KARMA v1.0 (Key Attribute and Risk Management and Analysis) is a risk-rating system developed by IOActive to assess a system’s ability to avoid negative outcomes based on specific key attributes. It uses the expertise of subject matter experts (SMEs) to identify the factors that best predict risks in real-world scenarios. “System” refers to the asset (e.g., application, software, device, or component) evaluated in its likely deployment context.
KARMA has been used for over 20 years and is effective across various security assessments, including web, mobile, infrastructure, embedded systems, code reviews, and design reviews.
KARMA evaluates vulnerabilities based on two factors: likelihood (the probability of an attacker finding and exploiting the vulnerability) and impact (the consequences of exploitation). Ratings are contextualized based on the system’s environment, and the risk score is computed as the product of likelihood and impact, where each range from 1 (informational) to 5 (critical).
Karma stands out as a crucial rating system to use due to its simplicity and elegance. Its design ensures that both technical and non-technical audiences can easily understand and engage with it, making it an accessible tool for a wide range of users.