Cisco adopts security reporting standard

By

Severity scores to help IT staff prioritise patches.

Cisco adopts security reporting standard
Cisco is planning to issue security severity scores as part of its security advisories. 

The programme is designed to help users pick the vulnerabilities that require the most attention.

Current severity ratings are generally limited to descriptions such as 'critical' or 'moderate'. The new scoring system provides a more efficient way to prioritise patches.

"Customers can now compute a score allowing them to set priorities based on the risk to the specific environment," said Russ Smoak, director of technical support for Cisco's security response team.

The scores will be calculated according to the Common Vulnerability Scoring System (CVSS) co-created by Cisco and maintained by the independent Forum for Incident Response and Security Teams. 

The networking vendor follows Oracle in embracing the standard in its security disclosures. 

The CVSS standard provides three scores. 'Base' indicates the conditions required to exploit the vulnerability, and the impact of a successful exploit.

'Temporal' indicates time-dependent information such as the exploitability of a flaw, while 'Environmental' considers a user's specific configuration and environment. Cisco will issue only 'Base' and 'Temporal' scores.
Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

"Widespread data theft" hits Salesforce customers via third party

"Widespread data theft" hits Salesforce customers via third party

Home Affairs adds SecOps to new cyber risk overhaul

Home Affairs adds SecOps to new cyber risk overhaul

Exetel fined $694k over system 'vulnerability' for mobile number porting

Exetel fined $694k over system 'vulnerability' for mobile number porting

Attackers weaponise Linux file names as malware vectors

Attackers weaponise Linux file names as malware vectors

Log In

  |  Forgot your password?