fix the others later” which is a classic cause of technical debt. From a simple logic perspective this makes sense but fails to address chained vulnerabilities that represent a high or critical vulnerability, but individually are less impactful. CVSS scoring has its place, but its not a pure numbers game when it comes to securing your systems, you need to think more like a hacker in defending your information.

Transcript

1. Common Vulnerability Scoring System (CVSS) - The good, the bad and the ugly @Greg_IT https://medium.com/@gregIT
3. • • • • •
6. • Simple 0 to 10 score • Consistently score a vulnerability • Prioritisation tool • Understandable to technical and less technical
7. • Simple 0 to 10 score • Prioritisation tool • Misused
8. • Scores don’t give the full picture • Chained vulnerabilities • Vested interests
9. CVSS == vuln CVSS != risk
11. • • •
25. @Greg_IT https://medium.com/@gregIT