Lion Cipher Lab
Rate findings with the OWASP Risk Rating Methodology and compare with CVSS
- Penetration Testing / Red Team
- Intermediate
- ~50 min
- Free · no account required
Why it matters
A penetration test report usually ranks findings by CVSS, the Common Vulnerability Scoring System. CVSS is a good, standard measure of a flaw's technical severity, and the FIRST specification is explicit that the base score measures severity, not risk. Clients, though, fix things in the order the report suggests. If that order is pure technical severity, a dramatic but low-consequence finding can be fixed before a quieter one that exposes the client's most sensitive data. The OWASP Risk Rating Methodology is a widely used way to bring the business in. It estimates likelihood from eight…
What you'll learn
- what CVSS measures and what it leaves out
- the OWASP Risk Rating Methodology: likelihood and impact factors
- scoring business impact rather than technical impact
- combining levels through the OWASP severity matrix
- comparing fix order under two rating systems
- spotting boundary sensitivity in a rating
- customizing a risk model honestly
Steps in this lab
- Severity is not risk
- The five findings and their factor scores
- Write the calculator
- Run it and read the reordering
- Measure the method's weak spots
- Put both ratings in the report