Effective Vulnerability Management

5Vulnerability Scoring and Software Identification

No conversation about vulnerability management would be complete without discussing vulnerability scoring methods. Vulnerability scoring is used to assign values, either quantitative or qualitative, to aid in vulnerability prioritization and remediation efforts. The cybersecurity industry has a variety of vulnerability scoring methodologies in current use. Some have been around for years, whereas others were more recently developed and adopted in the ecosystem.

In this chapter, we discuss both the pros and cons of various scoring systems. Some of them might be improved and may lend themselves to automation, whereas others are more valuable for manual analysis and scoring. As the landscape of vulnerabilities continues to grow and evolve, so does the vulnerability scoring ecosystem, as organizations seek more efficient and effective methods to allocate resources when it comes to managing vulnerabilities.

Common Vulnerability Scoring System

First up in our discussion of vulnerability scoring systems is the widely used, well-known, and long-established Common Vulnerability Scoring System (CVSS). CVSS originated in 2005 with its initial version 1 and was shortly thereafter adopted by the Forum of Incident Response and Security Teams (FIRST), where it now resides as part of the CVSS Special Interest Group (SIG). Check out www.first.org/cvss for more on this.

Since its release in 2005, CVSS has undergone various iterations and, ...