Add a property to scenario that identifies it's classification

[Chris-Turner-NIST]

User Story:

The vulntology could possibly be used to describe vulnerabilities that might fall outside the qualifications established by common systems such as CVE. This could result in Vulntology representations of theoretical issues, non-exploited issues, vulnerabilities that occur over time, issues that are near impossible to exploit in practice etc. IT would be useful to classify Vulntology representations.

A system needs to be established and defined to represent this classification system.

General Idea:

Theoretical vs Confirmed (ties into likelyhood, but could be a pre-designation)
Likelyhood of exploitation (similar to threat)
Common vs uncommon scenario (such as commonly crashes, but could result in uncommon disclosure)

This should be outside the scope of barrier, this is not intended to imply the conditions of success, but more the conditions of being a real world scenario.

Goals:

Research into each General Idea described in the user story and determine which types of classification would be useful and where they would apply within the model. (Some of these seem to be vulnerability level where others are possibly scenario level)

Dependencies:

N/A

Acceptance Criteria

[ ] Research completed into other areas of classification
[ ] Determinations clearly defined regarding types that should be considered for inclusion into Vulntology and where they would best fit