1 1 00:00:00,020 --> 00:00:01,080 In this lesson, 2 2 00:00:01,080 --> 00:00:02,760 we're going to go through a couple of examples 3 3 00:00:02,760 --> 00:00:05,100 of how to interpret CVSS scores 4 4 00:00:05,100 --> 00:00:06,960 so you can better decide which vulnerabilities 5 5 00:00:06,960 --> 00:00:10,380 need to be remediated first, and that way we can ensure 6 6 00:00:10,380 --> 00:00:12,780 that our systems are the most secure they can be 7 7 00:00:12,780 --> 00:00:15,120 because after all, you're not going to have time, money 8 8 00:00:15,120 --> 00:00:18,390 and resources to patch every single vulnerability you find. 9 9 00:00:18,390 --> 00:00:20,340 And so you have to be able to prioritize these things 10 10 00:00:20,340 --> 00:00:22,380 and decide which one must be done first 11 11 00:00:22,380 --> 00:00:24,930 to protect certain aspects of your system. 12 12 00:00:24,930 --> 00:00:27,300 Let's go ahead and take a look at four different questions 13 13 00:00:27,300 --> 00:00:28,830 to get an idea of what this might look like 14 14 00:00:28,830 --> 00:00:30,180 come exam day. 15 15 00:00:30,180 --> 00:00:31,920 First, let's assume you're working 16 16 00:00:31,920 --> 00:00:34,230 as a cybersecurity analyst at Dion Training. 17 17 00:00:34,230 --> 00:00:36,600 You just received the results of a vulnerability scan 18 18 00:00:36,600 --> 00:00:38,130 that identified four vulnerabilities 19 19 00:00:38,130 --> 00:00:39,870 on the company's web server. 20 20 00:00:39,870 --> 00:00:42,990 These are labeled as vulnerabilities 1, 2, 3, and 4 21 21 00:00:42,990 --> 00:00:45,840 and vulnerability 1 has a base score of 8.1. 22 22 00:00:45,840 --> 00:00:48,660 Vulnerability 2 has a base score of 7.3. 23 23 00:00:48,660 --> 00:00:51,420 Vulnerability 3 has a base score of 4.5 24 24 00:00:51,420 --> 00:00:54,720 and vulnerability 4 has a base score of 5.3. 25 25 00:00:54,720 --> 00:00:56,490 Based on the vulnerabilities listed 26 26 00:00:56,490 --> 00:00:59,790 which of these vulnerabilities should be remediated first? 27 27 00:00:59,790 --> 00:01:01,800 Now this one's a pretty simple question 28 28 00:01:01,800 --> 00:01:03,600 because they're just giving you four vulnerabilities 29 29 00:01:03,600 --> 00:01:06,300 and some base scores and not much else to go with. 30 30 00:01:06,300 --> 00:01:08,550 So, if this is all the information you have 31 31 00:01:08,550 --> 00:01:10,080 you'll simply choose the base score 32 32 00:01:10,080 --> 00:01:13,110 with the highest number, in this case, 8.1. 33 33 00:01:13,110 --> 00:01:14,850 That means that vulnerability 1 will be 34 34 00:01:14,850 --> 00:01:16,890 the vulnerability we need to remediate first 35 35 00:01:16,890 --> 00:01:18,870 and then we would remediate vulnerability 2, 36 36 00:01:18,870 --> 00:01:21,510 vulnerability 4, and then vulnerability 3. 37 37 00:01:21,510 --> 00:01:25,200 Remember, when it comes to CVSS 3.1 base scores, 38 38 00:01:25,200 --> 00:01:28,410 they're going to be categorized from zero to 10.0. 39 39 00:01:28,410 --> 00:01:29,460 If you're at zero 40 40 00:01:29,460 --> 00:01:32,490 this gives you a rating of none as your overall risk. 41 41 00:01:32,490 --> 00:01:35,850 If you're dealing with a score between 0.1 and 3.9 42 42 00:01:35,850 --> 00:01:37,560 this will give you a low rating. 43 43 00:01:37,560 --> 00:01:40,350 If you have 4.0 to 6.9 as your score 44 44 00:01:40,350 --> 00:01:42,330 you'll be using a medium rating. 45 45 00:01:42,330 --> 00:01:45,150 If you have 7.0 to 8.9 as your score 46 46 00:01:45,150 --> 00:01:46,680 you're going to have a high rating. 47 47 00:01:46,680 --> 00:01:49,080 And if you have 9 to 10 as your score 48 48 00:01:49,080 --> 00:01:50,910 you're going to have a critical rating. 49 49 00:01:50,910 --> 00:01:53,220 So once again, vulnerability 1 with a score 50 50 00:01:53,220 --> 00:01:55,980 of 8.1 is considered a high vulnerability 51 51 00:01:55,980 --> 00:01:59,100 and one that we want to remediate as soon as possible. 52 52 00:01:59,100 --> 00:02:01,170 Let's move on to our second question. 53 53 00:02:01,170 --> 00:02:02,730 Again, we're going to pretend you're working 54 54 00:02:02,730 --> 00:02:04,860 as a cybersecurity analyst at Dion Training 55 55 00:02:04,860 --> 00:02:07,320 and you just received the results of a vulnerability scan 56 56 00:02:07,320 --> 00:02:08,880 that identified four vulnerabilities 57 57 00:02:08,880 --> 00:02:10,830 on the company's web server. 58 58 00:02:10,830 --> 00:02:12,960 This time though, we have four vulnerabilities 59 59 00:02:12,960 --> 00:02:15,840 and their vector strings as shown here on the screen. 60 60 00:02:15,840 --> 00:02:17,760 Based on the four vulnerabilities listed 61 61 00:02:17,760 --> 00:02:20,970 which of these vulnerabilities should be remediated first? 62 62 00:02:20,970 --> 00:02:24,090 Vulnerability 1, vulnerability 2, vulnerability 3 63 63 00:02:24,090 --> 00:02:25,890 or vulnerability 4? 64 64 00:02:25,890 --> 00:02:27,990 Well, let's go ahead and break down each of these vector 65 65 00:02:27,990 --> 00:02:30,180 strings for a moment, and then we can make a determination 66 66 00:02:30,180 --> 00:02:32,400 of which one we should remediate first. 67 67 00:02:32,400 --> 00:02:34,470 Now, since we don't have the base scores, we can't rely 68 68 00:02:34,470 --> 00:02:36,780 on those solely, and even if we did, we don't always 69 69 00:02:36,780 --> 00:02:39,660 want to rely on the highest base score because sometimes 70 70 00:02:39,660 --> 00:02:41,670 there's other factors that we have to consider, 71 71 00:02:41,670 --> 00:02:43,800 such as can a standard user or an administrative user 72 72 00:02:43,800 --> 00:02:47,160 cause that issue or is a confidentiality, integrity 73 73 00:02:47,160 --> 00:02:48,570 and availability being affected 74 74 00:02:48,570 --> 00:02:50,310 by that particular vulnerability? 75 75 00:02:50,310 --> 00:02:52,800 So it's important to be able to read these vector strings 76 76 00:02:52,800 --> 00:02:54,960 to understand exactly what they're telling you. 77 77 00:02:54,960 --> 00:02:56,610 Let's take a look at each of these. 78 78 00:02:56,610 --> 00:02:58,890 Vulnerability 1, since it's exploitable through 79 79 00:02:58,890 --> 00:03:00,180 An an adjacent network 80 80 00:03:00,180 --> 00:03:03,360 it has a high attack complexity, requires user intervention, 81 81 00:03:03,360 --> 00:03:06,900 has no impact on confidentiality, has no impact on integrity 82 82 00:03:06,900 --> 00:03:09,750 but it does have a high impact on availability. 83 83 00:03:09,750 --> 00:03:11,430 If we move on to vulnerability 2, 84 84 00:03:11,430 --> 00:03:14,460 we can see that this vulnerability is exploitable remotely 85 85 00:03:14,460 --> 00:03:16,140 and you can see that under access vector 86 86 00:03:16,140 --> 00:03:19,680 being network based, it also has a low attack complexity 87 87 00:03:19,680 --> 00:03:21,510 no user interaction is required. 88 88 00:03:21,510 --> 00:03:23,580 It has a low impact on confidentiality, 89 89 00:03:23,580 --> 00:03:27,120 a low impact on integrity, and a low impact on availability. 90 90 00:03:27,120 --> 00:03:29,100 Now, this vulnerability is actually more severe 91 91 00:03:29,100 --> 00:03:30,510 than vulnerability 1 92 92 00:03:30,510 --> 00:03:32,190 because there's a low attack complexity 93 93 00:03:32,190 --> 00:03:34,530 and it's exploitable remotely, which makes this 94 94 00:03:34,530 --> 00:03:36,960 a pretty big vulnerability that we need to look at. 95 95 00:03:36,960 --> 00:03:39,210 Because of these factors it's actually more serious 96 96 00:03:39,210 --> 00:03:40,470 than vulnerability 1. 97 97 00:03:40,470 --> 00:03:42,510 So right now, this is the most serious vulnerability 98 98 00:03:42,510 --> 00:03:43,590 we've looked at. 99 99 00:03:43,590 --> 00:03:45,240 Let's go ahead and look at vulnerability 3 100 100 00:03:45,240 --> 00:03:48,030 and see if it's more or less severe than vulnerability 2 101 101 00:03:48,030 --> 00:03:49,920 which is currently our most severe. 102 102 00:03:49,920 --> 00:03:52,830 Vulnerability 3 says that it can be exploited remotely. 103 103 00:03:52,830 --> 00:03:54,600 It has a high attack complexity 104 104 00:03:54,600 --> 00:03:56,790 it has no user interaction that's required 105 105 00:03:56,790 --> 00:03:59,820 and it has a high impact on confidentiality, a high impact 106 106 00:03:59,820 --> 00:04:02,610 on integrity, and a high impact on availability. 107 107 00:04:02,610 --> 00:04:05,400 So based on looking at the CIA triad 108 108 00:04:05,400 --> 00:04:07,860 we can see that vulnerability 3 is more severe 109 109 00:04:07,860 --> 00:04:09,390 than vulnerability 2. 110 110 00:04:09,390 --> 00:04:12,090 In addition to that, it is still exploitable remotely 111 111 00:04:12,090 --> 00:04:13,500 and really the only thing that makes 112 112 00:04:13,500 --> 00:04:15,000 vulnerability 2 a little bit easier 113 113 00:04:15,000 --> 00:04:17,040 is that it has a low attack complexity, 114 114 00:04:17,040 --> 00:04:20,280 but because of the severity going from lows to highs 115 115 00:04:20,280 --> 00:04:23,130 in the CIA triad we are going to say that vulnerability 3 116 116 00:04:23,130 --> 00:04:26,340 is more severe and therefore that's right now our leader 117 117 00:04:26,340 --> 00:04:28,980 as far as which one do we want to remediate first. 118 118 00:04:28,980 --> 00:04:31,830 Our final one we're going to look at is vulnerability 4. 119 119 00:04:31,830 --> 00:04:34,530 This vulnerability is exploitable locally. 120 120 00:04:34,530 --> 00:04:36,150 It has a low attack complexity. 121 121 00:04:36,150 --> 00:04:38,790 It does require privileged access to run that exploit. 122 122 00:04:38,790 --> 00:04:41,010 It has no user interaction being required 123 123 00:04:41,010 --> 00:04:43,350 and it has a low impact on confidentiality, 124 124 00:04:43,350 --> 00:04:45,300 integrity and availability. 125 125 00:04:45,300 --> 00:04:47,610 So here again, we have another vulnerability 126 126 00:04:47,610 --> 00:04:50,130 that has a low impact on the CIA triad. 127 127 00:04:50,130 --> 00:04:53,130 Therefore, vulnerability 3 is going to be our first priority 128 128 00:04:53,130 --> 00:04:55,290 for remediation and makes it the correct answer 129 129 00:04:55,290 --> 00:04:56,490 to this question. 130 130 00:04:56,490 --> 00:04:58,290 Let's move on to our third question. 131 131 00:04:58,290 --> 00:05:00,210 Again, we're going to assume you're a cybersecurity 132 132 00:05:00,210 --> 00:05:02,190 analyst working here at Dion Training. 133 133 00:05:02,190 --> 00:05:04,440 You just received the results of a vulnerability scan 134 134 00:05:04,440 --> 00:05:05,910 that identified four vulnerabilities 135 135 00:05:05,910 --> 00:05:07,980 on your company's database server. 136 136 00:05:07,980 --> 00:05:10,320 Here on the screen, you can see those four vulnerabilities 137 137 00:05:10,320 --> 00:05:12,090 and their vector strings. 138 138 00:05:12,090 --> 00:05:13,590 Based on these vulnerabilities, 139 139 00:05:13,590 --> 00:05:16,380 which of these vulnerabilities should be remediated first 140 140 00:05:16,380 --> 00:05:17,910 in order to best mitigate the threat 141 141 00:05:17,910 --> 00:05:20,310 to the database servers confidentiality? 142 142 00:05:20,310 --> 00:05:22,230 Now, this question is a little bit different 143 143 00:05:22,230 --> 00:05:24,360 because we're not focused on the overall risk 144 144 00:05:24,360 --> 00:05:26,700 of any of these vulnerabilities, and instead 145 145 00:05:26,700 --> 00:05:29,580 we are really focused just on the confidentiality. 146 146 00:05:29,580 --> 00:05:31,950 So as we start going through these vector strings, 147 147 00:05:31,950 --> 00:05:34,530 we want to look for the third key pair from the right 148 148 00:05:34,530 --> 00:05:37,080 which is the C colon and something. 149 149 00:05:37,080 --> 00:05:39,420 If it says N, that means there's no impact. 150 150 00:05:39,420 --> 00:05:41,370 If it's L, it means it's a low impact, 151 151 00:05:41,370 --> 00:05:43,620 and if it's H it means it's a high impact. 152 152 00:05:43,620 --> 00:05:46,260 So the easiest way to answer this question is simply look 153 153 00:05:46,260 --> 00:05:47,670 at that column with C 154 154 00:05:47,670 --> 00:05:49,800 and you can see that vulnerability 1 has no impact 155 155 00:05:49,800 --> 00:05:50,940 to confidentiality. 156 156 00:05:50,940 --> 00:05:53,940 Vulnerability 2 has a high impact to confidentiality. 157 157 00:05:53,940 --> 00:05:56,760 Vulnerability 3 has no impact to confidentiality 158 158 00:05:56,760 --> 00:05:59,850 and vulnerability 4 has no impact to confidentiality. 159 159 00:05:59,850 --> 00:06:02,310 Therefore, the one that we need to remediate first 160 160 00:06:02,310 --> 00:06:05,370 in terms of confidentiality would be vulnerability 2 161 161 00:06:05,370 --> 00:06:07,620 because it is the biggest threat to confidentiality 162 162 00:06:07,620 --> 00:06:09,420 of these four vulnerabilities. 163 163 00:06:09,420 --> 00:06:11,640 Now, if I asked which one was for availability 164 164 00:06:11,640 --> 00:06:13,890 the answer to that would be vulnerability 3. 165 165 00:06:13,890 --> 00:06:15,810 If I asked about the threats to integrity 166 166 00:06:15,810 --> 00:06:17,700 that would be vulnerability 4. 167 167 00:06:17,700 --> 00:06:19,590 And if I asked for the biggest overall threat 168 168 00:06:19,590 --> 00:06:21,270 that would be vulnerability 1. 169 169 00:06:21,270 --> 00:06:23,250 And so you can see how this same set of strings 170 170 00:06:23,250 --> 00:06:24,600 for these four vulnerabilities 171 171 00:06:24,600 --> 00:06:26,100 could have different prioritization 172 172 00:06:26,100 --> 00:06:28,320 based on your organization and its needs. 173 173 00:06:28,320 --> 00:06:29,820 If you're focused on confidentiality 174 174 00:06:29,820 --> 00:06:31,050 like we are in this question 175 175 00:06:31,050 --> 00:06:33,090 the right answer here is vulnerability 2. 176 176 00:06:33,090 --> 00:06:35,220 But if you're looking at the biggest overall threat 177 177 00:06:35,220 --> 00:06:36,690 then it would be vulnerability 1. 178 178 00:06:36,690 --> 00:06:38,670 Or if you want the biggest threat to availability 179 179 00:06:38,670 --> 00:06:39,900 it's vulnerability 3. 180 180 00:06:39,900 --> 00:06:42,270 And the biggest threat to integrity is vulnerability 4. 181 181 00:06:42,270 --> 00:06:44,220 And that's why it's important not just to rely 182 182 00:06:44,220 --> 00:06:45,360 on a base score 183 183 00:06:45,360 --> 00:06:47,940 because the base score tells you the biggest overall threat 184 184 00:06:47,940 --> 00:06:49,560 but it doesn't tell you the threat specific 185 185 00:06:49,560 --> 00:06:51,930 to your organization and what you care about. 186 186 00:06:51,930 --> 00:06:54,300 Let's move on to our fourth and final question. 187 187 00:06:54,300 --> 00:06:56,460 Here again, we are a cybersecurity analyst working 188 188 00:06:56,460 --> 00:06:57,570 at Dion Training. 189 189 00:06:57,570 --> 00:06:58,500 We received the results 190 190 00:06:58,500 --> 00:07:00,540 of our vulnerability scan that identified four 191 191 00:07:00,540 --> 00:07:03,180 vulnerabilities on the company's email server. 192 192 00:07:03,180 --> 00:07:05,100 And again, you see the four vulnerabilities 193 193 00:07:05,100 --> 00:07:06,750 and their vector strings. 194 194 00:07:06,750 --> 00:07:08,430 Based on the vulnerabilities shown 195 195 00:07:08,430 --> 00:07:10,980 which of these vulnerabilities should be remediated first 196 196 00:07:10,980 --> 00:07:13,170 in order to best mitigate the threats to the email server's 197 197 00:07:13,170 --> 00:07:16,140 confidentiality, integrity, and availability. 198 198 00:07:16,140 --> 00:07:18,720 So in this case, we're not looking for an overall threat 199 199 00:07:18,720 --> 00:07:21,090 but we are focused on the last three key pairs 200 200 00:07:21,090 --> 00:07:24,150 inside that vector string, which is CINA 201 201 00:07:24,150 --> 00:07:27,030 or confidentiality, integrity and availability. 202 202 00:07:27,030 --> 00:07:30,060 So as I look through these from vulnerability 1, 2, 3, 203 203 00:07:30,060 --> 00:07:34,140 and 4, I can see that vulnerability 1 has low, low, low. 204 204 00:07:34,140 --> 00:07:35,520 If I look at vulnerability 2, 205 205 00:07:35,520 --> 00:07:37,590 I have no impact, no impact high. 206 206 00:07:37,590 --> 00:07:40,650 If I look at vulnerability 3, I have high, high, high. 207 207 00:07:40,650 --> 00:07:44,010 If I look at vulnerability 4, I have low, low and no impact. 208 208 00:07:44,010 --> 00:07:46,020 So which one is going to be the biggest threat 209 209 00:07:46,020 --> 00:07:47,610 to the confidentiality, integrity 210 210 00:07:47,610 --> 00:07:49,350 and availability of my system? 211 211 00:07:49,350 --> 00:07:51,930 Well, obviously it's going to be vulnerability number 3 212 212 00:07:51,930 --> 00:07:54,810 because it is high, high high for confidentiality, 213 213 00:07:54,810 --> 00:07:57,179 integrity, and availability. 214 214 00:07:57,179 --> 00:07:58,740 Now, if I wanted to take this a step further 215 215 00:07:58,740 --> 00:08:00,750 we could actually change this question a little bit 216 216 00:08:00,750 --> 00:08:02,850 and say instead of which one is the first one 217 217 00:08:02,850 --> 00:08:05,400 we want to remediate we might say, what is the order 218 218 00:08:05,400 --> 00:08:07,800 we would want to remediate all four of these based 219 219 00:08:07,800 --> 00:08:10,980 on the confidentiality, integrity and availability threats. 220 220 00:08:10,980 --> 00:08:13,050 In this case, vulnerability 3 would still 221 221 00:08:13,050 --> 00:08:15,390 be remediated first because it has a high impact 222 222 00:08:15,390 --> 00:08:18,330 to confidentiality, integrity, and availability. 223 223 00:08:18,330 --> 00:08:19,320 The second vulnerability 224 224 00:08:19,320 --> 00:08:21,780 that we would be looking at is vulnerability 1, 225 225 00:08:21,780 --> 00:08:24,510 because there's a low impact across all three categories 226 226 00:08:24,510 --> 00:08:27,690 of confidentiality, integrity, and availability. 227 227 00:08:27,690 --> 00:08:30,180 Next, we would remediate vulnerability number 2 228 228 00:08:30,180 --> 00:08:32,790 because it has no impact to confidentiality and integrity 229 229 00:08:32,790 --> 00:08:35,280 but it does have a high impact to availability. 230 230 00:08:35,280 --> 00:08:36,120 And then finally, 231 231 00:08:36,120 --> 00:08:38,310 we would remediate vulnerability number 4 232 232 00:08:38,310 --> 00:08:41,340 because this one has low impact to confidentiality, 233 233 00:08:41,340 --> 00:08:44,700 low impact to integrity, and no impact to availability. 234 234 00:08:44,700 --> 00:08:46,440 So as we look at this 235 235 00:08:46,440 --> 00:08:49,050 having all three highs is going to be first, 236 236 00:08:49,050 --> 00:08:52,410 all three lows is going to be second, and then having a high 237 237 00:08:52,410 --> 00:08:54,540 in any one category is going to be third 238 238 00:08:54,540 --> 00:08:56,910 and then having two lows and no impact on the third 239 239 00:08:56,910 --> 00:08:58,140 is going to be fourth 240 240 00:08:58,140 --> 00:08:59,790 which gives us the correct remediation order 241 241 00:08:59,790 --> 00:09:02,010 of vulnerability 3 being first, 242 242 00:09:02,010 --> 00:09:05,100 vulnerability 1 being second, vulnerability 2 being third 243 243 00:09:05,100 --> 00:09:07,800 and vulnerability 4 being fourth. 244 244 00:09:07,800 --> 00:09:09,900 So as you can see, there are lots of different ways 245 245 00:09:09,900 --> 00:09:11,670 to attack these types of questions 246 246 00:09:11,670 --> 00:09:13,200 and it's really important to take the time 247 247 00:09:13,200 --> 00:09:15,690 to understand what the question is asking you. 248 248 00:09:15,690 --> 00:09:17,820 Are they asking for an overall threat? 249 249 00:09:17,820 --> 00:09:19,770 Are they asking for a threat to a specific area 250 250 00:09:19,770 --> 00:09:22,770 like confidentiality, integrity, or availability? 251 251 00:09:22,770 --> 00:09:25,170 Are they asking you which of these vulnerabilities 252 252 00:09:25,170 --> 00:09:28,170 requires high complexity or low complexity, 253 253 00:09:28,170 --> 00:09:30,060 or which of these requires user interaction 254 254 00:09:30,060 --> 00:09:31,320 and which ones don't? 255 255 00:09:31,320 --> 00:09:32,911 All of these would be fair questions for you 256 256 00:09:32,911 --> 00:09:34,140 to be able to parse the information 257 257 00:09:34,140 --> 00:09:36,060 from a vector string to be able to understand 258 258 00:09:36,060 --> 00:09:38,070 which vulnerabilities are most dangerous 259 259 00:09:38,070 --> 00:09:39,720 and which ones are least dangerous 260 260 00:09:39,720 --> 00:09:41,973 to us based on these vector strings provided.