Understanding the Rating Methodologies
Rating is a measurement of how much of a risk a certain vulnerability poses to the user’s business.
Synopsys strongly recommends that users utilize the Advanced Rating Methodology. This rating methodology allows sites and applications to be evaluated using the same standards. Reports based on the Advanced Rating Methodology use the same rating scale for both sites and applications. In addition, the Advanced Rating Methodology allows users to set priorities for their sites, which enables efficient prioritization and remediation of vulnerabilities according to business needs. |
The Advanced Rating Methodology
In the Advanced Rating Methodology, sites and applications are evaluated in the same way, where the rating is based on Risk.
Risk
Risk includes the following factors:
-
Likelihood: How likely is it that a vulnerability will be exploited? This may be based on how widespread the knowledge of the vulnerability is, how easy it is to exploit, etc.
-
Impact: How much damage may be done to the user’s business if a vulnerability is exploited, as determined by the Threat Research Center.
-
Priority: (Sites only) How important this asset is to the user’s business. Setting a priority for a site is not required however, if no priority is set, priority will not be considered in the Risk calculations.
Risk is measured by the combination of the likelihood and the net impact, this is based on the impact and priority of any vulnerability associated with this asset.
Likelihood |
|||
---|---|---|---|
Net Impact |
Low Likelihood |
Medium Likelihood |
High Likelihood |
Low Impact |
Risk: Note |
Low Risk |
Medium Risk |
Medium Impact |
Low Risk |
Medium Risk |
High Risk |
High Impact |
Medium Risk |
High Risk |
Critical Risk |
In the Advanced Rating Methodology, all vulnerabilities are rated according to the Risk associated with the vulnerability for that asset. This is reflected in the Findings page, Dashboard, and in generated Reports.
The Legacy Rating Methodology
In the Legacy Rating Methodology, sites and applications are evaluated differently:
-
Sites are rated according to Severity.
-
Applications are rated according to Risk.
The Legacy Rating Methodology does not incorporate the site priority in its ratings. |
Severity reflects the amount of damage that could be done to the user’s business if a particular vulnerability is exploited. Severity is described as informational, low, medium, high, critical, or urgent. An informational vulnerability reflects a situation where best practices may not be followed, but no actual vulnerability is currently present. In the Legacy Rating Methodology, vulnerabilities found on sites are rated according to the severity of the vulnerability. This is reflected in the Findings page, Dashboard, and in generated Reports.
In the Legacy Rating Methodology, the Rating shown in Reports and Dashboard is based on severity alone. If viewing a particular vulnerability on the Vulnerability Details page, the details displayed under Score. The Score is the combination of severity and threat. |
Threat levels are rated zero to five:
Threat Levels | ||
---|---|---|
Rating |
Threat Level |
Description |
5 |
Urgent |
This is an easily exploited vulnerability, immediate remediation is recommended. |
4 |
Critical |
This is a commonly exploited vulnerability, priority remediation is recommended. |
3 |
High |
This is a regularly exploited vulnerability, priority remediation is recommended. |
2 |
Medium |
This is a moderately difficult vulnerability to exploit. Remediation is recommended. |
1 |
Low |
This is a difficult vulnerability to exploit. Remediation is recommended as possible. |
0 |
Informational |
This is an informational finding with negligible risk. Remediation is recommended as best practice. |
To change your rating methodology, see Changing Your Rating Methodology.