Articles in this section

See more

Risk Assessment Settings

Avatar
Tom Gibson
  • Updated
Follow

Use Risk Assessment settings to customize risk calculations and display risks in other dashboards. The weight and formula information listed below is also available from the Risk Assessment Settings dialog under Risk Assessment Info in the upper right corner.

  • Exposure Level Weight:

    • Low = 0

    • Medium = 33

    • High = 66

    • Critical = 100

  • Exploit Exists Weight

    • False = 0 (exploit does not exist)

    • True = 100 (exploit exists)

  • Product Criticality Rating Weight

Use the default setting or set custom criticality by product. See Custom Risk Settings.

The Risk Assessment Score calculation uses the following formula:

((ExposureLevelValue * ExposureLevelWeight) + (ExploitExistsValue * ExploitExistsWeight) + (CriticalityValue * CriticalityWeight)) / (ExposureLevelWeight + ExploitExistsWeight + CriticalityWeight)

Risk Score Settings

The Risk Assessment Score calculation uses a weighted average of three aspects of software security listed below. Each uses an assigned weight between 0 – 100. The default value for each weight is 50.

OSP-Ent-PDb-riskscoresettingswidget.png

Custom Risk Settings

Use these settings to create settings that override the default settings defined in the metadata for Product Criticality settings or to create Custom Risk Scores.

OSP-Ent-PDb-customrisksettings.png

Create Custom Product Criticalities

  1. Select + Create Custom Product Criticality in the Custom Risk Settings box. This opens the Create Custom Product Criticality dialog.

    OSP-Ent-PDb-riskcustomcrit.png

  2. Select Browse to search for the product you want to customize.

    OSP-Ent-PDb-addsoftwareprod.png

  3. Select the product to modify, and then click Add Software Product.

    • This adds a table to Custom Product Criticalities.

    • Each time you add another product, the added information appears in this tabl

  4. Enter the number that corresponds to the criticality weight you want to set for this product, and then click Create Custom Product Criticality.

    OSP-Ent-PDb-riskcustomcrit.png

Create Custom Risk Scores

  1. Select + Create Custom Risk Score in the Custom Risk Settings box of Risk Assessment Settings. This opens the Create Custom Risk Score dialog.

    OSP-Ent-PDb-customriskscore.png

  2. Select Browse to open the Add Installable Software dialog.

    1. Select one of the following tabs from the left-side column of the Add Installable Software dialog box:

      • Select the Software Patches tab to choose a patch release.

      • Select the Software Releases tab to choose a product release.

    2. Choose one of the methods below to search for a patch or release:

      OSP_Ent_FlexControl_PPtchSft.png

      • Use the navigation tools on the bottom right to scroll through the pages to find and select a Software product or release.

      • Enter a product name on the search line, and then click Search to find and select a specific product.

  4. Enter the number that corresponds to the risk score you want to set for this product, and then click Create Custom Risk Score.

    • This adds a table to Custom Risk Scores.

    • Each time you add another product, the added information appears in this table.

  5. Select Save Settings.

Comments

0 comments

Article is closed for comments.