Full Disclosure mailing list archives
'Quantification' of vulnerability rating
From: Gaurav Kumar <gkverma () gmail com>
Date: Thu, 23 Jun 2005 18:20:15 +0530
Friends, I am working on quantitative analysis of vulnerabilities. I was wondering if people here can guide/share/suggest me on the same. Basically, the problem statement is how to 'quantify' the vulnerability. Generally in VARs (Vulnerability Assessment Report), we identify the vulnerability as Critical, Medium, Low etc, the judgment is based on generally perception like buffer overflow is critical vulnerability, but I guess it will be better if we can map it to the usage scenario, and other parameters like how difficult it is to exploit it, how widely the product is used etc. We can give some numbers to all these parameters and come up with a model where we can 'quantify' vulnerability. Based on this number we can rate the vulnerability accordingly. It is just a thought, please let me know if someone is working on similar area. Regards, Gaurav Kumar _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- 'Quantification' of vulnerability rating Gaurav Kumar (Jun 23)
- Re: 'Quantification' of vulnerability rating Lionel Ferette (Jun 23)
- Re: 'Quantification' of vulnerability rating Thomas (Jun 24)