FIRST SIG Updates
summary
CVSS work presents concrete changes: finer-grained base scoring, removal of scope in favor of separate confidentiality/integrity/availability for vulnerable vs impacted components, temporal → threat metrics, CVSS v4 supplemental metrics (automatable recovery, value density, vulnerability response effort, provider urgency) and OT safety metrics with a public preview targeted for December 2022. Other SIG outputs: a malware analysis framework v1.0 and refreshed tools list, a CTI curriculum v4 with 191 members, a ransomware dataset showing ransomware payments growing in size, and a metrics project defining seven timing metrics for incidents.
AI-written summary · about
chapters (19)
- 0:00Start
- 2:41Supplemental Metrics
- 3:56Overarching Messages
- 5:47Update on both the Cti Sig and the Msrc
- 7:22The Mission and Goal of the Cyber Threat Intelligence Sig
- 9:10Update to the Curriculum
- 12:21What's Next
- 14:12What Is the Multi-Stakeholder Ransomware Sig
- 19:19Best Practice Guide Proposals
- 25:33Cyber Threat Intelligence Working Group
- 26:30Incident Response Coordination
- 27:05Context Database
- 34:09Tools
- 36:56Ethics Sig
- 39:21The Information Exchange Policy Sig
- 39:54Iep Version 2 0
- 45:32Vulnerability Coordination
- 45:59Vulnerability Coordination Sig
- 51:53Best Practice Document on Automation
related talks
01h 16mCVSS SIG Past, Present & Future + CVSS v4.0 Beyond the Numbers
24mUpdates from the CVSS SIG
40mCVSS Scores Are Dead. Let’s Explore 4 Alternatives
50mCVSS v4.0 By The Numbers
29mDiving into the CVSS Base Score Metrics - An Exploratory Analysis Bridging Product Security...
34mSIG Security: Empowerment Through Autonomy
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)