| CARVIEW |
- About FIRST
- Mission Statement
- Strategy Framework
- History
- Sustainable Development Goals
- Organization
- FIRST Policies
- Anti-Corruption Policy
- Antitrust Policy
- Bylaws
- Board duties
- Bug Bounty Program
- Code of Conduct
- Conflict of Interest Policy
- Document Record Retention and Destruction Policy
- FIRST Press Policy
- General Event Registration Refund Policy
- Guidelines for Site Selection for all FIRST events
- Identity & Logo Usage
- Mailing List Policy
- Media Policy
- Privacy Policy
- Registration Terms & Conditions
- Services Terms of Use
- Standards Policy
- Statement on Diversity & Inclusion
- Translation Policy
- Travel Policy
- Uniform IPR Policy
- Whistleblower Protection Policy
- Partnerships
- Newsroom
- Procurement
- Jobs
- Contact
- Membership
- Initiatives
- Special Interest Groups (SIGs)
- SIGs Framework
- Academic Security SIG
- AI Security SIG
- Automation SIG
- Cybersecurity Communications SIG
- Common Vulnerability Scoring System (CVSS-SIG)
- CSIRT Framework Development SIG
- Cyber Insurance SIG
- Cyber Threat Intelligence SIG
- Curriculum
- Introduction
- Introduction to CTI as a General topic
- Methods and Methodology
- Priority Intelligence Requirement (PIR)
- Source Evaluation and Information Reliability
- Machine and Human Analysis Techniques (and Intelligence Cycle)
- Threat Modelling
- Training
- Standards
- Glossary
- Communicating Uncertainties in CTI Reporting
- Webinars and Online Training
- Building a CTI program and team
- Curriculum
- Detection Engineering & Threat Hunting SIG
- Digital Safety SIG
- DNS Abuse SIG
- Stakeholder Advice
- Detection
- Cache Poisoning
- Creation of Malicious Subdomains Under Dynamic DNS Providers
- DGA Domains
- DNS As a Vector for DoS
- DNS Beacons - C2 Communication
- DNS Rebinding
- DNS Server Compromise
- DNS Tunneling
- DoS Against the DNS
- Domain Name Compromise
- Dynamic DNS (as obfuscation technique)
- Fast Flux (as obfuscation technique)
- Infiltration and exfiltration via the DNS
- Lame Delegations
- Local Resolver Hijacking
- Malicious registration of (effective) second level domains
- On-path DNS Attack
- Stub Resolver Hijacking
- Detection
- Code of Conduct & Other Policies
- Examples of DNS Abuse
- Stakeholder Advice
- Ethics SIG
- Exploit Prediction Scoring System (EPSS)
- FIRST Multi-Stakeholder Ransomware SIG
- Human Factors in Security SIG
- Industrial Control Systems SIG (ICS-SIG)
- Information Exchange Policy SIG (IEP-SIG)
- Information Sharing SIG
- Law Enforcement SIG
- Malware Analysis SIG
- Metrics SIG
- NETSEC SIG
- Public Policy SIG
- PSIRT SIG
- Red Team SIG
- Security Lounge SIG
- Security Operations Center SIG
- Threat Intel Coalition SIG
- Traffic Light Protocol (TLP-SIG)
- Transportation and Mobility SIG
- Vulnerability Coordination
- Vulnerability Reporting and Data eXchange SIG (VRDX-SIG)
- Women of FIRST
- CCB Initiatives
- FIRST CORE
- Internet Governance
- IR Database
- Fellowship Program
- Mentorship Program
- IR Hall of Fame
- Victim Notification
- Volunteers at FIRST
- Previous Activities
- Special Interest Groups (SIGs)
- Standards & Publications
- Events
- Education
- Blog
CVSS v2 Archive
New version of Common Vulnerability Scoring System released
Seville Spain June 20, 2007: Millions of computer users worldwide will enjoy more secure virtual experiences and transactions with the advent today of CVSSv2 the latest version of the Common Vulnerability Scoring System.
The release of version 2 was announced today by the Forum of Incident Response and Security Teams (FIRST) and the Common Vulnerability Scoring System-Special Interest Group (CVSS-SIG).
CVSS provides a universal open and standardized method for rating IT vulnerabilities.
Over a dozen members of the CVSS-SIG collaborated extensively through 2006 and 2007 to revise and improve CVSS v1 by testing and re-testing hundreds of real-world vulnerabilities. CVSS v2 represents the collective feedback and experience of many of the early adopters and security professionals of the CVSS-SIG.
We feel CVSS v2 addresses many of the early issues of CVSS v1 brought up both by consumers and the SIG. We are excited to announce this new version and are looking forward to using it, said Gavin Reid, Chair of the CVSS SIG.
CVSS v2 is a significant improvement over the original version. It reduces inconsistencies, provides additional granularity, and more accurately reflects the wide variety of vulnerabilities.
We believe that CVSS v2 demonstrates a new level of maturity in standardized vulnerability scoring, added Steve Christey, of the MITRE Corporation, who edits Common Vulnerabilities and Exposures (CVE). We wanted to achieve the best possible balance of accuracy, flexibility and usability.
Another member of the program team, Sasha Romanosky of Carnegie Mellon University, said that CVSSv2 is even better at communicating the true properties of IT vulnerabilities for end-users, and for commercial and non-profit security organizations.
As a part of the U.S. governments SCAP (Security Content Automation Protocol) CVSS v2 will be used in standardizing and automating vulnerability management for many millions of computers, eventually rising to hundreds of millions.
CVSS v2 represents the culmination of CVSS-SIG efforts to test, correct, and improve CVSS.
Nevertheless, the CVSS-SIG continues constantly to evaluate the standard by analyzing and scoring old and new vulnerabilities, examining feedback received from CVSS users, and fine-tuning the mathematical equations.
- Common Vulnerability Scoring System (CVSS-SIG)
About CVSS
CVSS is a vulnerability scoring system designed to provide an open and standardized method for rating IT vulnerabilities. CVSS helps organizations prioritize and coordinate a joint response to security vulnerabilities by communicating the base, temporal and environmental properties of a vulnerability. For additional information on CVSS v2, please see https://www.first.org/cvss and https://nvd.nist.gov/cvss.cfm?calculator&adv&version=2
About FIRST and CVSS-SIG
FIRST, the world's leading incident-handling forum, is an international confederation of trusted computer incident response teams who cooperatively handle computer security incidents and promote incident prevention programs. FIRST sponsors and supports the CVSS-SIG, a diverse group of security professionals who have a keen interest in security vulnerabilities and use CVSS in their daily work. In addition, FIRST hosts a special interest group to update and promote CVSS and provides a central repository for CVSS documentation.
Chair
- Seth Hanford (TIAA-CREF)