A finding grade is derived for the Desktop Software and Mobile Software risk vectors based on the grade attributed to each OS and browser version.
The OS and browsers are evaluated based on their supported status:
- GOOD: The version is supported.
- FAIR: The version has been unsupported for less than 4 weeks.
- WARN: The version has been unsupported for less than 52 weeks.
- BAD: The version has been unsupported for over 52 weeks.
Versions that are undetermined or unknown default to the following evaluations:
- ❗Undetermined: Either there’s no version available, the finding cannot be identified, or both the OS and browser are unknown. The finding is evaluated as NEUTRAL.
- ❓Unknown: When either the OS or browser has been evaluated and the other is unknown. The finding is graded as the available grade.
The calculation is depicted in the following table:
| OS & Browser Support Status Matrix | Browser Grade | |||||
|---|---|---|---|---|---|---|
| Supported |
Unsupported < 4 weeks |
Unsupported < 52 weeks |
Unsupported > 52 weeks |
❗Undetermined ❓Unknown |
||
| OS Grade | Supported |
|||||
| Unsupported < 4 weeks |
||||||
| Unsupported < 52 weeks |
||||||
| Unsupported > 52 weeks |
||||||
| ❗Undetermined ❓Unknown |
||||||
- July 18, 2023: Published.
Feedback
2 comments
Hello Ingrid
I am currently working on updating the browser management process. I have reviewed this article which outlines clear formulas for the Fair, Warn, and BAD ranges. However, when I examine the Excel files available on your website, these formulas do not appear to be functioning as expected. The Excel sheets seem to rely on the concept of EOL, which is defined as the gap between the release dates of two consecutive versions plus 7 days.
Our goal is to automate the identification of devices with outdated browser packages. To achieve this, I need to be able to categorize each version of the browser in order to update the packages before BitSight reports a Warn or a BAD status.
I have a few questions:
1. Can a BitSight API provide the information equivalent to what is contained in your Excel file?
2. If not, is there a fixed link to an Excel file that can be automatically accessed and loaded when it is updated?
3. Additionally, is any documentation available that explains how BitSight calculates the different ranges (Fair, Warn, BAD)?
Regards,
Laurent
Hello Laurent,
Are you referring to the endpoint OS-browser versions sheet? I will forward your query to Product Management and Data Research.
As for your third question, finding grading is outlined in How is the Desktop Software Risk Vector Assessed? and How is the Mobile Software Risk Vector Assessed?
Please sign in to leave a comment.