Comments on: Common Criteria Web Application Security Scoring (CCWAPSS) Released http://www.darknet.org.uk/2007/10/common-criteria-web-application-security-scoring-ccwapss-released/ Ethical Hacking, Penetration Testing & Computer Security Fri, 21 Nov 2008 01:18:27 +0000 http://wordpress.org/?v=2.6.3 By: dre http://www.darknet.org.uk/2007/10/common-criteria-web-application-security-scoring-ccwapss-released/#comment-68791 dre Thu, 25 Oct 2007 01:20:43 +0000 http://www.darknet.org.uk/2007/10/common-criteria-web-application-security-scoring-ccwapss-released/#comment-68791 for similar work look at the fortifysoftware metricon 2.0 talk by fred lee, <a href="https://securitymetrics.org/content/attach/Metricon2.0/Lee_metricon20070807.ppt" rel="nofollow">Security Metrics in Practice: Development of a Security Metric System to Rate Enterprise Software</a>. i wasn't able to see it at metricon 2.0, but he gave the talk along with me at the <a href="https://www.owasp.org/index.php/Minneapolis_St_Paul" rel="nofollow">owasp msp event</a> last week. mark cuphey and the owasp team (including chris wysopal and myself) have also been working on another set of metrics. darkreading did an article on it called <a>OWASP Preps Framework for Website Security Certification</a>. wysopal is also working on a more generic vulnerability rating system using CVSS from CWE data as described in <a href="https://securitymetrics.org/content/attach/Metricon2.0/Wysopal-metricon2.0-software-weakness-scoring.ppt" rel="nofollow">Software Security Weakness Scoring</a> for similar work look at the fortifysoftware metricon 2.0 talk by fred lee, Security Metrics in Practice: Development of a Security Metric System to Rate Enterprise Software. i wasn’t able to see it at metricon 2.0, but he gave the talk along with me at the owasp msp event last week.

mark cuphey and the owasp team (including chris wysopal and myself) have also been working on another set of metrics. darkreading did an article on it called OWASP Preps Framework for Website Security Certification. wysopal is also working on a more generic vulnerability rating system using CVSS from CWE data as described in Software Security Weakness Scoring

]]>