FIRST SIG Updates
Presenters detail vulnerability discovery and exploitation in FIRST SIG Updates.
Summary
Overview: FIRST SIG leaders present updates at the Cyber Threat Intelligence Symposium, covering CVSS v4.0 development and other special interest group progress.
Key Topics: CVSS v4.0 finer granularity metrics and attack requirements; 3,000 person-hours of SIG effort; BTE (Base, Threat, Environmental) scoring model; public preview targeting December 2022; and other FIRST SIG initiatives.
Technical Details: Dave Dugal presents CVSS v4.0 improvements including enhanced user interaction metrics, attack requirements, and a bit.ly calculator preview for community feedback before NIST math finalization.
Takeaways: CVSS v4.0 addresses long-standing scoring granularity complaints. Security teams should review the preview calculator and provide feedback to shape the final specification.
Related talks
36th Annual FIRST Conference·57 min
Industry experts analyze emerging threats surrounding SIG Updates.
FIRST·24 min
Security researchers examine technical aspects of Updates from the CVSS SIG.
S4 Events·15 min
Industry experts analyze emerging threats surrounding ISA Updates.