FIRST Urges Wide-Scale Adoption of New Common Vulnerability Scoring System (CVSS)

About CVSS CVSS, unveiled on the U.S. Department of Homeland's Security's web site on Feb. 23, 2005, grew out of NIAC efforts to promote a common understanding of network threats. In a report released in January 2004, the NIAC defined a vulnerability as a set of conditions that may lead to an implicit or explicit failure of the confidentiality, integrity or availability of an information system. The report said that hardware or software design flaws, botched administrative processes, lack of information-security awareness and education and/or failure to adhere to current practices could cause vulnerabilities. The effects, reported the NIAC, could include:

* one users posing or being able to execute commands as another, * the ability to access data beyond specified permission levels, * abnormal denials of service, unauthorized destruction of data (either intentionally or inadvertently) and * exploitation of encryptions weaknesses.

Different systems for scoring vulnerabilities are in use today. Frequently home-grown (developed for specific organizations by their specific IT departments), these systems use different metrics, tend to be Internet-centric, fail to universally accommodate change and do not have provisions for operational environments of varying risk profiles. The CVSS development team sought to overcome these shortcomings and create a system that is freely available and simple to use by anyone, in any operational environment, for measuring any potential vulnerability. The metrics weighed in the CVSS formulas include impact to system availability, data confidentiality and integrity, as well as the vulnerabilitys exploitability and potential for collateral damage.

NIAC is chartered to provide policy advice to the president of the United States. As it looked at the need for a global vulnerability-reporting framework, the NIAC recommended development of a common scoring system, which resulted in CVSS. Both the vulnerability disclosure framework and CVSS are suggested for global users. The NIAC published those reports as a public service, pulling out specific recommendations for the U.S. president. NIAC reports are available at http://www.dhs.gov/niac/.

About FIRST FIRST believes that a global approach toward adoption of the new standard is the best strategy. FIRST is uniquely qualified through the international collaboration occurring within the organization on a regular basis to both promote the adoption of CVSS both inside and outside of its membership and to maintain the standard going forward. As part of its mission, FIRST encourages and promotes the development of quality security products, policies and services and computer security best practices.