Hi Vikas,
First thanks for the statement; although whilst it answers the question it does give some concern regarding potential intent to mask industry standard scoring by only highlighting the less granular Cisco SIR rating; this is contrary to tat as stated in the current Cisco Security Vulnerability Policy, within SNTC.
Since the policy clearly states under the heading 'Assessing Security Risk' that "Cisco uses version 2.0 of the Common Vulnerability Scoring System (CVSS) as part of its standard process of evaluating reported potential vulnerabilities in Cisco products", and that SIR is an 'additional' and 'simple' categorization.
Such details (CVSS scores) are included within 'Cisco Security Advisories' and referenced within Cisco Bug descriptions, noting that bug description themselves reference only the CVSS score and not SIR rating.
Furthermore since CVSS is universally adopted by all (telecom) vendors it enables us, as network operators, consistent analysis of threats to a common framework and scale. This is of significant benefit especially when we have devices from multiple vendors deployed within our networks.
I hope that Cisco will reconsider this planned approach to merely 'showcase the Security Impact Rating' and provide the standard CVSS score for all PSIRT alerts within the SNTC portal.
Rgds,
Graham
