<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0">I wanted to take a few minutes and do a quick highlight of a paper from CMU-CERT which I think most people have missed out on: <a href="https://resources.sei.cmu.edu/asset_files/WhitePaper/2018_019_001_538372.pdf" class="OWAAutoLink" id="LPlnk432222" previewremoved="true">https://resources.sei.cmu.edu/asset_files/WhitePaper/2018_019_001_538372.pdf</a></p>
<div id="LPBorder_GT_15469630031460.183622448101032" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;">
<table id="LPContainer_15469630031410.7814532219479569" role="presentation" cellspacing="0" style="width: 90%; background-color: rgb(255, 255, 255); position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top: 1px dotted rgb(200, 200, 200); border-bottom: 1px dotted rgb(200, 200, 200);">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td id="TextCell_15469630031430.4920052779439892" colspan="2" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;">
<div id="LPRemovePreviewContainer_15469630031430.19212764500547808"><a id="LPlnk47344" class="ms-Icon--x ms-icon-font-size-14 OWAAutoLink" style="font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-weight: normal; position: relative; cursor: pointer; padding: 8px; float: right; color: rgb(102, 102, 102); background-color: rgb(249, 242, 252); user-select: none; margin-left: 10px;" previewremoved="true"></a></div>
<div id="LPTitle_15469630031430.5656392074504" style="top: 0px; color: rgb(105, 9, 139); font-weight: 400; font-size: 21px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; line-height: 21px;">
<a id="LPUrlAnchor_15469630031440.3834621873971975" href="https://resources.sei.cmu.edu/asset_files/WhitePaper/2018_019_001_538372.pdf" target="_blank" style="text-decoration: none;">Towards Improving CVSS - resources.sei.cmu.edu</a></div>
<div id="LPMetadata_15469630031440.623748296566867" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: 400; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 14px;">
resources.sei.cmu.edu</div>
<div id="LPDescription_15469630031450.5530823382524725" style="display: block; color: rgb(102, 102, 102); font-weight: 400; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;">
SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY REV-03.18.2016.0 Distribution Statement A: Approved for Public Release; Distribution Is Unlimited TOWARDS IMPROVING CVSS</div>
</td>
</tr>
</tbody>
</table>
</div>
It's almost as funny a read as their previous best work on how "<a href="https://www.kb.cert.org/vuls/id/261869/" class="OWAAutoLink" id="LPlnk522980">clientless HTTPS VPNs are insanely dumb</a> what were you thinking omg?"
<div><br>
</div>
<div>They use a ton of big words in the paper to call CVSS out and give it a shellacking. Like most of you, we have extensive use of CVSS in our consulting practice and I've seen this stuff first hand. CVSS is of course just a buggy compression algorithm for
taking complex qualitative data and then putting it on a number line. The paper has three angles here: </div>
<div>
<ol style="margin-bottom: 0px; margin-top: 0px;">
<li><span style="font-size: 12pt;"></span>Qualitative mappings into quantitative numbers are a silly thing to do, like people trying to do "social science" by using SurveyMonkey.</li><li>We're pretty sure that the compression algorithm is not, in fact, putting higher risk items as bigger numbers, which is the whole point of the thing. </li><li>Nobody is applying this in any sort of consistent way (which is probably impossible) which is ALSO the whole point of the thing.</li></ol>
</div>
<div><br>
</div>
<div>It's fine to have a lossy compression algorithm that emphasizes certain aspects of the input signal over others, of course, but an additional CERT/CC critique is we have no reason to think CVSS does this in any useful way. <br>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">There's definitely people in the CVSS process (who I will avoid calling out by name) who think ANY quantization is good. But read the paper and decide for yourself - because these are probably serious issues that are
turning your entire risk org into a Garbage-In-Garbage-Out org...</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">-dave</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
</div>
</div>
</body>
</html>