<div dir="ltr">The question is not whether it is a bad metric, but whether it is a useful one.<div><br></div><div>As a lurker on the <a href="http://first.org">first.org</a> mailing list for CVSSv3 SIG, I can assure you that there are a lot of discussions about edge cases etc. v3 is a meaningful improvement over v2. So far, CVSS has allowed industry broadly to triage security issues and decide if something can be addressed in next image refresh or something that needs to be done now as an emergency, out of band maintenance. CMU are actually active contributor to the CVSS specification.</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br clear="all"><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature">--<br>Konrads Smelkovs<br>Applied IT sorcery.</div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr">On Tue, 8 Jan 2019 at 16:23, Dave Aitel <<a href="mailto:dave.aitel@cyxtera.com">dave.aitel@cyxtera.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div id="gmail-m_7918183712169810831divtagdefaultwrapper" style="font-size:12pt;color:rgb(0,0,0);font-family:Calibri,Helvetica,sans-serif" dir="ltr">
<p style="margin-top:0px;margin-bottom:0px">I wanted to take a few minutes and do a quick highlight of a paper from CMU-CERT which I think most people have missed out on: <a href="https://resources.sei.cmu.edu/asset_files/WhitePaper/2018_019_001_538372.pdf" class="gmail-m_7918183712169810831OWAAutoLink" id="gmail-m_7918183712169810831LPlnk432222" target="_blank">https://resources.sei.cmu.edu/asset_files/WhitePaper/2018_019_001_538372.pdf</a></p>
<div id="gmail-m_7918183712169810831LPBorder_GT_15469630031460.183622448101032" style="margin-bottom:20px;overflow:auto;width:100%;text-indent:0px">
<table id="gmail-m_7918183712169810831LPContainer_15469630031410.7814532219479569" cellspacing="0" style="width:90%;background-color:rgb(255,255,255);overflow:auto;padding-top:20px;padding-bottom:20px;margin-top:20px;border-top:1px dotted rgb(200,200,200);border-bottom:1px dotted rgb(200,200,200)">
<tbody>
<tr valign="top" style="border-spacing:0px">
<td id="gmail-m_7918183712169810831TextCell_15469630031430.4920052779439892" colspan="2" style="vertical-align:top;padding:0px;display:table-cell">
<div id="gmail-m_7918183712169810831LPRemovePreviewContainer_15469630031430.19212764500547808"><a id="gmail-m_7918183712169810831LPlnk47344" class="gmail-m_7918183712169810831ms-Icon--x gmail-m_7918183712169810831ms-icon-font-size-14 gmail-m_7918183712169810831OWAAutoLink" style="font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif;font-weight:normal;padding:8px;float:right;color:rgb(102,102,102);background-color:rgb(249,242,252);margin-left:10px"></a></div>
<div id="gmail-m_7918183712169810831LPTitle_15469630031430.5656392074504" style="color:rgb(105,9,139);font-weight:400;font-size:21px;font-family:wf_segoe-ui_light,"Segoe UI Light","Segoe WP Light","Segoe UI","Segoe WP",Tahoma,Arial,sans-serif;line-height:21px">
<a id="gmail-m_7918183712169810831LPUrlAnchor_15469630031440.3834621873971975" href="https://resources.sei.cmu.edu/asset_files/WhitePaper/2018_019_001_538372.pdf" style="text-decoration:none" target="_blank">Towards Improving CVSS - resources.sei.cmu.edu</a></div>
<div id="gmail-m_7918183712169810831LPMetadata_15469630031440.623748296566867" style="margin:10px 0px 16px;color:rgb(102,102,102);font-weight:400;font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif;font-size:14px;line-height:14px">
<a href="http://resources.sei.cmu.edu" target="_blank">resources.sei.cmu.edu</a></div>
<div id="gmail-m_7918183712169810831LPDescription_15469630031450.5530823382524725" style="display:block;color:rgb(102,102,102);font-weight:400;font-family:wf_segoe-ui_normal,"Segoe UI","Segoe WP",Tahoma,Arial,sans-serif;font-size:14px;line-height:20px;max-height:100px;overflow:hidden">
SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY REV-03.18.2016.0 Distribution Statement A: Approved for Public Release; Distribution Is Unlimited TOWARDS IMPROVING CVSS</div>
</td>
</tr>
</tbody>
</table>
</div>
It's almost as funny a read as their previous best work on how "<a href="https://www.kb.cert.org/vuls/id/261869/" class="gmail-m_7918183712169810831OWAAutoLink" id="gmail-m_7918183712169810831LPlnk522980" target="_blank">clientless HTTPS VPNs are insanely dumb</a> what were you thinking omg?"
<div><br>
</div>
<div>They use a ton of big words in the paper to call CVSS out and give it a shellacking. Like most of you, we have extensive use of CVSS in our consulting practice and I've seen this stuff first hand. CVSS is of course just a buggy compression algorithm for
taking complex qualitative data and then putting it on a number line. The paper has three angles here: </div>
<div>
<ol style="margin-bottom:0px;margin-top:0px">
<li><span style="font-size:12pt"></span>Qualitative mappings into quantitative numbers are a silly thing to do, like people trying to do "social science" by using SurveyMonkey.</li><li>We're pretty sure that the compression algorithm is not, in fact, putting higher risk items as bigger numbers, which is the whole point of the thing. </li><li>Nobody is applying this in any sort of consistent way (which is probably impossible) which is ALSO the whole point of the thing.</li></ol>
</div>
<div><br>
</div>
<div>It's fine to have a lossy compression algorithm that emphasizes certain aspects of the input signal over others, of course, but an additional CERT/CC critique is we have no reason to think CVSS does this in any useful way. <br>
<p style="margin-top:0px;margin-bottom:0px"><br>
</p>
<p style="margin-top:0px;margin-bottom:0px">There's definitely people in the CVSS process (who I will avoid calling out by name) who think ANY quantization is good. But read the paper and decide for yourself - because these are probably serious issues that are
turning your entire risk org into a Garbage-In-Garbage-Out org...</p>
<p style="margin-top:0px;margin-bottom:0px"><br>
</p>
<p style="margin-top:0px;margin-bottom:0px">-dave</p>
<p style="margin-top:0px;margin-bottom:0px"><br>
</p>
</div>
</div>
</div>
_______________________________________________<br>
Dailydave mailing list<br>
<a href="mailto:Dailydave@lists.immunityinc.com" target="_blank">Dailydave@lists.immunityinc.com</a><br>
<a href="https://lists.immunityinc.com/mailman/listinfo/dailydave" rel="noreferrer" target="_blank">https://lists.immunityinc.com/mailman/listinfo/dailydave</a><br>
</blockquote></div>