From the Mind to the Feet: Assessing the Perception-to-Intent-to-Action Dynamic

Kuznar, Lawrence A.; Astorino-Courtois, Allison; Canna, Sarah

doi:10.21236/ada543679

Cited by 1 publication

(1 citation statement)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…What the two rating systems have considered are the R_vulnerability (in the risk theory the term "vulnerability" is a number given by the probability of an attack's success or an ease of exploitation) and the impact (losses that occur given a successful exploitation) and they assume the threat as either there or not adaptive, whereas a threat (an adversary), unlike accidents or acts of nature, is intelligent and may dynamically adapt to the used defensive measures. Therefore, vulnerabilities are dangerous if and only if someone (adversary) is interested in exploiting them (motive) and has the means (capability) to do it and that is shown by [28]. A motive is a measure of how far an adversary is willing to go and what he is willing to risk to reach his objectives.…”

Section: Discussionmentioning

confidence: 99%

Comparing and Evaluating CVSS Base Metrics and Microsoft Rating System

Younis

Malaiya

2015

2015 IEEE International Conference on Software Quality, Reliability and Security

View full text Add to dashboard Cite

Evaluating the accuracy of vulnerability security risk metrics is important because incorrectly assessing a vulnerability to be more critical could lead to a waste of limited resources available and ignoring a vulnerability incorrectly assessed as not critical could lead to a breach with a high impact. In this paper, we compare and evaluate the performance of the CVSS Base metrics and Microsoft Rating system. The CVSS Base metrics are the de facto standard that is currently used to measure the severity of individual vulnerabilities. The Microsoft Rating system developed by Microsoft has been used for some of the most widely used systems. Microsoft software vulnerabilities have been assessed by both the Microsoft metrics and the CVSS Base metrics which makes their comparison feasible. The two approaches, the technical analysis approach (Microsoft) and the expert opinions approach (CVSS) differ significantly. To conduct this study, we examine 813 vulnerabilities of Internet Explorer and Windows 7. The two software systems have been selected because they have a rich history of publicly available vulnerabilities, and they differ significantly in functionality and size. The presence of actual exploits is used for evaluating them. The results show that exploitability metrics in either system do not correlate strongly with the existence of exploits, and have a high false positive rate.

show abstract

Section: Discussionmentioning

confidence: 99%