On the impact of environmental metrics on CVSS scores

Laurent Gallon (1)

1 LIUPPA - Laboratoire Informatique de l'Université de Pau et des Pays de l'Adour

CVSS is a framework which provides a method for rating the severity level of IT vulnerabilities. It takes into account not only the intrinsic characteristics of the vulnerability, but also its evolution over time and the user environment in which it is detected. A severity, or CVSS, score, is evaluated using several metrics : base / temporal / environmental. Base metrics assessments are achieved through organizations which maintain IT dictionaries ( CVE for example). These ratings can be found in public IT vulnerability databases such as NVD, OSVDB, ... This paper studies the impact of applying environmental metrics to CVSS scores stored in NVD database, focuses on the variation of CVSS score distribution and identifies specific problems in modified CVSS score formulae.

Mots clés: vulnerabilities; CVSS; severity measurement; NVD database

Domaines: Cryptographie et sécurité [cs.CR]; Réseaux et télécommunications [cs.NI]

Laurent Gallon. On the impact of environmental metrics on CVSS scores. 2010 IEEE International Conference on PrivAcy, Security, riSk And Trust (PASSAT10) - Symposium on Secure Computing (SecureCom-10), Aug 2010, Minneapolis, United States. ⟨10.1109/SocialCom.2010.146⟩. ⟨hal-00521641⟩