Instructor: In this lesson, 2 2
we're going to go through a couple of examples 3 3
of how to interpret CVSS scores 4 4
so you can better decide which vulnerabilities 5 5
need to be remediated first, and that way we can ensure 6 6
that our systems are the most secure they can be 7 7
because after all, you're not going to have time, money 8 8
and resources to patch every single vulnerability you find. 9 9
And so you have to be able to prioritize these things 10 10
and decide which one must be done first 11 11
to protect certain aspects of your system. 12 12
Let's go ahead and take a look at four different questions 13 13
to get an idea of what this might look like 14 14
come exam day. 15 15
First, let's assume you're working 16 16
as a cybersecurity analyst at Dion Training. 17 17
You just received the results of a vulnerability scan 18 18
that identified four vulnerabilities 19 19
on the company's web server. 20 20
These are labeled as vulnerabilities 1, 2, 3, and 4 21 21
and vulnerability 1 has a base score of 8.1. 22 22
Vulnerability 2 has a base score of 7.3. 23 23
Vulnerability 3 has a base score of 4.5 24 24
and vulnerability 4 has a base score of 5.3. 25 25
Based on the vulnerabilities listed 26 26
which of these vulnerabilities should be remediated first? 27 27
Now this one's a pretty simple question 28 28
because they're just giving you four vulnerabilities 29 29
and some base scores and not much else to go with. 30 30
So, if this is all the information you have 31 31
you'll simply choose the base score 32 32
with the highest number, in this case, 8.1. 33 33
That means that vulnerability 1 will be 34 34
the vulnerability we need to remediate first 35 35
and then we would remediate vulnerability 2, 36 36
vulnerability 4, and then vulnerability 3. 37 37
Remember, when it comes to CVSS 3.1 base scores, 38 38
they're going to be categorized from zero to 10.0. 39 39
If you're at zero 40 40
this gives you a rating of none as your overall risk. 41 41
If you're dealing with a score between 0.1 and 3.9 42 42
this will give you a low rating. 43 43
If you have 4.0 to 6.9 as your score 44 44
you'll be using a medium rating. 45 45
If you have 7.0 to 8.9 as your score 46 46
you're going to have a high rating. 47 47
And if you have 9 to 10 as your score 48 48
you're going to have a critical rating. 49 49
So once again, vulnerability 1 with a score 50 50
of 8.1 is considered a high vulnerability 51 51
and one that we want to remediate as soon as possible. 52 52
Let's move on to our second question. 53 53
Again, we're going to pretend you're working 54 54
as a cybersecurity analyst at Dion Training 55 55
and you just received the results of a vulnerability scan 56 56
that identified four vulnerabilities 57 57
on the company's web server. 58 58
This time though, we have four vulnerabilities 59 59
and their vector strings as shown here on the screen. 60 60
Based on the four vulnerabilities listed 61 61
which of these vulnerabilities should be remediated first? 62 62
Vulnerability 1, vulnerability 2, vulnerability 3 63 63
or vulnerability 4? 64 64
Well, let's go ahead and break down each of these vector 65 65
strings for a moment, and then we can make a determination 66 66
of which one we should remediate first. 67 67
Now, since we don't have the base scores, we can't rely 68 68
on those solely, and even if we did, we don't always 69 69
want to rely on the highest base score because sometimes 70 70
there's other factors that we have to consider, 71 71
such as can a standard user or an administrative user 72 72
cause that issue or is a confidentiality, integrity 73 73
and availability being affected 74 74
by that particular vulnerability? 75 75
So it's important to be able to read these vector strings 76 76
to understand exactly what they're telling you. 77 77
Let's take a look at each of these. 78 78
Vulnerability 1, since it's exploitable through 79 79
An an adjacent network 80 80
it has a high attack complexity, requires user intervention, 81 81
has no impact on confidentiality, has no impact on integrity 82 82
but it does have a high impact on availability. 83 83
If we move on to vulnerability 2, 84 84
we can see that this vulnerability is exploitable remotely 85 85
and you can see that under access vector 86 86
being network based, it also has a low attack complexity 87 87
no user interaction is required. 88 88
It has a low impact on confidentiality, 89 89
a low impact on integrity, and a low impact on availability. 90 90
Now, this vulnerability is actually more severe 91 91
than vulnerability 1 92 92
because there's a low attack complexity 93 93
and it's exploitable remotely, which makes this 94 94
a pretty big vulnerability that we need to look at. 95 95
Because of these factors it's actually more serious 96 96
than vulnerability 1. 97 97
So right now, this is the most serious vulnerability 98 98
we've looked at. 99 99
Let's go ahead and look at vulnerability 3 100 100
and see if it's more or less severe than vulnerability 2 101 101
which is currently our most severe. 102 102
Vulnerability 3 says that it can be exploited remotely. 103 103
It has a high attack complexity 104 104
it has no user interaction that's required 105 105
and it has a high impact on confidentiality, a high impact 106 106
on integrity, and a high impact on availability. 107 107
So based on looking at the CIA triad 108 108
we can see that vulnerability 3 is more severe 109 109
than vulnerability 2. 110 110
In addition to that, it is still exploitable remotely 111 111
and really the only thing that makes 112 112
vulnerability 2 a little bit easier 113 113
is that it has a low attack complexity, 114 114
but because of the severity going from lows to highs 115 115
in the CIA triad we are going to say that vulnerability 3 116 116
is more severe and therefore that's right now our leader 117 117
as far as which one do we want to remediate first. 118 118
Our final one we're going to look at is vulnerability 4. 119 119
This vulnerability is exploitable locally. 120 120
It has a low attack complexity. 121 121
It does require privileged access to run that exploit. 122 122
It has no user interaction being required 123 123
and it has a low impact on confidentiality, 124 124
integrity and availability. 125 125
So here again, we have another vulnerability 126 126
that has a low impact on the CIA triad. 127 127
Therefore, vulnerability 3 is going to be our first priority 128 128
for remediation and makes it the correct answer 129 129
to this question. 130 130
Let's move on to our third question. 131 131
Again, we're going to assume you're a cybersecurity 132 132
analyst working here at Dion Training. 133 133
You just received the results of a vulnerability scan 134 134
that identified four vulnerabilities 135 135
on your company's database server. 136 136
Here on the screen, you can see those four vulnerabilities 137 137
and their vector strings. 138 138
Based on these vulnerabilities, 139 139
which of these vulnerabilities should be remediated first 140 140
in order to best mitigate the threat 141 141
to the database servers confidentiality? 142 142
Now, this question is a little bit different 143 143
because we're not focused on the overall risk 144 144
of any of these vulnerabilities, and instead 145 145
we are really focused just on the confidentiality. 146 146
So as we start going through these vector strings, 147 147
we want to look for the third key pair from the right 148 148
which is the C colon and something. 149 149
If it says N, that means there's no impact. 150 150
If it's L, it means it's a low impact, 151 151
and if it's H it means it's a high impact. 152 152
So the easiest way to answer this question is simply look 153 153
at that column with C 154 154
and you can see that vulnerability 1 has no impact 155 155
to confidentiality. 156 156
Vulnerability 2 has a high impact to confidentiality. 157 157
Vulnerability 3 has no impact to confidentiality 158 158
and vulnerability 4 has no impact to confidentiality. 159 159
Therefore, the one that we need to remediate first 160 160
in terms of confidentiality would be vulnerability 2 161 161
because it is the biggest threat to confidentiality 162 162
of these four vulnerabilities. 163 163
Now, if I asked which one was for availability 164 164
the answer to that would be vulnerability 3. 165 165
If I asked about the threats to integrity 166 166
that would be vulnerability 4. 167 167
And if I asked for the biggest overall threat 168 168
that would be vulnerability 1. 169 169
And so you can see how this same set of strings 170 170
for these four vulnerabilities 171 171
could have different prioritization 172 172
based on your organization and its needs. 173 173
If you're focused on confidentiality 174 174
like we are in this question 175 175
the right answer here is vulnerability 2. 176 176
But if you're looking at the biggest overall threat 177 177
then it would be vulnerability 1. 178 178
Or if you want the biggest threat to availability 179 179
it's vulnerability 3. 180 180
And the biggest threat to integrity is vulnerability 4. 181 181
And that's why it's important not just to rely 182 182
on a base score 183 183
because the base score tells you the biggest overall threat 184 184
but it doesn't tell you the threat specific 185 185
to your organization and what you care about. 186 186
Let's move on to our fourth and final question. 187 187
Here again, we are a cybersecurity analyst working 188 188
at Dion Training. 189 189
We received the results 190 190
of our vulnerability scan that identified four 191 191
vulnerabilities on the company's email server. 192 192
And again, you see the four vulnerabilities 193 193
and their vector strings. 194 194
Based on the vulnerabilities shown 195 195
which of these vulnerabilities should be remediated first 196 196
in order to best mitigate the threats to the email server's 197 197
confidentiality, integrity, and availability. 198 198
So in this case, we're not looking for an overall threat 199 199
but we are focused on the last three key pairs 200 200
inside that vector string, which is CINA 201 201
or confidentiality, integrity and availability. 202 202
So as I look through these from vulnerability 1, 2, 3, 203 203
and 4, I can see that vulnerability 1 has low, low, low. 204 204
If I look at vulnerability 2, 205 205
I have no impact, no impact high. 206 206
If I look at vulnerability 3, I have high, high, high. 207 207
If I look at vulnerability 4, I have low, low and no impact. 208 208
So which one is going to be the biggest threat 209 209
to the confidentiality, integrity 210 210
and availability of my system? 211 211
Well, obviously it's going to be vulnerability number 3 212 212
because it is high, high high for confidentiality, 213 213
integrity, and availability. 214 214
Now, if I wanted to take this a step further 215 215
we could actually change this question a little bit 216 216
and say instead of which one is the first one 217 217
we want to remediate we might say, what is the order 218 218
we would want to remediate all four of these based 219 219
on the confidentiality, integrity and availability threats. 220 220
In this case, vulnerability 3 would still 221 221
be remediated first because it has a high impact 222 222
to confidentiality, integrity, and availability. 223 223
The second vulnerability 224 224
that we would be looking at is vulnerability 1, 225 225
because there's a low impact across all three categories 226 226
of confidentiality, integrity, and availability. 227 227
Next, we would remediate vulnerability number 2 228 228
because it has no impact to confidentiality and integrity 229 229
but it does have a high impact to availability. 230 230
And then finally, 231 231
we would remediate vulnerability number 4 232 232
because this one has low impact to confidentiality, 233 233
low impact to integrity, and no impact to availability. 234 234
So as we look at this 235 235
having all three highs is going to be first, 236 236
all three lows is going to be second, and then having a high 237 237
in any one category is going to be third 238 238
and then having two lows and no impact on the third 239 239
is going to be fourth 240 240
which gives us the correct remediation order 241 241
of vulnerability 3 being first, 242 242
vulnerability 1 being second, vulnerability 2 being third 243 243
and vulnerability 4 being fourth. 244 244
So as you can see, there are lots of different ways 245 245
to attack these types of questions 246 246
and it's really important to take the time 247 247
to understand what the question is asking you. 248 248
Are they asking for an overall threat? 249 249
Are they asking for a threat to a specific area 250 250
like confidentiality, integrity, or availability? 251 251
Are they asking you which of these vulnerabilities 252 252
requires high complexity or low complexity, 253 253
or which of these requires user interaction 254 254
and which ones don't? 255 255
All of these would be fair questions for you 256 256
to be able to parse the information 257 257
from a vector string to be able to understand 258 258
which vulnerabilities are most dangerous 259 259
and which ones are least dangerous 260 260
to us based on these vector strings provided.