1 1 00:00:00,240 --> 00:00:01,740 CVSS, 2 2 00:00:01,740 --> 00:00:04,620 or the Common Vulnerability Scoring System. 3 3 00:00:04,620 --> 00:00:06,510 We very briefly touched upon this 4 4 00:00:06,510 --> 00:00:08,760 when I started talking about the NVD, 5 5 00:00:08,760 --> 00:00:10,440 the National Vulnerability Database, 6 6 00:00:10,440 --> 00:00:11,460 because I mentioned 7 7 00:00:11,460 --> 00:00:15,270 that this includes information including the CVSS score. 8 8 00:00:15,270 --> 00:00:16,103 In this lesson, 9 9 00:00:16,103 --> 00:00:18,840 we're going to break down exactly what is that score. 10 10 00:00:18,840 --> 00:00:19,920 Well, first, let's talk 11 11 00:00:19,920 --> 00:00:23,430 about the Common Vulnerability Scoring System, or CVSS. 12 12 00:00:23,430 --> 00:00:25,110 This is a risk management approach 13 13 00:00:25,110 --> 00:00:27,270 to quantifying vulnerability data, 14 14 00:00:27,270 --> 00:00:29,189 and then taking into account the degree of risk 15 15 00:00:29,189 --> 00:00:32,130 to different types of systems or information. 16 16 00:00:32,130 --> 00:00:34,077 Essentially, it's going to allow us to put a number 17 17 00:00:34,077 --> 00:00:35,370 against something. 18 18 00:00:35,370 --> 00:00:36,217 So instead of just saying, 19 19 00:00:36,217 --> 00:00:38,700 "This is a low risk or this is a high risk," 20 20 00:00:38,700 --> 00:00:41,370 I can actually quantifiably measure it. 21 21 00:00:41,370 --> 00:00:43,470 Now, CVSS can be useful 22 22 00:00:43,470 --> 00:00:45,270 in prioritizing your response actions 23 23 00:00:45,270 --> 00:00:49,110 because if I have something that has a 9.3 versus a 10, 24 24 00:00:49,110 --> 00:00:51,030 I should probably fix the 10 first, 25 25 00:00:51,030 --> 00:00:53,580 or so you would think because it's a higher number, right? 26 26 00:00:53,580 --> 00:00:56,460 That's the basis of using a CVSS score. 27 27 00:00:56,460 --> 00:00:58,230 But for you to really be able to use these, 28 28 00:00:58,230 --> 00:01:00,270 you have to understand what they mean, 29 29 00:01:00,270 --> 00:01:02,100 and that's why we're going to break these things apart 30 30 00:01:02,100 --> 00:01:03,360 in this lesson. 31 31 00:01:03,360 --> 00:01:05,280 Now, at their most simple form, 32 32 00:01:05,280 --> 00:01:08,430 a CVSS score is a number with a description. 33 33 00:01:08,430 --> 00:01:11,190 If I have a score of zero, that means none, 34 34 00:01:11,190 --> 00:01:12,090 there is no risk. 35 35 00:01:12,090 --> 00:01:13,920 It's not a very threatening thing. 36 36 00:01:13,920 --> 00:01:17,100 If I have a number that's between 0.1 and 3.9, 37 37 00:01:17,100 --> 00:01:19,200 this is considered a low threat. 38 38 00:01:19,200 --> 00:01:21,053 If I'm dealing with something between 4.0 and 6.9, 39 39 00:01:22,440 --> 00:01:24,000 this is a medium threat. 40 40 00:01:24,000 --> 00:01:27,987 If I'm dealing with 7.0 to 8.9, this is a high threat. 41 41 00:01:27,987 --> 00:01:30,200 And if I'm dealing with a 9.0 to 10.0, 42 42 00:01:31,200 --> 00:01:33,180 this would be a critical threat. 43 43 00:01:33,180 --> 00:01:35,884 Now, these numbers are baseline numbers. 44 44 00:01:35,884 --> 00:01:37,350 You're going to be able to adjust these 45 45 00:01:37,350 --> 00:01:38,940 based on your own circumstances 46 46 00:01:38,940 --> 00:01:40,530 and your own mitigations as well. 47 47 00:01:40,530 --> 00:01:42,840 For this reason, it's really important that you look 48 48 00:01:42,840 --> 00:01:45,090 at how these numbers are constructed. 49 49 00:01:45,090 --> 00:01:47,310 Now, coming directly from the NVD website, 50 50 00:01:47,310 --> 00:01:48,780 you can see this graphic. 51 51 00:01:48,780 --> 00:01:51,030 We have three things that actually are added 52 52 00:01:51,030 --> 00:01:53,370 into making up that CVSS score. 53 53 00:01:53,370 --> 00:01:55,650 First, we start with a base metric. 54 54 00:01:55,650 --> 00:01:58,650 This includes things like the exploit or the impact, 55 55 00:01:58,650 --> 00:02:01,080 and then we take that and we can actually feed that in 56 56 00:02:01,080 --> 00:02:03,403 to some optional metrics, including Temporal metrics 57 57 00:02:03,403 --> 00:02:05,160 and Environmental metrics. 58 58 00:02:05,160 --> 00:02:06,140 And all of those combined 59 59 00:02:06,140 --> 00:02:08,880 will give you this final CVSS score. 60 60 00:02:08,880 --> 00:02:10,620 Now, what we're going to do in the rest of this lesson 61 61 00:02:10,620 --> 00:02:13,950 is break down all the components of these base metrics 62 62 00:02:13,950 --> 00:02:15,628 because that is really where the bulk of this score 63 63 00:02:15,628 --> 00:02:16,890 is going to come from, 64 64 00:02:16,890 --> 00:02:18,960 and it's really important for you to understand it. 65 65 00:02:18,960 --> 00:02:20,760 Now, when I talk about base metrics, 66 66 00:02:20,760 --> 00:02:23,640 these are comprised of things like the access vector, 67 67 00:02:23,640 --> 00:02:26,520 the access complexity, the privileges required, 68 68 00:02:26,520 --> 00:02:28,500 the user interaction, the scope, 69 69 00:02:28,500 --> 00:02:31,560 the confidentiality, integrity, and availability, 70 70 00:02:31,560 --> 00:02:32,850 and if they're being modified 71 71 00:02:32,850 --> 00:02:35,460 by this particular exploit or vulnerability. 72 72 00:02:35,460 --> 00:02:36,480 Now, in addition to that, 73 73 00:02:36,480 --> 00:02:38,730 we have to start looking at each of these individually. 74 74 00:02:38,730 --> 00:02:41,070 As we start looking at the access vector, 75 75 00:02:41,070 --> 00:02:42,060 this is going to tell us, 76 76 00:02:42,060 --> 00:02:44,700 does the attacker need to have physical access, 77 77 00:02:44,700 --> 00:02:47,160 local access, adjacent network access, 78 78 00:02:47,160 --> 00:02:48,480 or network access? 79 79 00:02:48,480 --> 00:02:49,980 If they need physical access, 80 80 00:02:49,980 --> 00:02:51,900 it's probably less of a threat to you 81 81 00:02:51,900 --> 00:02:53,280 than if they need network access, 82 82 00:02:53,280 --> 00:02:55,710 which means they can get to you over the internet. 83 83 00:02:55,710 --> 00:02:57,960 And so again, depending on the access vector, 84 84 00:02:57,960 --> 00:03:00,420 this is going to be either more or less dangerous to us, 85 85 00:03:00,420 --> 00:03:02,460 and so that's going to affect our score. 86 86 00:03:02,460 --> 00:03:04,650 Then we have to consider our access complexity. 87 87 00:03:04,650 --> 00:03:07,530 Is this a high complexity or a low complexity? 88 88 00:03:07,530 --> 00:03:09,750 If this is a high complexity exploit, 89 89 00:03:09,750 --> 00:03:11,730 that means it's going to be less of a threat 90 90 00:03:11,730 --> 00:03:14,190 because less people will be able to do it. 91 91 00:03:14,190 --> 00:03:16,080 If it has a low complexity to that exploit, 92 92 00:03:16,080 --> 00:03:17,849 it's going to be more dangerous to us, right? 93 93 00:03:17,849 --> 00:03:19,770 Because more people will be able to do it. 94 94 00:03:19,770 --> 00:03:21,480 It's easier for an attacker to use. 95 95 00:03:21,480 --> 00:03:23,520 And so complexity is important as well, 96 96 00:03:23,520 --> 00:03:25,470 and this will affect our number. 97 97 00:03:25,470 --> 00:03:27,720 Then we have to consider the privileges required. 98 98 00:03:27,720 --> 00:03:30,180 Can they run this exploit with no privileges, 99 99 00:03:30,180 --> 00:03:32,340 low privileges, or high privileges? 100 100 00:03:32,340 --> 00:03:34,980 Again, no privileges or low privileges 101 101 00:03:34,980 --> 00:03:37,560 are going to be more dangerous than high privileges. 102 102 00:03:37,560 --> 00:03:38,640 The reason for this is 103 103 00:03:38,640 --> 00:03:40,050 if you could do it with no privileges, 104 104 00:03:40,050 --> 00:03:41,262 that means you don't have to log in. 105 105 00:03:41,262 --> 00:03:42,870 If you do it with low privileges, 106 106 00:03:42,870 --> 00:03:44,820 that means a standard user or a guest user 107 107 00:03:44,820 --> 00:03:46,020 could do this exploit. 108 108 00:03:46,020 --> 00:03:47,280 And if you're doing it with high privileges, 109 109 00:03:47,280 --> 00:03:48,990 that means they need something like administrative 110 110 00:03:48,990 --> 00:03:51,630 or a service account to be able to run this exploit. 111 111 00:03:51,630 --> 00:03:54,180 And so again, this is going to affect our base score. 112 112 00:03:54,180 --> 00:03:56,610 The next one we're going to look at is user interaction. 113 113 00:03:56,610 --> 00:03:59,220 Are we going to have none or required? 114 114 00:03:59,220 --> 00:04:00,743 Now, again, this is going to make things 115 115 00:04:00,743 --> 00:04:02,910 either more or less dangerous. 116 116 00:04:02,910 --> 00:04:04,500 If there is no user interaction required, 117 117 00:04:04,500 --> 00:04:06,165 that means that the exploit can run 118 118 00:04:06,165 --> 00:04:08,310 without the user doing anything. 119 119 00:04:08,310 --> 00:04:09,840 If the user interaction is required, 120 120 00:04:09,840 --> 00:04:11,940 that means the user has to run the program 121 121 00:04:11,940 --> 00:04:13,230 or launch the exploit, 122 122 00:04:13,230 --> 00:04:14,063 and so you're going to have to use 123 123 00:04:14,063 --> 00:04:15,510 some kind of a social engineering component 124 124 00:04:15,510 --> 00:04:17,070 to trick the user into doing that, 125 125 00:04:17,070 --> 00:04:19,200 making it more of a complex attack. 126 126 00:04:19,200 --> 00:04:21,119 So again, it becomes more or less risky 127 127 00:04:21,119 --> 00:04:25,050 based on if you need no interaction or required interaction. 128 128 00:04:25,050 --> 00:04:27,030 The next category is scope. 129 129 00:04:27,030 --> 00:04:29,850 The scope can either be unchanged or changed. 130 130 00:04:29,850 --> 00:04:31,200 Now, when I talk about this, 131 131 00:04:31,200 --> 00:04:32,520 this is referring to whether or not 132 132 00:04:32,520 --> 00:04:35,670 the exploit affects only the local security context, 133 133 00:04:35,670 --> 00:04:39,420 meaning unchanged, or the entire security context, 134 134 00:04:39,420 --> 00:04:41,100 which means it would be changed. 135 135 00:04:41,100 --> 00:04:44,280 So change is more of risk for us than unchanged 136 136 00:04:44,280 --> 00:04:45,780 in this case. 137 137 00:04:45,780 --> 00:04:48,360 The next one we have is confidentiality. 138 138 00:04:48,360 --> 00:04:50,430 Now, as we start looking at these, 139 139 00:04:50,430 --> 00:04:52,560 if somebody's able to run this exploit, 140 140 00:04:52,560 --> 00:04:54,450 there are different measures that have impact 141 141 00:04:54,450 --> 00:04:55,740 to the CIA triad, 142 142 00:04:55,740 --> 00:04:58,260 confidentiality, integrity, and availability. 143 143 00:04:58,260 --> 00:04:59,790 And so if I run this exploit, 144 144 00:04:59,790 --> 00:05:01,710 am I affecting confidentiality? 145 145 00:05:01,710 --> 00:05:03,270 Am I affecting integrity? 146 146 00:05:03,270 --> 00:05:05,220 Am I affecting availability? 147 147 00:05:05,220 --> 00:05:06,053 And for each of these, 148 148 00:05:06,053 --> 00:05:08,370 we're going to be looking at high, medium, and low. 149 149 00:05:08,370 --> 00:05:12,360 So, if this exploit has a high change to confidentiality, 150 150 00:05:12,360 --> 00:05:13,500 that's more risky for us 151 151 00:05:13,500 --> 00:05:16,050 than something that has a low change to confidentiality. 152 152 00:05:16,050 --> 00:05:17,970 The same thing when we talk about integrity, 153 153 00:05:17,970 --> 00:05:19,230 high, medium, and low, 154 154 00:05:19,230 --> 00:05:21,300 how much is being changed or altered? 155 155 00:05:21,300 --> 00:05:23,910 And then availability, high, medium, and low. 156 156 00:05:23,910 --> 00:05:25,710 And so we take all of these components, 157 157 00:05:25,710 --> 00:05:29,310 we add them together, and that gives us our base metric. 158 158 00:05:29,310 --> 00:05:31,530 Now, in addition to that base metric, though, 159 159 00:05:31,530 --> 00:05:34,260 we can then feed that into this optional metrics, 160 160 00:05:34,260 --> 00:05:36,750 which include Temporal and Environmental. 161 161 00:05:36,750 --> 00:05:38,460 Now, when I talk about Temporal metrics, 162 162 00:05:38,460 --> 00:05:41,340 these are composed of things like Exploit Code Maturity, 163 163 00:05:41,340 --> 00:05:43,890 Remediation Level, and Report Confidence. 164 164 00:05:43,890 --> 00:05:45,600 All of these have to do with time. 165 165 00:05:45,600 --> 00:05:47,040 How timely is this information? 166 166 00:05:47,040 --> 00:05:48,810 How much do I trust it? 167 167 00:05:48,810 --> 00:05:50,490 How long has this exploit been available? 168 168 00:05:50,490 --> 00:05:52,530 And how many versions of this exploit exist? 169 169 00:05:52,530 --> 00:05:53,970 Because that would mean it's more mature 170 170 00:05:53,970 --> 00:05:56,250 and harder for us to detect necessarily. 171 171 00:05:56,250 --> 00:05:57,330 The next one we want to talk about 172 172 00:05:57,330 --> 00:05:58,710 is the Environmental metrics, 173 173 00:05:58,710 --> 00:06:02,220 and these are composed of modifying those base metrics. 174 174 00:06:02,220 --> 00:06:03,930 So we're still going to be looking back 175 175 00:06:03,930 --> 00:06:05,760 into things like your access vectors. 176 176 00:06:05,760 --> 00:06:06,593 We're going to be looking 177 177 00:06:06,593 --> 00:06:09,330 into things like integrity and confidentiality. 178 178 00:06:09,330 --> 00:06:11,490 And based on the environment you're dealing with, 179 179 00:06:11,490 --> 00:06:13,620 you can then modify the base score 180 180 00:06:13,620 --> 00:06:16,230 to make it more or less threatening. 181 181 00:06:16,230 --> 00:06:18,870 Now, I want to give you a quick word of warning. 182 182 00:06:18,870 --> 00:06:22,110 CVSS metrics are really, really helpful. 183 183 00:06:22,110 --> 00:06:24,750 All of our tools that we use for vulnerability assessment 184 184 00:06:24,750 --> 00:06:26,940 do rely on these CVSS metrics, 185 185 00:06:26,940 --> 00:06:30,780 but you as an analyst should not rely on them exclusively. 186 186 00:06:30,780 --> 00:06:33,630 After all, the whole reason that we have analysts 187 187 00:06:33,630 --> 00:06:35,220 is for you to think. 188 188 00:06:35,220 --> 00:06:37,237 Your job is not just to look at a number and say, 189 189 00:06:37,237 --> 00:06:38,790 "Ah, that's a 9.3. 190 190 00:06:38,790 --> 00:06:40,140 That must be critical." 191 191 00:06:40,140 --> 00:06:42,060 Because that's not always true. 192 192 00:06:42,060 --> 00:06:44,730 For example, as you start looking at some of these things, 193 193 00:06:44,730 --> 00:06:45,727 you might go, 194 194 00:06:45,727 --> 00:06:47,460 "This is something that affects anybody 195 195 00:06:47,460 --> 00:06:48,840 who's connected to the internet." 196 196 00:06:48,840 --> 00:06:49,957 And then you look at your system, you go, 197 197 00:06:49,957 --> 00:06:52,320 "Oh, I'm talking about a manufacturing plant 198 198 00:06:52,320 --> 00:06:54,810 and my manufacturing plant isn't connected to the internet 199 199 00:06:54,810 --> 00:06:57,060 so I'm mitigated from that vulnerability." 200 200 00:06:57,060 --> 00:06:58,963 So while it might be a 9.3, 201 201 00:06:58,963 --> 00:07:01,800 because it's really critical and tied to the internet, 202 202 00:07:01,800 --> 00:07:03,363 if your system isn't tied to the internet, 203 203 00:07:03,363 --> 00:07:06,000 you need to adjust that down to something more reasonable 204 204 00:07:06,000 --> 00:07:08,190 because for you, it might be a low threat. 205 205 00:07:08,190 --> 00:07:09,120 So I want you to remember, 206 206 00:07:09,120 --> 00:07:11,190 you have to be thinking about these things. 207 207 00:07:11,190 --> 00:07:12,804 Don't just blindly accept the numbers. 208 208 00:07:12,804 --> 00:07:14,250 They're there to help you. 209 209 00:07:14,250 --> 00:07:16,590 They are not the end-all be-all. 210 210 00:07:16,590 --> 00:07:18,210 Now, the other thing I want to remind you of 211 211 00:07:18,210 --> 00:07:21,480 is that inside of CVSS, there are multiple versions. 212 212 00:07:21,480 --> 00:07:24,660 The most current version as of this recording is 3.1, 213 213 00:07:24,660 --> 00:07:27,330 and that is what you're going to see on the exam. 214 214 00:07:27,330 --> 00:07:30,540 Now, as I mentioned, you can adjust these metrics, 215 215 00:07:30,540 --> 00:07:32,100 and one of the easiest ways to do that 216 216 00:07:32,100 --> 00:07:33,990 is by using an online calculator, 217 217 00:07:33,990 --> 00:07:38,990 such as the one here at first.org/cvss/calculator/3.1. 218 218 00:07:40,170 --> 00:07:43,140 If you go in here, you can put in the different metrics 219 219 00:07:43,140 --> 00:07:46,350 for each of those areas based on the threats you're seeing, 220 220 00:07:46,350 --> 00:07:47,880 and then you can adjust them 221 221 00:07:47,880 --> 00:07:49,530 based on your unique circumstance 222 222 00:07:49,530 --> 00:07:53,430 and calculate a new CVSS score directly for you. 223 223 00:07:53,430 --> 00:07:55,110 Remember, when you look at these tools 224 224 00:07:55,110 --> 00:07:57,750 and you look at the National Vulnerability Database, 225 225 00:07:57,750 --> 00:07:59,520 they're going to give you the base score 226 226 00:07:59,520 --> 00:08:01,740 based on what the manufacturer thinks it is 227 227 00:08:01,740 --> 00:08:03,600 as far as how dangerous it is. 228 228 00:08:03,600 --> 00:08:06,240 So what they think is a 9.3 in their environment 229 229 00:08:06,240 --> 00:08:08,190 may only be a 5.0 in yours, 230 230 00:08:08,190 --> 00:08:10,020 or something you think is a 2.3, 231 231 00:08:10,020 --> 00:08:12,060 might be a 10.0 in their environment. 232 232 00:08:12,060 --> 00:08:13,860 It just depends on the environment you're using. 233 233 00:08:13,860 --> 00:08:16,440 So you can use these calculators to modify your scores 234 234 00:08:16,440 --> 00:08:17,790 and have yourself a baseline 235 235 00:08:17,790 --> 00:08:19,950 that matches your particular environment 236 236 00:08:19,950 --> 00:08:21,600 so you can make better decisions.