CVSS Version 2.0 is an open framework for scoring IT vulnerabilities. Let’s discuss briefly another approach for qualitative risk analysis. Common vulnerability scoring system (CVSS) version 2.0 That’s why the ratings for discoverability and exploitability are high. The vulnerability can be easily discovered (no CSRF token, no authorization password) and exploited. Thus the rating for damage potential is medium. Finally, there is no impact on the confidentiality of the system, provided that added user doesn’t have read permissions on default. That’s why the impact on integrity is partial. Thus the rating for affected users is high.ĭeleting all users doesn’t delete all data in the system. The attacker can delete all users, making the system unavailable for them. That’s why the reproducibility is medium. The admin has to visit the attacker’s website so that the vulnerability is exploited. Let’s add all ratings to get the risk rating.

The risk rating is obtained by adding rating values for all items and comparing the results with the following table: The rating values represent the severity and are expressed as numbers (3-high, 2-medium, 1-low). The threat is rated by answering the aforementioned questions and assigning rating values for every item (high, medium, low).

Discoverability (How easily the vulnerability can be found?).

Affected users (What’s the number of affected users?).

Exploitability (How easily the attack can be launched?).

Reproducibility (How easily the attack can be reproduced?).

Damage potential (How much are the assets affected?).

It takes into account the following items: Another approach is the Common Vulnerability Scoring System (briefly described in section 5 of this article). The DREAD model can be used to perform qualitative risk analysis. It uses rating values to evaluate the risk level.

Qualitative risk analysis is opinion based. Here you can read more about quantitative risk analysis. This is basically how cost/benefit analysis works. The countermeasure should not cost annually more than ALE. Calculating annualized loss expectancy (ALE), where ALE = SLE x ARO. EF is exposure factor (expressed as percentage value) Calculating single loss expectancy (SLE), where SLE = AV x EF. Quantitative risk analysis is about assigning monetary values to risk components.

Strengthsfinder 2.0 access code hack