You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<navclass="md-nav" aria-label="CVSS Requirements for Regulated Environments">
1412
+
<ulclass="md-nav__list">
1413
+
1414
+
<liclass="md-nav__item">
1415
+
<ahref="#pci" class="md-nav__link">
1416
+
<spanclass="md-ellipsis">
1417
+
PCI
1418
+
</span>
1419
+
</a>
1420
+
1421
+
</li>
1422
+
1423
+
<liclass="md-nav__item">
1424
+
<ahref="#fedramp" class="md-nav__link">
1425
+
<spanclass="md-ellipsis">
1426
+
FedRAMP
1427
+
</span>
1428
+
</a>
1429
+
1430
+
</li>
1431
+
1432
+
</ul>
1433
+
</nav>
1434
+
1435
+
</li>
1436
+
1437
+
</ul>
1438
+
</nav>
1439
+
1344
1440
</li>
1345
1441
1346
1442
<liclass="md-nav__item">
@@ -1454,9 +1550,10 @@ <h2 id="cvss-severity-rating-scale"><abbr title="Common Vulnerability Scoring Sy
1454
1550
<li>>96% of CVEs are ranked Medium or higher (4+)</li>
1455
1551
</ol>
1456
1552
</div>
1553
+
<h2id="dont-use-cvss-base-scores-alone-to-assess-risk">Don't use <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base Scores alone to assess risk<aclass="headerlink" href="#dont-use-cvss-base-scores-alone-to-assess-risk" title="Permanent link">¶</a></h2>
1457
1554
<divclass="admonition tip">
1458
-
<pclass="admonition-title">Don't use <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Scores alone to assess risk.</p>
1459
-
<p>Many organizations use <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Scores alone to assess risk despite repeated guidance against this. </p>
1555
+
<pclass="admonition-title">Don't use <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr>Base Scores alone to assess risk.</p>
1556
+
<p>Many organizations use <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr>Base Scores alone to assess risk despite repeated guidance against this. </p>
1460
1557
<p><strong>A Critical or High <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Severity is not the same as a Critical or High <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr>.</strong></p>
1461
1558
<p><strong>There's a ~10x difference in counts of CVEs</strong> for these 2 groups:</p>
1462
1559
<ul>
@@ -1468,11 +1565,30 @@ <h2 id="cvss-severity-rating-scale"><abbr title="Common Vulnerability Scoring Sy
1468
1565
<p><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base (<abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr>-B) scores are designed to measure the severity of a vulnerability and should not be used alone to assess risk. </p>
<h3id="cvss-requirements-for-regulated-environments"><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Requirements for Regulated Environments<aclass="headerlink" href="#cvss-requirements-for-regulated-environments" title="Permanent link">¶</a></h3>
1570
+
<p>Some Regulated Environments requirements appear to conflict with this guidance 🤔</p>
<p>The Payment Card Industry Data Security Standard (PCI DSS) is an information security standard used to handle credit cards from major card brands. The standard is administered by the Payment Card Industry Security Standards Council, and its use is mandated by the card brands. It was created to better control cardholder data and reduce credit card fraud. Validation of compliance is performed annually or quarterly with a method suited to the volume of transactions</p>
<p>PCI DSS 4.0 11.3.2.1 “External vulnerability scans are performed after any significant change as follows: Vulnerabilities that are scored <strong>4.0 or higher by the <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr></strong> are resolved.”</p>
<p>The Federal <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> and Authorization Management Program (FedRAMP) is a United States federal government-wide compliance program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services <ahref="https://en.wikipedia.org/wiki/FedRAMP">https://en.wikipedia.org/wiki/FedRAMP</a></p>
1586
+
</div>
1587
+
<divclass="admonition quote">
1588
+
<pclass="admonition-title">Quote</p>
1589
+
<p>3.0 Scanning Requirements</p>
1590
+
<p>Common Vulnerability Scoring System (<abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr>) <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Scoring: For any vulnerability with a CVSSv3 base score assigned in the latest version of the <abbrtitle="National Vulnerability Database">NVD</abbr>, <strong>the CVSSv3 base score must be used as the original risk rating</strong>. If no CVSSv3 score is available, a CVSSv2 base score is acceptable where available. If no <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> score is available, the native scanner base risk score can be used.</p>
<h2id="cvss-confidentiality-integrity-availability-impacts"><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Confidentiality, Integrity, Availability Impacts<aclass="headerlink" href="#cvss-confidentiality-integrity-availability-impacts" title="Permanent link">¶</a></h2>
<li>>96% of CVEs are ranked Medium or higher (4+)</li>
2660
2660
</ol>
2661
2661
</div>
2662
+
<h2id="cvss-cvss-dont-use-cvss-base-scores-alone-to-assess-risk">Don't use <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base Scores alone to assess risk<aclass="headerlink" href="#cvss-cvss-dont-use-cvss-base-scores-alone-to-assess-risk" title="Permanent link">¶</a></h2>
2662
2663
<divclass="admonition tip">
2663
-
<pclass="admonition-title">Don't use <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Scores alone to assess risk.</p>
2664
-
<p>Many organizations use <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Scores alone to assess risk despite repeated guidance against this. </p>
2664
+
<pclass="admonition-title">Don't use <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr>Base Scores alone to assess risk.</p>
2665
+
<p>Many organizations use <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr>Base Scores alone to assess risk despite repeated guidance against this. </p>
2665
2666
<p><strong>A Critical or High <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Severity is not the same as a Critical or High <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr>.</strong></p>
2666
2667
<p><strong>There's a ~10x difference in counts of CVEs</strong> for these 2 groups:</p>
<p><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base (<abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr>-B) scores are designed to measure the severity of a vulnerability and should not be used alone to assess risk. </p>
<h3id="cvss-cvss-cvss-requirements-for-regulated-environments"><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Requirements for Regulated Environments<aclass="headerlink" href="#cvss-cvss-cvss-requirements-for-regulated-environments" title="Permanent link">¶</a></h3>
2679
+
<p>Some Regulated Environments requirements appear to conflict with this guidance 🤔</p>
<p>The Payment Card Industry Data Security Standard (PCI DSS) is an information security standard used to handle credit cards from major card brands. The standard is administered by the Payment Card Industry Security Standards Council, and its use is mandated by the card brands. It was created to better control cardholder data and reduce credit card fraud. Validation of compliance is performed annually or quarterly with a method suited to the volume of transactions</p>
<p>PCI DSS 4.0 11.3.2.1 “External vulnerability scans are performed after any significant change as follows: Vulnerabilities that are scored <strong>4.0 or higher by the <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr></strong> are resolved.”</p>
<p>The Federal <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> and Authorization Management Program (FedRAMP) is a United States federal government-wide compliance program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services <ahref="https://en.wikipedia.org/wiki/FedRAMP">https://en.wikipedia.org/wiki/FedRAMP</a></p>
2695
+
</div>
2696
+
<divclass="admonition quote">
2697
+
<pclass="admonition-title">Quote</p>
2698
+
<p>3.0 Scanning Requirements</p>
2699
+
<p>Common Vulnerability Scoring System (<abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr>) <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Scoring: For any vulnerability with a CVSSv3 base score assigned in the latest version of the <abbrtitle="National Vulnerability Database">NVD</abbr>, <strong>the CVSSv3 base score must be used as the original risk rating</strong>. If no CVSSv3 score is available, a CVSSv2 base score is acceptable where available. If no <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> score is available, the native scanner base risk score can be used.</p>
<h2id="cvss-cvss-cvss-confidentiality-integrity-availability-impacts"><abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Confidentiality, Integrity, Availability Impacts<aclass="headerlink" href="#cvss-cvss-cvss-confidentiality-integrity-availability-impacts" title="Permanent link">¶</a></h2>
0 commit comments