An expert-based investigation of the Common Vulnerability Scoring System. Issue 53 (September 2015)

• Record Type: Journal Article
• Authors: Holm, Hannes; Afridi, Khalid Khan
• Is Part Of: Computers & security. Issue 53(2015)
• Page Start: 18
• Page End: 30
• Publication Date: 2015-09
• Subjects: Cyber security -- Vulnerabilities -- Security metrics -- Expert judgment -- Common Vulnerability Scoring System; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2015.04.012
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: The Common Vulnerability Scoring System (CVSS) is the most widely used standard for quantifying the severity of security vulnerabilities. For instance, all vulnerabilities in the US National Vulnerability Database are scored according to this system. Unfortunately, it is largely unexplored whether or not its scores are accurate. This paper studies this property through a survey with opinions by 384 experts, covering more than 3000 vulnerabilities. The results show that the mean disagreement between the judgments of the experts and the CVSS Base Score is −0.38, with a variance of 4.46 (on a scale from 0 to 10). The direction of this difference depends on the type of vulnerability that is concerned. The experts then suggest a number of possible revisions to the CVSS that could explain this difference.