Skip to content

Commit 6b68982

Browse files
CrashedmindCrashedmind
committed
Deployed 96c33f9 with MkDocs version: 1.5.3
1 parent 4c9661e commit 6b68982

File tree

5 files changed

+270
-48
lines changed

5 files changed

+270
-48
lines changed

‎epss/grouped_epss/index.html‎

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -941,6 +941,48 @@
941941
</ul>
942942
</nav>
943943

944+
</li>
945+
946+
<li class="md-nav__item">
947+
<a href="#independence-assumption" class="md-nav__link">
948+
<span class="md-ellipsis">
949+
Independence Assumption
950+
</span>
951+
</a>
952+
953+
<nav class="md-nav" aria-label="Independence Assumption">
954+
<ul class="md-nav__list">
955+
956+
<li class="md-nav__item">
957+
<a href="#scenario-1-same-cve-truly-independent-deployments" class="md-nav__link">
958+
<span class="md-ellipsis">
959+
Scenario 1: Same CVE, Truly Independent Deployments
960+
</span>
961+
</a>
962+
963+
</li>
964+
965+
<li class="md-nav__item">
966+
<a href="#scenario-2-same-cve-shared-system-or-pathway" class="md-nav__link">
967+
<span class="md-ellipsis">
968+
Scenario 2: Same CVE, Shared System or Pathway
969+
</span>
970+
</a>
971+
972+
</li>
973+
974+
<li class="md-nav__item">
975+
<a href="#calculating-conditional-probabilities-with-a-small-number-of-dependent-vulnerabilities" class="md-nav__link">
976+
<span class="md-ellipsis">
977+
Calculating Conditional Probabilities With A Small Number Of Dependent Vulnerabilities
978+
</span>
979+
</a>
980+
981+
</li>
982+
983+
</ul>
984+
</nav>
985+
944986
</li>
945987

946988
<li class="md-nav__item">
@@ -2037,6 +2079,48 @@
20372079
</ul>
20382080
</nav>
20392081

2082+
</li>
2083+
2084+
<li class="md-nav__item">
2085+
<a href="#independence-assumption" class="md-nav__link">
2086+
<span class="md-ellipsis">
2087+
Independence Assumption
2088+
</span>
2089+
</a>
2090+
2091+
<nav class="md-nav" aria-label="Independence Assumption">
2092+
<ul class="md-nav__list">
2093+
2094+
<li class="md-nav__item">
2095+
<a href="#scenario-1-same-cve-truly-independent-deployments" class="md-nav__link">
2096+
<span class="md-ellipsis">
2097+
Scenario 1: Same CVE, Truly Independent Deployments
2098+
</span>
2099+
</a>
2100+
2101+
</li>
2102+
2103+
<li class="md-nav__item">
2104+
<a href="#scenario-2-same-cve-shared-system-or-pathway" class="md-nav__link">
2105+
<span class="md-ellipsis">
2106+
Scenario 2: Same CVE, Shared System or Pathway
2107+
</span>
2108+
</a>
2109+
2110+
</li>
2111+
2112+
<li class="md-nav__item">
2113+
<a href="#calculating-conditional-probabilities-with-a-small-number-of-dependent-vulnerabilities" class="md-nav__link">
2114+
<span class="md-ellipsis">
2115+
Calculating Conditional Probabilities With A Small Number Of Dependent Vulnerabilities
2116+
</span>
2117+
</a>
2118+
2119+
</li>
2120+
2121+
</ul>
2122+
</nav>
2123+
20402124
</li>
20412125

20422126
<li class="md-nav__item">
@@ -2122,6 +2206,75 @@ <h4 id="step-2-calculate-the-chance-of-at-least-one-being-exploited">Step 2: Cal
21222206
<p><strong>So, there is a 38.8% chance that at least one vulnerability will be exploited.</strong></p>
21232207
</div>
21242208
</div>
2209+
<h2 id="independence-assumption">Independence Assumption<a class="headerlink" href="#independence-assumption" title="Permanent link">&para;</a></h2>
2210+
<div class="admonition info">
2211+
<p class="admonition-title">What if Vulnerabilities are not independent?</p>
2212+
<p>If multiple systems in the group (that you're calculating Grouped <abbr title="Exploit Prediction Scoring System">EPSS</abbr> for) share the same <abbr title="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr>, the assumption of independence is likely not valid — or at least weakened — because:</p>
2213+
<ul>
2214+
<li>
2215+
<p>An attacker exploiting that <abbr title="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr> successfully on one system might increase their ability (or knowledge) to exploit it elsewhere.</p>
2216+
</li>
2217+
<li>
2218+
<p>Shared configurations, network access, or authentication could create a correlation between the vulnerabilities being exploited.</p>
2219+
</li>
2220+
</ul>
2221+
<h4 id="scenario-1-same-cve-truly-independent-deployments"><strong>Scenario 1: Same <abbr title="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr>, Truly Independent Deployments</strong><a class="headerlink" href="#scenario-1-same-cve-truly-independent-deployments" title="Permanent link">&para;</a></h4>
2222+
<p>Imagine you have:</p>
2223+
<ul>
2224+
<li>3 different machines or services,</li>
2225+
<li>All vulnerable to <strong><abbr title="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr>-XXXX-YYYY</strong>,</li>
2226+
<li>Each independently patched, segmented, or exposed.</li>
2227+
</ul>
2228+
<p><strong>In this case</strong>, you can reasonably <strong>treat them independently</strong>. So the math above still applies:</p>
2229+
<div class="arithmatex">\[
2230+
P(\text{no exploits}) = \prod_{i=1}^{N} (1 - P_i)
2231+
\]</div>
2232+
<p>Example: Three instances of <abbr title="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr>-2022-12345 with 10% chance each</p>
2233+
<div class="arithmatex">\[
2234+
P(\text{at least one exploit}) = 1 - (0.9)^3 = 0.271
2235+
\]</div>
2236+
<hr />
2237+
<h4 id="scenario-2-same-cve-shared-system-or-pathway"><strong>Scenario 2: Same <abbr title="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr>, Shared System or Pathway</strong><a class="headerlink" href="#scenario-2-same-cve-shared-system-or-pathway" title="Permanent link">&para;</a></h4>
2238+
<p>Now suppose:</p>
2239+
<ul>
2240+
<li>All three instances run on the <strong>same host</strong> or share an <strong>authentication mechanism</strong>.</li>
2241+
<li>Once an attacker exploits it in <strong>one place</strong>, they can <strong>reuse access or credentials</strong> elsewhere.</li>
2242+
</ul>
2243+
<p>Then the exploit events are <strong>dependent</strong>, and the original formula <strong>no longer holds</strong>.</p>
2244+
<p>You might see something like:</p>
2245+
<ul>
2246+
<li>One successful exploit causes <strong>all instances</strong> to be compromised (100% dependence).</li>
2247+
<li>Or a <strong>partial dependence</strong> — e.g., exploiting one boosts others from 10% to 50%.</li>
2248+
</ul>
2249+
<div class="admonition warning">
2250+
<p class="admonition-title">Warning</p>
2251+
<p>When vulnerabilities are <strong>not</strong> independent and there is a</p>
2252+
<ul>
2253+
<li>small number, e.g. 3, of the same vulnerability, then conditional probabilities can be used </li>
2254+
<li>
2255+
<p>large number of the same vulnerability, then calculating probabilities becomes complex! </p>
2256+
<ul>
2257+
<li>It would involve e.g. conditional probabilities, Bayesian networks, or Markov chains.</li>
2258+
</ul>
2259+
</li>
2260+
</ul>
2261+
</div>
2262+
<h4 id="calculating-conditional-probabilities-with-a-small-number-of-dependent-vulnerabilities"><strong>Calculating Conditional Probabilities With A Small Number Of Dependent Vulnerabilities</strong><a class="headerlink" href="#calculating-conditional-probabilities-with-a-small-number-of-dependent-vulnerabilities" title="Permanent link">&para;</a></h4>
2263+
<p>Let’s say you define:</p>
2264+
<ul>
2265+
<li><span class="arithmatex">\(A\)</span>: event that system 1 is exploited</li>
2266+
<li><span class="arithmatex">\(B\)</span>: event that system 2 is exploited</li>
2267+
</ul>
2268+
<p>Instead of computing <span class="arithmatex">\(P(A \cup B) = 1 - (1 - P(A))(1 - P(B))\)</span>, you’d now use:</p>
2269+
<div class="arithmatex">\[
2270+
P(A \cup B) = P(A) + P(B) - P(A \cap B)
2271+
\]</div>
2272+
<p>Where:</p>
2273+
<div class="arithmatex">\[
2274+
P(A \cap B) = P(A) \cdot P(B | A)
2275+
\]</div>
2276+
<p>And <strong><span class="arithmatex">\(P(B | A) &gt; P(B)\)</span></strong> if they’re positively correlated (as with the same <abbr title="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr> in a shared system).</p>
2277+
</div>
21252278
<h2 id="using-grouped-epss">Using Grouped <abbr title="Exploit Prediction Scoring System">EPSS</abbr><a class="headerlink" href="#using-grouped-epss" title="Permanent link">&para;</a></h2>
21262279
<div class="admonition tip">
21272280
<p class="admonition-title">Using Grouped <abbr title="Exploit Prediction Scoring System">EPSS</abbr></p>

‎print_page/index.html‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4733,6 +4733,75 @@ <h4 id="epss-grouped_epss-step-2-calculate-the-chance-of-at-least-one-being-expl
47334733
<p><strong>So, there is a 38.8% chance that at least one vulnerability will be exploited.</strong></p>
47344734
</div>
47354735
</div>
4736+
<h2 id="epss-grouped_epss-independence-assumption">Independence Assumption<a class="headerlink" href="#epss-grouped_epss-independence-assumption" title="Permanent link">&para;</a></h2>
4737+
<div class="admonition info">
4738+
<p class="admonition-title">What if Vulnerabilities are not independent?</p>
4739+
<p>If multiple systems in the group (that you're calculating Grouped <abbr title="Exploit Prediction Scoring System">EPSS</abbr> for) share the same <abbr title="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr>, the assumption of independence is likely not valid — or at least weakened — because:</p>
4740+
<ul>
4741+
<li>
4742+
<p>An attacker exploiting that <abbr title="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr> successfully on one system might increase their ability (or knowledge) to exploit it elsewhere.</p>
4743+
</li>
4744+
<li>
4745+
<p>Shared configurations, network access, or authentication could create a correlation between the vulnerabilities being exploited.</p>
4746+
</li>
4747+
</ul>
4748+
<h4 id="epss-grouped_epss-scenario-1-same-cve-truly-independent-deployments"><strong>Scenario 1: Same <abbr title="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr>, Truly Independent Deployments</strong><a class="headerlink" href="#epss-grouped_epss-scenario-1-same-cve-truly-independent-deployments" title="Permanent link">&para;</a></h4>
4749+
<p>Imagine you have:</p>
4750+
<ul>
4751+
<li>3 different machines or services,</li>
4752+
<li>All vulnerable to <strong><abbr title="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr>-XXXX-YYYY</strong>,</li>
4753+
<li>Each independently patched, segmented, or exposed.</li>
4754+
</ul>
4755+
<p><strong>In this case</strong>, you can reasonably <strong>treat them independently</strong>. So the math above still applies:</p>
4756+
<div class="arithmatex">\[
4757+
P(\text{no exploits}) = \prod_{i=1}^{N} (1 - P_i)
4758+
\]</div>
4759+
<p>Example: Three instances of <abbr title="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr>-2022-12345 with 10% chance each</p>
4760+
<div class="arithmatex">\[
4761+
P(\text{at least one exploit}) = 1 - (0.9)^3 = 0.271
4762+
\]</div>
4763+
<hr />
4764+
<h4 id="epss-grouped_epss-scenario-2-same-cve-shared-system-or-pathway"><strong>Scenario 2: Same <abbr title="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr>, Shared System or Pathway</strong><a class="headerlink" href="#epss-grouped_epss-scenario-2-same-cve-shared-system-or-pathway" title="Permanent link">&para;</a></h4>
4765+
<p>Now suppose:</p>
4766+
<ul>
4767+
<li>All three instances run on the <strong>same host</strong> or share an <strong>authentication mechanism</strong>.</li>
4768+
<li>Once an attacker exploits it in <strong>one place</strong>, they can <strong>reuse access or credentials</strong> elsewhere.</li>
4769+
</ul>
4770+
<p>Then the exploit events are <strong>dependent</strong>, and the original formula <strong>no longer holds</strong>.</p>
4771+
<p>You might see something like:</p>
4772+
<ul>
4773+
<li>One successful exploit causes <strong>all instances</strong> to be compromised (100% dependence).</li>
4774+
<li>Or a <strong>partial dependence</strong> — e.g., exploiting one boosts others from 10% to 50%.</li>
4775+
</ul>
4776+
<div class="admonition warning">
4777+
<p class="admonition-title">Warning</p>
4778+
<p>When vulnerabilities are <strong>not</strong> independent and there is a</p>
4779+
<ul>
4780+
<li>small number, e.g. 3, of the same vulnerability, then conditional probabilities can be used </li>
4781+
<li>
4782+
<p>large number of the same vulnerability, then calculating probabilities becomes complex! </p>
4783+
<ul>
4784+
<li>It would involve e.g. conditional probabilities, Bayesian networks, or Markov chains.</li>
4785+
</ul>
4786+
</li>
4787+
</ul>
4788+
</div>
4789+
<h4 id="epss-grouped_epss-calculating-conditional-probabilities-with-a-small-number-of-dependent-vulnerabilities"><strong>Calculating Conditional Probabilities With A Small Number Of Dependent Vulnerabilities</strong><a class="headerlink" href="#epss-grouped_epss-calculating-conditional-probabilities-with-a-small-number-of-dependent-vulnerabilities" title="Permanent link">&para;</a></h4>
4790+
<p>Let’s say you define:</p>
4791+
<ul>
4792+
<li><span class="arithmatex">\(A\)</span>: event that system 1 is exploited</li>
4793+
<li><span class="arithmatex">\(B\)</span>: event that system 2 is exploited</li>
4794+
</ul>
4795+
<p>Instead of computing <span class="arithmatex">\(P(A \cup B) = 1 - (1 - P(A))(1 - P(B))\)</span>, you’d now use:</p>
4796+
<div class="arithmatex">\[
4797+
P(A \cup B) = P(A) + P(B) - P(A \cap B)
4798+
\]</div>
4799+
<p>Where:</p>
4800+
<div class="arithmatex">\[
4801+
P(A \cap B) = P(A) \cdot P(B | A)
4802+
\]</div>
4803+
<p>And <strong><span class="arithmatex">\(P(B | A) &gt; P(B)\)</span></strong> if they’re positively correlated (as with the same <abbr title="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr> in a shared system).</p>
4804+
</div>
47364805
<h2 id="epss-grouped_epss-using-grouped-epss">Using Grouped <abbr title="Exploit Prediction Scoring System">EPSS</abbr><a class="headerlink" href="#epss-grouped_epss-using-grouped-epss" title="Permanent link">&para;</a></h2>
47374806
<div class="admonition tip">
47384807
<p class="admonition-title">Using Grouped <abbr title="Exploit Prediction Scoring System">EPSS</abbr></p>

‎search/search_index.json‎

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

0 commit comments

Comments
 (0)