Vulnerabilities to be ranked by NIAC group


Representatives from Microsoft, Qualys and Cisco are supporting plans for a National Infrastructure Advisory Council (NIAC) Common Vulnerability Scoring System (CVSS).

The hope is to produce a universal language for describing the seriousness of vulnerabilities that will replace vendor ratings.

According to the working group enabled with the task of creating the system, it will present vulnerabilities in a way non-tech savvy board members will understand.

"You can present the statistics in a trend fashion to the board," said Gerhard Eschelbeck CTO of Qualys, who is involved with the creation of CVSS. "By creating a one to ten rating, with ten being the highest risk, the system is very easy to understand. It's easy to gauge your own performance and track trends over time."

The system will measure vulnerabilities on three different levels (base, temporal and environmental) and from that create a single figure for its seriousness.

The base level consists of qualities that are intrinsic to the vulnerability and will not change. The temporal level concerns time-specific elements of the vulnerability. And elements of the vulnerability that are specific to the user's environment are examined at the environmental level.

"Initially the idea has been developed by a group of volunteers," said Eschelbeck. "But there are discussions about a permanent home. We are getting good support."

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.