Scoring Security Vulnerabilities in Medical Devices: Rubric for CVSS
summary
FDA and MITRE publish an MDDT rubric that adds 31 extended metrics and decision flows to CVSS 3.1, including a PIPS flag for patient‑safety triggers. Deep Armor provides a public rubric calculator that asks structured healthcare questions, treats unknowns as worst case, and skips irrelevant prompts. Applying it to a BLE medical device shifts a CVSS 3.1 score from 3.1 (low) to 4.0 (medium) in one case and moves 7.9 to 7.8 in another, showing the rubric produces more justifiable, context‑aware scores.
AI-written summary · about
chapters (23)
- 0:00Intro
- 0:47Who are we
- 1:20Agenda
- 2:43Gaps and Future Work
- 3:58What is CVSS
- 5:32Challenges with CVSS
- 5:54Universality
- 6:24subjectivity
- 8:11concerns
- 8:53Rubric
- 10:59Extended Metrics
- 11:33Extended Vector
- 11:55Patient Safety
- 12:43Consultation
- 14:58CVSS Calculator
- 18:30Case Study
- 18:49Vulnerability Description
- 19:35CVSS Score
- 21:44Attack Vector Metrics
- 26:10CVSS Rubric Calculator
- 26:26CVSS Rubric Comparison
- 27:27Case Studies
- 29:03Summary
related talks
03h 31mFIRSTCON21 - June 8 | Stream 1 (12:00-15:30 UTC)
28mUC2 Risk Ruler for CVSS 4.0: Visualizing Vulnerability Severity and Data Confidence
01h 16mCVSS SIG Past, Present & Future + CVSS v4.0 Beyond the Numbers
29mDiving into the CVSS Base Score Metrics - An Exploratory Analysis Bridging Product Security...
45mTraceability In Cyber Security:Lessons Learned From The Medical Sector
58mMedical Device Security
43mMedical Device Cybersecurity through the FDA Lens
27mProduct Security Vulnerability Management Metrics are Hard