The Common Configuration Scoring System (CCSS): Metrics for Software Security Configuration Vulnerabilities

Mell, Peter; Scarfone, Karen

doi:https://doi.org/10.6028/NIST.IR.7502

July 19, 2023: URLs for CSRC publication details pages have changed. Legacy URLs should automatically redirect to the new URLs. However, links to the actual publications have NOT changed (e.g., DOIs and PDFs on nvlpubs.nist.gov). Please send inquiries to csrc-inquiry@nist.gov. [12:20 pm ET - If you received "Page Not Found" errors recently, please retry accessing those files. File synchronization should now be complete.]

NIST IR 7502

The Common Configuration Scoring System (CCSS): Metrics for Software Security Configuration Vulnerabilities

Documentation Topics

Date Published: December 2010

Author(s)

Peter Mell (NIST), Karen Scarfone (G2)

Abstract

The Common Configuration Scoring System (CCSS) is a set of measures of the severity of software security configuration issues. CCSS is derived from the Common Vulnerability Scoring System (CVSS), which was developed to measure the severity of vulnerabilities due to software flaws. CCSS can assist organizations in making sound decisions as to how security configuration issues should be addressed and can provide data to be used in quantitative assessments of the overall security posture of a system. This report defines proposed measures for CCSS and equations to be used to combine the measures into severity scores for each configuration issue. The report also provides several examples of how CCSS measures and scores would be determined for a diverse set of security configuration issues.

Keywords

security configuration; security measurement; vulnerability measurement; vulnerability scoring

Control Families

Configuration Management; Risk Assessment

Documentation

Publication:
https://doi.org/10.6028/NIST.IR.7502
Download URL

Supplemental Material:
None available

Document History:
12/27/10: IR 7502 (Final)

Topics

Security and Privacy

risk assessment, security automation, threats, vulnerability management