Mastering OWASP Risk Rating
Whaddup y'all..
Besides the well-known CVSS, there’s actually an alternative risk
assessment method, especially for web pentests, called the OWASP Risk
Rating. As the name suggests, this method is provided by the OWASP
organization.
Luckily, someone made a calculator so you don’t have to manually calculate the score. But it still uses pretty formal language, which can be confusing sometimes. I’ve made a simpler explanation for each factor, hope it helps you understand better!🔥
1. Likelihood Factors
The first step is to estimate how likely it is that an attacker will find and exploit the vulnerability. There are two sub-factors: the threat agent factor and the vulnerability factor.
a) Threat Agent Factors
b) Vulnerability Factors
2. Impact Factors
After a successful attack, the next step is to estimate the technical and business impacts of the vulnerability. There are two sub-factors: the technical impact factor and the business impact factor.
a) Technical Impact Factors
b) Business Impact Factors
In The Wild Reality
As a pentester, we usually just fill out a form with three factors: threat agent, vulnerability, and technical impact. For the business impact factor, it requires a deep understanding of what’s important for the company’s operations. If necessary, the pentester and the company should collaborate to fill out the business impact factor together.
Comments
Post a Comment