Vulnerabilities to be ranked by NIAC group

The hope is to produce a universal language for describing the seriousness of vulnerabilities that will replace vendor ratings.

According to the working group enabled with the task of creating the system, it will present vulnerabilities in a way non-tech savvy board members will understand.

"You can present the statistics in a trend fashion to the board," said Gerhard Eschelbeck CTO of Qualys, who is involved with the creation of CVSS. "By creating a one to ten rating, with ten being the highest risk, the system is very easy to understand. It's easy to gauge your own performance and track trends over time."

The system will measure vulnerabilities on three different levels (base, temporal and environmental) and from that create a single figure for its seriousness.

The base level consists of qualities that are intrinsic to the vulnerability and will not change. The temporal level concerns time-specific elements of the vulnerability. And elements of the vulnerability that are specific to the user's environment are examined at the environmental level.

"Initially the idea has been developed by a group of volunteers," said Eschelbeck. "But there are discussions about a permanent home. We are getting good support."

www.dhs.gov/niac
www.qualys.com