[Full-disclosure] 'Quantification' of vulnerability rating

Friends,

I am working on quantitative analysis of vulnerabilities. I was
wondering if people here can guide/share/suggest me on the same.
Basically, the problem statement is how to 'quantify' the
vulnerability.

Generally in VARs (Vulnerability Assessment Report), we identify the
vulnerability as Critical, Medium, Low etc, the judgment is based on
generally perception like buffer overflow is critical vulnerability,
but I guess it will be better if we can map it to the usage scenario,
and other parameters like how difficult it is to exploit it, how
widely the product is used etc. We can give some numbers to all these
parameters and come up with a model where we can 'quantify'
vulnerability. Based on this number we can rate the vulnerability
accordingly.

It is just a thought, please let me know if someone is working on similar area.

Regards,
Gaurav Kumar
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/