NIAC presented their previously described new vulnerability scoring system at RSA today. I wasn't in the room myself, but have heard a couple of first-hand accounts so far - also, I had seen one of the earlier NIAC drafts.

The scoring system definitely has a couple of good points - they made the good choice of differentiating authenticated and un-authenticated vulnerabilities as well as the acknowledgement of different attack vectors as a key point of severity. They also made many of the same choices we made 5 years ago: being aware of the complexity of the attack as an important factor, being aware of depth of access as the fundamental component of risk, and so on.

However, I believe that they made a fundamental error when it comes to the temporal component of their metric: they forgot the audience. The temporal component of the new scoring system works to reduce the score from day #1 until day #n - that is, the vulnerability gets less severe as time marches forward.

This is true in a very global sense: as the enterprises patch vulnerabilities, they become less severe. Thus, the vulnerability (from a global perspective) becomes less wide-spread.

However, this metric isn't designed to talk about the global severity of the vulnerability - it's designed to assist end-users in their decisions on how to patch. Because of this, the thinking above is absolutely backwards.

While a vulnerability may be globally less severe with time because the number of instances grows fewer, the number of available tools and exploit vectors continues to grow (albeit at a slower rate) with each additional day that the vulnerability is publically accessible. This should be obvious to anyone who has ever done a penetration test: the brand new Solaris vulnerability is less likely to have an exploit than the 4-year old Solaris RPC vulnerability. I always loved it when I found a box that was unpatched to older exploits - it made my life easier.

Just like it makes the life of any attacker easier.

This metric (much as our scoring system) is designed to prioritize patching - as I see it, the vulnerabilities that make it easier for an attacker to compromise YOUR network are the ones that have the highest priority, regardless of their global significance.

That will always be the oldest, best known ones.

Because of that, the new CVSS (Common Vulnerability Scoring System) is doomed to fail to actually do what it's supposed to do best - allow customers to protect their networks from attackers.