A New CVSS-Based Tool to Mitigate the Effects of Software Vulnerabilities Assad Ali, Pavol Zavarsky, Dale Lindskog, Ron Ruhl Information Systems Security Management Concordia University College of Alberta, Edmonton,T5B 4E4 Canada assad.qazi@yahoo.com, {pavol.zavarsky, ron.ruhl, dale.lindskog}@concordia.ab.ca Abstract The organizations are challenged by the number of vulnerabilities in the software and hardware platforms. Successful execution of the operations need to have vulnerabilities clean environment. The U.S. National Vulnerability Database (NVD) uses Common Vulnerability Scoring System (CVSS) to score each vulnerability found and provides the detailed description of those security vulnerabilities. The score provided by the NVD is based on the intrinsic and the fundamental characteristics of a vulnerability. This score can further be refined by the organizations to calculate the bearing of the vulnerability on their environment. The purpose of CVSS is to provide a standard way to measure severity of vulnerabilities therefore CVSS version 2.0 calculator contributes less in proposing the solutions to mitigate the effects of vulnerability on a user environment. The growing number of vulnerabilities requires to have more than a simple CVSS calculator that can also propose the remediation actions for the organizations. This research paper reports on the functionality of previously developed software application to enhance the functionalities of standard CVSS version 2.0 calculator. The developed software application is capable of proposing the optimum remedial actions against vulnerabilities for organizations, requiring minimal time and efforts. This software application will be freely available for use. Keywords CVSS, vulnerability scoring system, environmental metrics, enhanced CVSS v2 calculator. 1. Introduction The CVSS has become a de-facto standard for documenting the major characteristics of vulnerabilities and measuring potential impacts of vulnerability exploitation [1],[2],[3]. Initially introduced by the National Infrastructure Advisory Council, CVSS is currently being managed by the CVSS Special Interest Group (CVSS-SIG), and the Forum of Incident Response and Security Teams (FIRST). The National Vulnerability Database (NVD) [4] of the U.S. government is a repository of data of more than forty thousand known software vulnerabilities and their base CVSS scores. The base CVSS score provided by NVD to a vulnerability cannot be used to prioritize the vulnerability remediation activities. The base score serves as a foundation by providing the innate attributes of vulnerability. The CVSS base score always has the largest bearing on the overall CVSS score of a vulnerability. The CVSS however defines equations for temporal and environmental data that can be used to calculate the overall CVSS score that would estimate more precisely the exploitability and impacts of known vulnerabilities to an organization’s IT environment. The NVD also provides a simple online CVSS calculator to calculate these overall scores. While the CVSS calculator is a useful tool to obtain a high level understanding of how the CVSS scoring system works, the calculator has not been designed to calculate the possible overall CVSS scores for a range of possible temporal and environmental data. The CVSS environmental metric group values alone can be arranged in up to 1920 combinations for any particular base score value. However, the existing CVSS calculator calculates the overall CVSS score for only one combination of International Journal for Information Security Research (IJISR), Volume 1, Issue 4, December 2011 Copyright © 2011, Infonomics Society 178