On Fri, 31 May 2002, Tony Torri wrote:
> Question: Should I be concerned about a finding that has a low severity
> rating but the risk factor is high? Why isn't a finding that has a high
> risk factor rated with a high severity rating? I have seen lots of findings
> like this that have a low severity rating but a high risk factor. Just does
> not make sense to me. What is the logic behind Nessus doing this?
In short:
The severity rating tells you what can be done if you break in.
The risk factor indicates how likely it is that it will be (ab)used.
So plan you strategy based on the risks you run. Classify each type and
try to put numbers ($$$) to it and then prioritize based on these
calculations.
Hugo.
--
All email send to me is bound to the rules described on my homepage.
[EMAIL PROTECTED] http://hvdkooij.xs4all.nl/
Don't meddle in the affairs of sysadmins,
for they are subtle and quick to anger.
