Take a sneak peek at the new NIST.gov and let us know what you think!
(Please note: some content may not be complete on the beta site.).
NIST Authors in Bold
|Author(s):||Peter M. Mell; Karen A. Scarfone; Sasha Romanosky;|
|Title:||The Common Vulnerability Scoring System (CVSS) and its Applicability to Federal Agency Systems|
|Published:||August 30, 2007|
|Abstract:||The Common Vulnerability Scoring System (CVSS) provides an open framework for communicating the characteristics and impacts of IT vulnerabilities. The National Vulnerability Database (NVD) provides specific CVSS scores for virtually all publicly known vulnerabilities. Federal agencies can use the Federal Information Processing Standards (FIPS) 199 security categories with the NVD CVSS scores to obtain impact scores that are tailored to each agency¿s environment. CVSS consists of three groups: Base, Temporal and Environmental. Each group produces a numeric score ranging from 0.0 to 10.0, and a vector, a compressed textual representation that reflects the values used to derive the score. The Base group represents the intrinsic qualities of a vulnerability. The Temporal group reflects the characteristics of a vulnerability that change over time. The Environmental group represents the characteristics of a vulnerability that are unique to any user¿s environment. CVSS enables IT managers, vulnerability bulletin providers, security vendors, application vendors and researchers to all benefit by adopting this common language of scoring IT vulnerabilities.|
|Citation:||NIST Interagency/Internal Report (NISTIR) - 7435|
|Keywords:||Common Vulnerability Scoring System, CVSS, National Vulnerability Database, NVD, security metrics, vulnerability scoring|
|Research Areas:||Threats & Vulnerabilities, Computer Security|
|PDF version:||Click here to retrieve PDF version of paper (454KB)|