Re: [IDMEF][Issue 10] Severity scale too narrow

On Sun, 11 Jan 2004, David A. Curry wrote:

> 
> >>>>> On Fri, 9 Jan 2004, Herve Debar, identified as "Herve" below, wrote:
> 
>   Herve> From Krzysztof Zaraska: severity scale (3 grades only) is too narrow;
>   Herve> for example, there is an idea floating around of expressing the danger
>   Herve> associated with the attack as exp(severity*vulnerabity_level), but you
>   Herve> can't go far this way with 3 level severity scale only.
> 
> I am way skeptical of any scheme that purports to assign numerical values to
> this type of data and claim that they are "accurate" in any meaningful way.

Just to clarify: I was not proposing including this kind of metric in
IDMEF, I was merely giving an example of situation where 3 level severity
scale is too narrow. 

// Krzysztof Zaraska * kzaraska (at) student.uci.agh.edu.pl
// http://mops.uci.agh.edu.pl/~kzaraska/ * http://www.prelude-ids.org/
// A dream will always triumph over reality, once it is given the chance.
//		-- Stanislaw Lem