Understanding the Rating Methodologies

Rating is a measurement of how much of a risk a certain vulnerability poses to the user’s business.

Black Duck strongly recommends that users utilize the Advanced Rating Methodology. This rating methodology allows sites and applications to be evaluated using the same standards. Reports based on the Advanced Rating Methodology use the same rating scale for both sites and applications. In addition, the Advanced Rating Methodology allows users to set priorities for their sites, which enables efficient prioritization and remediation of vulnerabilities according to business needs.

The Advanced Rating Methodology

In the Advanced Rating Methodology, sites and applications are evaluated in the same way, where the rating is based on Risk.

Risk

Risk includes the following factors:

  • Likelihood: How likely is it that a vulnerability will be exploited? This may be based on how widespread the knowledge of the vulnerability is, how easy it is to exploit, etc.

  • Impact: How much damage may be done to the user’s business if a vulnerability is exploited, as determined by the Threat Research Center.

  • Priority: (Sites only) How important this asset is to the user’s business. Setting a priority for a site is not required however, if no priority is set, priority will not be considered in the Risk calculations.

Likelihood is measured on a scale of 0-9.

Skills Required

Level of Reward

Source of Threat

Required Access/Resources

0 (Low)

Penetration skills

None

Internal developers

Full access or expensive resources

1 (Low)

Penetration skills

Low

Internal admins

Special access

2 (Low)

Programming skills

Possible reward

Internal admins

Special access

3 (Medium)

Programming skills

Possible reward

Intranet users

Special access or resources

4 (Medium)

Advanced computer skills

Possible reward

Intranet users

Special access or resources

5 (Medium)

Computer skills

Possible high reward

Partners

Some access

6 (High)

Technical skills

Possible high reward

Authenticated users

Some access

7 (High)

Technical skills

Possible high reward

Anonymous internet users

Some access or resources

8 (High)

Technical skills

Possible high reward

Anonymous internet users

No access required

9 (High)

None

High

Anonymous internet users

No access or resources

Impact is measured on a scale of 0-9.

Data Disclosure

Data Corruption

Services Interrupted

0 (Low)

None

None

None

1 (Low)

None

Minimal slightly corrupt data

Minimal secondary services

2 (Low)

Minimal/Non-sensitive

Minimal slightly corrupt data

Minimal secondary services

3 (Medium)

Minimal/Non-sensitive

Minimal seriously corrupt data

Minimal secondary services

4 (Medium)

Minimal/Non-sensitive

Minimal seriously corrupt data

Minimal secondary services

5 (Medium)

Minimal/Non-sensitive

Extensive slightly corrupt data

Minimal primary services

6 (High)

Minimal sensitive data

Extensive slightly corrupt data

Minimal primary services

7 (High)

Extensive sensitive data

Extensive seriously corrupt data

Extensive secondary services

8 (High)

Extensive sensitive data

Extensive seriously corrupt data

Extensive primary services

9 (High)

All data

All data

All services

Risk is measured by the combination of the likelihood and the net impact, which is the impact after taking site priority into consideration.

Likelihood

Net Impact

Low Likelihood

Medium Likelihood

High Likelihood

Low Impact

Risk: Note

Low Risk

Medium Risk

Medium Impact

Low Risk

Medium Risk

High Risk

High Impact

Medium Risk

High Risk

Critical Risk

In the Advanced Rating Methodology, all vulnerabilities are rated according to the Risk associated with the vulnerability for that asset. This is reflected in the Findings page, Dashboard, and in generated Reports.

The Legacy Rating Methodology

In the Legacy Rating Methodology, sites and applications are evaluated differently:

  • Sites are rated according to Severity.

  • Applications are rated according to Risk.

The Legacy Rating Methodology does not incorporate the site priority in its ratings.

Severity reflects the amount of damage that could be done to the user’s business if a particular vulnerability is exploited. Severity is described as informational, low, medium, high, critical, or urgent. An informational vulnerability reflects a situation where best practices may not be followed, but no actual vulnerability is currently present. In the Legacy Rating Methodology, vulnerabilities found on sites are rated according to the severity of the vulnerability. This is reflected in the Findings page, Dashboard, and in generated Reports.

In the Legacy Rating Methodology, the Rating shown in Reports and Dashboard is based on severity alone. If viewing a particular vulnerability on the Vulnerability Details page, the details displayed under Score. The Score is the combination of severity and threat.

Threat levels are rated zero to five:

Threat Levels

Rating

Threat Level

Description

5

Urgent

This is an easily exploited vulnerability, immediate remediation is recommended.

4

Critical

This is a commonly exploited vulnerability, priority remediation is recommended.

3

High

This is a regularly exploited vulnerability, priority remediation is recommended.

2

Medium

This is a moderately difficult vulnerability to exploit. Remediation is recommended.

1

Low

This is a difficult vulnerability to exploit. Remediation is recommended as possible.

0

Informational

This is an informational finding with negligible risk. Remediation is recommended as best practice.

To change your rating methodology, see Changing Your Rating Methodology.