Risk Score Calculation

[SRIRAMSANKAR007]

Calculators helps to calculate the risk score calculation is it right? And if so, what are the severity calculator used for? What and see i could not catch this concept. Anybody explain this properly.

[rahulswami]

Hi @SRIRAMSANKAR007, 

Yes, that's correct. Calculators are what actually compute the risk score, rather than simply displaying it.

How it works: the Risk Score Calculator pulls in raw inputs such as the CVSS score, asset criticality, exploit availability and exposure then runs them through weighted rules to produce a single risk score.
for example 85 out of 100.

The Severity Calculator takes that score and places it into a category people can act on quickly, like: Critical, High, Medium, or Low, so analysts don't need to interpret raw numbers every time.

Here's a simple example. Two servers carry the exact same vulnerability with a 9.0 CVSS score. One is a test box and the other runs your payment gateway. Both start from the same base severity, but the Risk Score Calculator accounts for the fact that one asset matters far more to the business, so the payment gateway ends up with a much higher risk score. The Severity Calculator then flags that server as Critical, while the test server might only land as High or Medium.

In short, the Risk Score Calculator handles the math and the Severity Calculator turns that math into a priority label people can act on.

[SRIRAMSANKAR007]

Hi @rahulswami

Thanks for your reply to my question. My further doubt is like, the final score we need to analyze is the risk score right. From your context I could understand that with both of the Calculators(risk score calculator and severity calculator) the final Risk Score is generated. Is my above context is correct?

[rahulswami]

Hi @SRIRAMSANKAR007, Let me clarify that a bit.

The Risk Score itself comes only from the Risk Score Calculator. That's the one doing the actual math, pulling in CVSS, asset criticality, exploit availability.....etc and finally producing the final number.

The Severity Calculator is not a part of generating that number. Its job is to take a score, usually the Risk Score once it exists and translate it into a category like Critical, High, Medium, or Low. So think of it as a separate step that runs after the risk score is already calculated, not something that feeds into producing it.

So directly answer your question, the two calculators do not combine to generate the Risk Score together. The Risk Score Calculator generates the score and the Severity Calculator then reads that score and assigns the severity label on top of it.

I hope this works for you now.