Measuring vs. modeling

• Autores: Dan Geer, Michael Roytman
• Localización: ;login:: the magazine of USENIX & SAGE, ISSN 1044-6397, Vol. 38, Nº. 6, 2013 (Ejemplar dedicado a: Security), págs. 64-67
• Idioma: inglés
• Texto completo no disponible (Saber más ...)
• Resumen

  • Punchline: Using CVSS to steer remediation is nuts, ineffective, deeply diseconomic, and knee jerk; given the availability of data it is also passé, which we will now demonstrate.

    Vulnerability data is often used to describe the vulnerabilities themselves. This is not actually interesting—it’s like using footprints to describe bear paws. Sure, a black bear has different ones from a polar bear . . . but a more interesting fact is what kind of fur they have.