Accuracy SLA

Description

F2 and F0.5 scores of at least 90% are achieved in reports of a client’s software’s risk exposure  and vulnerabilities, respectively.

Criteria

For this SLA indicator to apply, your group must be subscribed to the Advanced plan . Additionally, false negative and false positive reports must meet the defined conditions to be considered as true. (See the articles False negatives  and False positives  for details.)

Details

In addition to the general measurement aspects , the following is taken into account to measure this SLA indicator:

• The risk exposure caused by vulnerabilities is calculated using the formula CVSSF = 4^(CVSS-4).
• Accuracy is calculated based on false positives, false negatives, and the F-Score model .
• In groups subscribed to black-box testing , vulnerabilities detectable only via source code review  are not considered false negatives.

Indicator calculation

This SLA indicator involves two measures: Severity accuracy and quantity accuracy. Accordingly, the former is equal to the value of the F2 score, which places significant weight on false negatives. Using this model and involving the CVSSF metric allows Fluid Attacks to measure accuracy in the terms that matters most to your organization’s management, i.e., that critical issues have not been overlooked. Quantity accuracy, in contrast, is equal to the value of the F0.5 score, in which false positives have more weight. This model, and using the number of vulnerabilities, allows Fluid Attacks to measure accuracy in a way that interests your development team the most, i.e., that reported issues to fix are indeed correct.

Severity accuracy is calculated as follows:

• Compute the CVSSF for each individual vulnerability using the formula CVSSF = 4^(CVSS-4).
• Calculate the total CVSSF for True Positives, False Positives and False Negatives.
• Compute the following intermediate indicators:
• Precision: True Positives / (True Positives + False Positives)
• Recall: True Positives / (True Positives + False Negatives)
• Compute the F2 score with the formula 5 _ {[Precision _ Recall] / [(4 * Precision) + Recall]}

Quantity accuracy is calculated as follows:

• Calculate the total number of vulnerabilities differentiating by True Positives, False Positives and False Negatives.
• Compute the following intermediate indicators:
• Precision: True Positives / (True Positives + False Positives)
• Recall: True Positives / (True Positives + False Negatives)
• Compute the F0.5 score with the formula 1.25 _ {[Precision _ Recall] / [(0.25 * Precision) + Recall]}