within the root attack vector.The final RASQ score for a system is the product of the
sum of all effective attack surfaces multiplied by the root vector’s attack bias.
According to a study by Ernst &Young, [122] the RASQ for an out-of-the-box
Windows 2000 Server running Internet Information Server (IIS) is 341.20, a high