Choose a value for each of the methodology's sixteen factors and get the likelihood, the impact and the overall severity from OWASP's matrix, with the vector to quote in your report.
Likelihood asks who would attack this and how easily: the attacker's skill, motive, opportunity and numbers, and how easy the weakness is to find and exploit, how widely it is known and whether an attack would be noticed. Impact asks what an attack would cost: in technical terms, the loss of confidentiality, integrity, availability and accountability; in business terms, money, reputation, compliance and privacy.
Each side is the average of its factors, read as Low below 3, Medium below 6 and High from 6, and the matrix beside the result turns the two into the overall severity, from Note to Critical.
Give the vector with the rating, so the client can see which judgements drove it and argue with a factor rather than with the outcome, and say in the report's methodology whether impact was taken from technical or business factors. Where the client has stated how much a system matters to them, use it: the business factors exist so that a rating reflects their exposure rather than the tester's guess at it.
The factors, their values, the thresholds and the matrix are those of the OWASP Risk Rating Methodology, published by the OWASP Foundation under the Creative Commons Attribution-ShareAlike 4.0 licence. This calculator is Pental's, and is not affiliated with or endorsed by OWASP.
Likelihood is the average of the eight threat agent and vulnerability factors, each scored from 0 to 9. Impact is the average of the four technical impact factors, or of the four business impact factors where that information is known. Each average is Low below 3, Medium from 3 to below 6 and High from 6, and the two levels give the overall severity from OWASP’s matrix.
OWASP advises using the business factors where you have good information about them, because the business impact is what the client is actually exposed to. A tester rarely knows a client’s annual profit or regulatory position, which is why the technical factors are the default here; switch to business impact when the client has given you what you need.
CVSS rates the vulnerability itself in a standard way that anyone can repeat from the vector. The OWASP methodology rates the risk to a particular organisation, with judgements about who would attack it and what it would cost them. Many firms report a CVSS score and use a risk rating like this one where the client wants their own context reflected.
It records the value chosen for each of the sixteen factors, in the form OWASP’s calculators use, such as (SL:5/M:4/O:7/S:6/ED:7/EE:5/A:6/ID:8/LC:6/LI:3/LAV:1/LAC:7/FD:3/RD:4/NC:5/PV:5). Quoting it beside a rating lets anybody see how the rating was reached, and pasting it here opens the same rating.
No. The rating is worked out in your browser, and the vector is kept in the page’s address so you can share it.
The tools are free and stay free, and so is our open-source reporting tool. Pental is the platform they come from.
Pental is pentest management and reporting for testing firms: findings scored as you write them, reports in your own Word template, QA review and a white-label client portal. Free trial, no card required.