value of simplicity

[j---]

As raised by @jchester in his post:

The other area where SSVC arguably falls short is that it has a simpler implied causal model than CVSS does. In the critique by Risk Based Security discussed above, it was argued that CVSS was not detailed enough. But SSVC goes from CVSS's eight variables down to just four. It might be argued that three of CVSS's variables (Confidentiality, Integrity and Availability) can be usefully compressed into the SSVC Mission & Well-Being variable. That still leaves a substantial gap in the input permutations between the two schemes.

I think it is possible that within the context of this paragraph, different stakeholders have different "causal models."
If that is the case, SSVC and CVSS are not directly comparable. I'd like to explore if this is a reasonable basis to understand the "causal model" idea, because I did not so much think of SSVC as having a causal model. And at least, insofar as it does, the "stakeholder specific" thing means I think it might have multiple.

I think this might suggest some changes to the visual display of the calculator, also. In the section of the paper that talks about relationship to other systems and CVSS specifically, we sketch how technical impact is related to the CVSS v3 impact metrics. That the post relates the CVSS impact metrics to mission impact and safety impact indicates we need to either message this better or change our minds. One way to message better would be to pull the CVSS vector string in for vuls that have one and use our suggested mapping to make a suggestion for the technical impact value.
@sei-vsarvepalli , how hard would it be to pull the CVSS vector string values for C/I/A impact and Scope if a user enters a CVE-ID into the calculator?

[sei-vsarvepalli]

Hey @j---

I had noticed this till just now. It is very easy to pull CVSS vector strings. May be will do this once the open Bug tickets are fixed for the demo site.

Vijay

[jchester]

/CCing my dayjob alterego, @jchestershopify.

[j---]

@sei-vsarvepalli , let's handle the calculator engineering under #195 . This issue will be closed once the discussion of causal modes and the comparison to CVSS is handled in the PDF document / documentation.