I'm at bullet one of this list and immediately, entirely skeptical, since that bullet suggests that a common core competency of infosec people is evaluating a CVE by its CVSS score (which, we're told, has meaning relative to your own environment; that's where the art lies, presumably).
But CVSS is an industry-wide joke. It means almost literally nothing (a 9+ is usually, but not always, more severe than a 2). It's a Ouija board, computed by a mysterious calculator and adjusted by imperceptible nudges until the score matches the intuitions of the scorer.
But CVSS is an industry-wide joke. It means almost literally nothing (a 9+ is usually, but not always, more severe than a 2). It's a Ouija board, computed by a mysterious calculator and adjusted by imperceptible nudges until the score matches the intuitions of the scorer.