You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<figcaption><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Rating for all CVEs</figcaption>
<p>A different way of looking at this is that this guide (and the prioritization schemes herein), can be used as a first pass triage and prioritization of vulnerabilities, before the overall asset-specific business and runtime context, and remediation context, is considered, and all the context-specific dependencies that go with that.</p>
1455
1455
<p>In other words, Relative <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> per vulnerability.</p>
Copy file name to clipboardExpand all lines: risk/Rbp_schemes/index.html
+40-30Lines changed: 40 additions & 30 deletions
Original file line number
Diff line number
Diff line change
@@ -1487,8 +1487,8 @@ <h1 id="risk-based-prioritization-schemes"><abbr title="The likelihood of a vuln
1487
1487
<h3id="cvss-temporal-threat-metrics"><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Temporal & Threat Metrics<aclass="headerlink" href="#cvss-temporal-threat-metrics" title="Permanent link">¶</a></h3>
1488
1488
<p>Exploitation data is added per the <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> standard as described in <ahref="../../cvss/CVSS/#cvss-exploit-maturity"><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr></a>.</p>
<figcaption>The effect of CVSS Base & Threat is to move some CVEs down a Rating e.g. some Critical CVEs move to High</figcaption>
1492
1492
</figure>
1493
1493
<h3id="cvss-base-score-ratings-with-exploitation-focus"><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base Score Ratings with Exploitation Focus<aclass="headerlink" href="#cvss-base-score-ratings-with-exploitation-focus" title="Permanent link">¶</a></h3>
1494
1494
<p>A simple illustrative scheme that combines Base Score Ratings with Exploitation status is defined here.</p>
<th><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base Score Rating</th>
1503
+
<th>Exploitation</th>
1505
1504
</tr>
1506
1505
</thead>
1507
1506
<tbody>
1508
1507
<tr>
1509
-
<td></td>
1508
+
<td>10</td>
1510
1509
<td>critical</td>
1511
1510
<td>kev</td>
1512
-
<td>10</td>
1513
1511
</tr>
1514
1512
<tr>
1515
-
<td></td>
1513
+
<td>9</td>
1516
1514
<td>critical</td>
1517
1515
<td>weaponized</td>
1518
-
<td>9</td>
1519
1516
</tr>
1520
1517
<tr>
1521
-
<td></td>
1518
+
<td>8</td>
1522
1519
<td>high</td>
1523
1520
<td>kev</td>
1524
-
<td>8</td>
1525
1521
</tr>
1526
1522
<tr>
1527
-
<td></td>
1523
+
<td>7</td>
1528
1524
<td>high</td>
1529
1525
<td>weaponized</td>
1530
-
<td>7</td>
1531
1526
</tr>
1532
1527
<tr>
1533
-
<td></td>
1534
-
<td>critical</td>
1535
-
<td>poc and not kev and not weaponized</td>
1536
1528
<td>6</td>
1529
+
<td>critical</td>
1530
+
<td>poc</td>
1537
1531
</tr>
1538
1532
<tr>
1539
-
<td></td>
1540
-
<td>high</td>
1541
-
<td>poc and not kev and not weaponized</td>
1542
1533
<td>5</td>
1534
+
<td>high</td>
1535
+
<td>poc</td>
1543
1536
</tr>
1544
1537
<tr>
1545
-
<td></td>
1538
+
<td>4</td>
1546
1539
<td>critical</td>
1547
1540
<td>-</td>
1548
-
<td>4</td>
1549
1541
</tr>
1550
1542
<tr>
1551
-
<td></td>
1543
+
<td>3</td>
1552
1544
<td>high</td>
1553
1545
<td>-</td>
1554
-
<td>3</td>
1555
1546
</tr>
1556
1547
<tr>
1557
-
<td></td>
1548
+
<td>2</td>
1558
1549
<td>medium</td>
1559
1550
<td>-</td>
1560
-
<td>2</td>
1561
1551
</tr>
1562
1552
<tr>
1563
-
<td></td>
1553
+
<td>1</td>
1564
1554
<td>-</td>
1565
1555
<td>-</td>
1566
-
<td>1</td>
1567
1556
</tr>
1568
1557
</tbody>
1569
1558
</table>
1570
-
<p>where a <abbrtitle="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr> is assigned to a Group if it appears in the Data Source listed:</p>
1559
+
<p>where a <abbrtitle="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr> is assigned to a group if it appears in the Data Source listed:</p>
<p>The <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base parameters are used instead of <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> scores or ratings.</p>
1599
1588
<p>Per the <ahref="../../ssvc/decision_trees_from_scratch/"><abbrtitle="SSVC Stakeholder-Specific Vulnerability Categorization">SSVC</abbr></a> Decision Tree example, the Exploitability and Impact <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Factors that make up the <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base Score are split out separately and used instead of the <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base Score.</p>
1600
1589
<p>This gives more granularity than combining <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Ratings and Exploitation factors i.e. better <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Based Prioritization.</p>
<li>Either <ahref="#cvss-base-score-ratings-with-exploitation-focus"><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base Score Ratings with Exploitation Focus</a> or <ahref="#ssvc-decision-trees"><abbrtitle="SSVC Stakeholder-Specific Vulnerability Categorization">SSVC</abbr> Decision Trees</a>, that <ahref="../Understanding_Risk/#where-cvss-epss-cisa-kev-fit">Focus on Exploitation</a>, are good starting points or references for a <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Based Prioritization scheme.</li>
1632
1621
<li>Apply a <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Based Prioritization scheme based on your environment, and refine it based on your data.</li>
1633
1622
</ol>
1623
+
<table>
1624
+
<thead>
1625
+
<tr>
1626
+
<th><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Temporal & Threat Metrics</th>
1627
+
<th><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base Score Ratings with Exploitation Focus</th>
<td>The effect of <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base & Threat is to move some CVEs down a Rating e.g. some Critical CVEs move to High</td>
<p><ahref="../../introduction/Requirements/">Requirements for a <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Based Prioritization Scheme for First Pass Triage</a>.</p>
1496
1496
<h2id="risk-based-prioritization-scheme-for-first-pass-triage"><abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Based Prioritization Scheme for First Pass Triage<aclass="headerlink" href="#risk-based-prioritization-scheme-for-first-pass-triage" title="Permanent link">¶</a></h2>
<figcaption>The scope for this guide is up to and including the First Pass Triage</figcaption>
1500
1500
</figure>
1501
1501
<p><abbrtitle="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr> data is public.</p>
<figcaption>NIST Generic <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Model with Key <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Factors</figcaption>
<p>Adding more detail to the Vulnerability branch, to show where <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr>,
<figcaption> Where CVSS, EPSS, CISA KEV Fit with Risk</figcaption>
1750
1750
</figure>
1751
1751
<h3id="threat-likelihood-of-exploit-data-sources">Threat Likelihood of Exploit Data Sources<aclass="headerlink" href="#threat-likelihood-of-exploit-data-sources" title="Permanent link">¶</a></h3>
<figcaption>CISA's SSVC Decision Tree Outcomes https://www.cisa.gov/ssvc-calculator</figcaption>
1515
1515
</figure>
1516
1516
<h2id="exploitation-evidence-of-active-exploitation-of-a-vulnerability">Exploitation: Evidence of Active Exploitation of a Vulnerability<aclass="headerlink" href="#exploitation-evidence-of-active-exploitation-of-a-vulnerability" title="Permanent link">¶</a></h2>
0 commit comments