Christopher Turner

Entity Role was created to support the concept of "Scope" within CVSS. CVSS has evolved a few times since this was originally added making multiple nuanced concepts that may or...

Reasoning: Currently, Entity Role's purpose is for defining relevant security boundaries across existing assessment systems. This change will enable tracking of these boundaries using the concept of System of Interest....

Consider transitioning all graphs from Visio to Mermaid

1

# User Story: Mermaid is a tool that can be used to visualize the Vulntology Graphs using text representations within GitHub. We may be able to leverage this tool to...

# User Story: The vulntology could possibly be used to describe vulnerabilities that might fall outside the qualifications established by common systems such as CVE. This could result in Vulntology...

Investigate other non-logical impact types

1

# User Story: Organizations may care about impacts a vulnerability could cause that are not simply related to human injury or property destruction. A small list of possible categories was...

Consider adding Threat mechanisms

1

# User Story: Currently there are no assignable values to assist with establishing current threat levels of a given vulnerability. What can we capture within the Vulntology to better represent...

# User Story: Throughout the Vulnerability life cycle there are a series of events that would be valuable to track for historical, maintenance and academic purposes. Should we consider adding...

Research: How does MITRE D3FEND relate to Vulntology?

4

https://d3fend.mitre.org/

# User Story: We have a few goals of the Vulntology that are listed on the current readme. However, these use cases don't really work for all users that may...

Add capability to communicate chronology for CWE and Actions

2

# User Story: When using the Vulntology to describe a vulnerability I may desire the ability to communicate the order that certain things occur within a scenario. Specifically this is...