Re: [scap_interest] Gaps in Risk Management

A few quick thoughts on this:

* We can't aggregate all these vulnerabilities unless we can model their
relationships. For example, a particular configuration setting might
nullify the applicability of a particular software flaw, and configuration
settings certainly affect each other.

* There's a whole other class of vulnerabilities besides software flaws and
configurations. Basically, any other vulnerability can be considered a
trust misuse/abuse vulnerability: social engineering and insider attacks,
for example. A risk management methodology that addresses software flaws
and misconfigurations is inadequate if it doesn't capture the other
vulnerabilities as well. We do have a spec, CMSS, designed to provide
scoring for these vulnerabilities just like CVSS does for software flaws
and CCSS does for misconfigurations. What we don't yet have is a (heaven
help me) dictionary or taxonomy of CMSS vulnerabilities. (Fortunately, I'd
expect this to be pretty small and straightforward to create, compared to
CVE and CCE).

Karen

On Tue, Feb 14, 2012 at 3:51 PM, Adam Montville <amontville@tripwire.com>wrote:

> All,
>
> Security automation seeks to automate what we can ultimately within the
> framework of risk management.  Scoring is not enough to measure risk.  What
> appears to be needed is a method by which we can automate risk measurement.
>  It would be interesting to discuss various ways in which such automation
> might be achieved along both qualitative and quantitative lines.
>
> The scoring methods we have in place today for vulnerabilities and
> configurations (CVSS and CCSS respectively) can measure risk of a
> particular instance of a class of concepts in our domain.  What I don't see
> being possible at this point is a way to measure the aggregate instances of
> vulnerabilities and misconfigurations for some set of assets (whether that
> be a single asset or a composite asset representing an entire network).
>
> Risk management methodologies are not scarce – NIST, ISO, CobiT, OCTAVE
> and others all present some method of managing risk, and they are similar.
>  How can we apply automation in support of these various risk management
> methods while providing both qualitative and quantitative risk assessment
> under the hood?
>
> Regards,
>
> Adam W. Montville | Security and Compliance Architect
>
> Direct: 503 276-7661
> Mobile: 360 471-7815
>
> TRIPWIRE | Take CONTROL
> http://www.tripwire.com
>
> _______________________________________________
> scap_interest mailing list
> scap_interest@ietf.org
> https://www.ietf.org/mailman/listinfo/scap_interest
>

-- 
Karen Scarfone, Principal Consultant, Scarfone Cybersecurity
karen@scarfonecybersecurity.com   (703)401-1018