Vulnerability Scoring: CVSS and CVE

Industry-Standard Vulnerability Scoring

• CVSS (Common Vulnerability Scoring System) catalogues known vulnerabilities.
• CVSS provides a score indicating the severity of a vulnerability.

Publicly Known Vulnerabilities

• CVE (Common Vulnerabilities and Exposures) catalogue creates a list of publicly known vulnerabilities.
• Each CVE entry is assigned an ID number, description, and reference.

CVSS Metric Groups

• Base metric group: Includes exploitability metrics and impact metrics.
• Environmental metric group: Includes modified base metrics, confidentiality, integrity, and availability requirements.
• Temporal metric group: Includes exploit code maturity, remediation level, and report confidence.

CVSS Base Metric Group Items

• Attack complexity
• Integrity impact
• Availability requirements

CVSS Environmental Metric Group Items

• Confidentiality requirements

CVSS Temporal Metric Group Items

• Exploit code maturity

Penetration Testing Report Generation

• Dradis can ingest results from penetration testing tools
• Cybersecurity analysts use Dradis to produce reports in formats like CSV, HTML, and PDF.

Technical Controls

• Multifactor authentication
• Certificate management

Pen-Test Results

• Process-level remediation
• Patch management
• Secrets management solutions

Vulnerability Prevention

• OWASP (Open Web Application Security Project) provides cheat sheets and detailed guidance on preventing vulnerabilities.
• Examples of vulnerabilities include: cross-site scripting, SQL injection, and command injection

Minimum Password Requirements

• Minimum password requirements and policies/procedures are examples of administrative controls.

User Training

• Mandatory vacations and user training are included in the administrative control category.

Access Control

• Access control vestibule information are included in the physical security control category.

True Positive

• A successful identification of a security attack or a malicious event

False Positive (Benign Trigger)

• A security device that triggers an alarm where no actual malicious activity is taking place.

Alert fatigue.

• False positives diminish the value and urgency of real alerts

False Negatives

• Malicious activites that are undetected by network security devices

True Negatives

• An intrusion detection device identifies an activity as acceptable behavior, and the activity in fact, is acceptable

Incident Identification

• A true positive event is a successful identification of a security attack.

Technical Controls for Vulnerability Mitigation

• User input sanitization

Administrative Controls

• RBAC (Role-Based Access Control) enables administrators to control what users can do.
• Control is at both broad and granular levels

Security Education and Training

• "Building an Information Technology Security Awareness and Training Program" highlights the importance of security education for users.
• It defines ways to improve the security operations of an organization.

CVSS Scoring Interpretation

• CVSS scores are rated from 0 to 10, with 10 being the most severe.

System Hardening

• System hardening belongs to the technical control category.