Instructor: CVSS, 2 2
or the Common Vulnerability Scoring System. 3 3
We very briefly touched upon this 4 4
when I started talking about the NVD, 5 5
the National Vulnerability Database, 6 6
because I mentioned 7 7
that this includes information including the CVSS score. 8 8
In this lesson, 9 9
we're going to break down exactly what is that score. 10 10
Well, first, let's talk 11 11
about the Common Vulnerability Scoring System, or CVSS. 12 12
This is a risk management approach 13 13
to quantifying vulnerability data, 14 14
and then taking into account the degree of risk 15 15
to different types of systems or information. 16 16
Essentially, it's going to allow us to put a number 17 17
against something. 18 18
So instead of just saying, 19 19
"This is a low risk or this is a high risk," 20 20
I can actually quantifiably measure it. 21 21
Now, CVSS can be useful 22 22
in prioritizing your response actions 23 23
because if I have something that has a 9.3 versus a 10, 24 24
I should probably fix the 10 first, 25 25
or so you would think because it's a higher number, right? 26 26
That's the basis of using a CVSS score. 27 27
But for you to really be able to use these, 28 28
you have to understand what they mean, 29 29
and that's why we're going to break these things apart 30 30
in this lesson. 31 31
Now, at their most simple form, 32 32
a CVSS score is a number with a description. 33 33
If I have a score of zero, that means none, 34 34
there is no risk. 35 35
It's not a very threatening thing. 36 36
If I have a number that's between 0.1 and 3.9, 37 37
this is considered a low threat. 38 38
If I'm dealing with something between 4.0 and 6.9, 39 39
this is a medium threat. 40 40
If I'm dealing with 7.0 to 8.9, this is a high threat. 41 41
And if I'm dealing with a 9.0 to 10.0, 42 42
this would be a critical threat. 43 43
Now, these numbers are baseline numbers. 44 44
You're going to be able to adjust these 45 45
based on your own circumstances 46 46
and your own mitigations as well. 47 47
For this reason, it's really important that you look 48 48
at how these numbers are constructed. 49 49
Now, coming directly from the NVD website, 50 50
you can see this graphic. 51 51
We have three things that actually are added 52 52
into making up that CVSS score. 53 53
First, we start with a base metric. 54 54
This includes things like the exploit or the impact, 55 55
and then we take that and we can actually feed that in 56 56
to some optional metrics, including Temporal metrics 57 57
and Environmental metrics. 58 58
And all of those combined 59 59
will give you this final CVSS score. 60 60
Now, what we're going to do in the rest of this lesson 61 61
is break down all the components of these base metrics 62 62
because that is really where the bulk of this score 63 63
is going to come from, 64 64
and it's really important for you to understand it. 65 65
Now, when I talk about base metrics, 66 66
these are comprised of things like the access vector, 67 67
the access complexity, the privileges required, 68 68
the user interaction, the scope, 69 69
the confidentiality, integrity, and availability, 70 70
and if they're being modified 71 71
by this particular exploit or vulnerability. 72 72
Now, in addition to that, 73 73
we have to start looking at each of these individually. 74 74
As we start looking at the access vector, 75 75
this is going to tell us, 76 76
does the attacker need to have physical access, 77 77
local access, adjacent network access, 78 78
or network access? 79 79
If they need physical access, 80 80
it's probably less of a threat to you 81 81
than if they need network access, 82 82
which means they can get to you over the internet. 83 83
And so again, depending on the access vector, 84 84
this is going to be either more or less dangerous to us, 85 85
and so that's going to affect our score. 86 86
Then we have to consider our access complexity. 87 87
Is this a high complexity or a low complexity? 88 88
If this is a high complexity exploit, 89 89
that means it's going to be less of a threat 90 90
because less people will be able to do it. 91 91
If it has a low complexity to that exploit, 92 92
it's going to be more dangerous to us, right? 93 93
Because more people will be able to do it. 94 94
It's easier for an attacker to use. 95 95
And so complexity is important as well, 96 96
and this will affect our number. 97 97
Then we have to consider the privileges required. 98 98
Can they run this exploit with no privileges, 99 99
low privileges, or high privileges? 100 100
Again, no privileges or low privileges 101 101
are going to be more dangerous than high privileges. 102 102
The reason for this is 103 103
if you could do it with no privileges, 104 104
that means you don't have to log in. 105 105
If you do it with low privileges, 106 106
that means a standard user or a guest user 107 107
could do this exploit. 108 108
And if you're doing it with high privileges, 109 109
that means they need something like administrative 110 110
or a service account to be able to run this exploit. 111 111
And so again, this is going to affect our base score. 112 112
The next one we're going to look at is user interaction. 113 113
Are we going to have none or required? 114 114
Now, again, this is going to make things 115 115
either more or less dangerous. 116 116
If there is no user interaction required, 117 117
that means that the exploit can run 118 118
without the user doing anything. 119 119
If the user interaction is required, 120 120
that means the user has to run the program 121 121
or launch the exploit, 122 122
and so you're going to have to use 123 123
some kind of a social engineering component 124 124
to trick the user into doing that, 125 125
making it more of a complex attack. 126 126
So again, it becomes more or less risky 127 127
based on if you need no interaction or required interaction. 128 128
The next category is scope. 129 129
The scope can either be unchanged or changed. 130 130
Now, when I talk about this, 131 131
this is referring to whether or not 132 132
the exploit affects only the local security context, 133 133
meaning unchanged, or the entire security context, 134 134
which means it would be changed. 135 135
So change is more of risk for us than unchanged 136 136
in this case. 137 137
The next one we have is confidentiality. 138 138
Now, as we start looking at these, 139 139
if somebody's able to run this exploit, 140 140
there are different measures that have impact 141 141
to the CIA triad, 142 142
confidentiality, integrity, and availability. 143 143
And so if I run this exploit, 144 144
am I affecting confidentiality? 145 145
Am I affecting integrity? 146 146
Am I affecting availability? 147 147
And for each of these, 148 148
we're going to be looking at high, medium, and low. 149 149
So, if this exploit has a high change to confidentiality, 150 150
that's more risky for us 151 151
than something that has a low change to confidentiality. 152 152
The same thing when we talk about integrity, 153 153
high, medium, and low, 154 154
how much is being changed or altered? 155 155
And then availability, high, medium, and low. 156 156
And so we take all of these components, 157 157
we add them together, and that gives us our base metric. 158 158
Now, in addition to that base metric, though, 159 159
we can then feed that into this optional metrics, 160 160
which include Temporal and Environmental. 161 161
Now, when I talk about Temporal metrics, 162 162
these are composed of things like Exploit Code Maturity, 163 163
Remediation Level, and Report Confidence. 164 164
All of these have to do with time. 165 165
How timely is this information? 166 166
How much do I trust it? 167 167
How long has this exploit been available? 168 168
And how many versions of this exploit exist? 169 169
Because that would mean it's more mature 170 170
and harder for us to detect necessarily. 171 171
The next one we want to talk about 172 172
is the Environmental metrics, 173 173
and these are composed of modifying those base metrics. 174 174
So we're still going to be looking back 175 175
into things like your access vectors. 176 176
We're going to be looking 177 177
into things like integrity and confidentiality. 178 178
And based on the environment you're dealing with, 179 179
you can then modify the base score 180 180
to make it more or less threatening. 181 181
Now, I want to give you a quick word of warning. 182 182
CVSS metrics are really, really helpful. 183 183
All of our tools that we use for vulnerability assessment 184 184
do rely on these CVSS metrics, 185 185
but you as an analyst should not rely on them exclusively. 186 186
After all, the whole reason that we have analysts 187 187
is for you to think. 188 188
Your job is not just to look at a number and say, 189 189
"Ah, that's a 9.3. 190 190
That must be critical." 191 191
Because that's not always true. 192 192
For example, as you start looking at some of these things, 193 193
you might go, 194 194
"This is something that affects anybody 195 195
who's connected to the internet." 196 196
And then you look at your system, you go, 197 197
"Oh, I'm talking about a manufacturing plant 198 198
and my manufacturing plant isn't connected to the internet 199 199
so I'm mitigated from that vulnerability." 200 200
So while it might be a 9.3, 201 201
because it's really critical and tied to the internet, 202 202
if your system isn't tied to the internet, 203 203
you need to adjust that down to something more reasonable 204 204
because for you, it might be a low threat. 205 205
So I want you to remember, 206 206
you have to be thinking about these things. 207 207
Don't just blindly accept the numbers. 208 208
They're there to help you. 209 209
They are not the end-all be-all. 210 210
Now, the other thing I want to remind you of 211 211
is that inside of CVSS, there are multiple versions. 212 212
The most current version as of this recording is 3.1, 213 213
and that is what you're going to see on the exam. 214 214
Now, as I mentioned, you can adjust these metrics, 215 215
and one of the easiest ways to do that 216 216
is by using an online calculator, 217 217
such as the one here at first.org/cvss/calculator/3.1. 218 218
If you go in here, you can put in the different metrics 219 219
for each of those areas based on the threats you're seeing, 220 220
and then you can adjust them 221 221
based on your unique circumstance 222 222
and calculate a new CVSS score directly for you. 223 223
Remember, when you look at these tools 224 224
and you look at the National Vulnerability Database, 225 225
they're going to give you the base score 226 226
based on what the manufacturer thinks it is 227 227
as far as how dangerous it is. 228 228
So what they think is a 9.3 in their environment 229 229
may only be a 5.0 in yours, 230 230
or something you think is a 2.3, 231 231
might be a 10.0 in their environment. 232 232
It just depends on the environment you're using. 233 233
So you can use these calculators to modify your scores 234 234
and have yourself a baseline 235 235
that matches your particular environment 236 236
so you can make better decisions.