Skip to content

Commit 8c3fc48

Browse files
CrashedmindCrashedmind
committed
Deployed 577f2c3 with MkDocs version: 1.5.3
1 parent 12df914 commit 8c3fc48

4 files changed

Lines changed: 95 additions & 67 deletions

File tree

‎print_page/index.html‎

Lines changed: 31 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -5082,17 +5082,39 @@ <h2 id="risk-takeaway-requirements-for-a-risk-based-prioritization-scheme-for-fi
50825082
</li>
50835083
</ol>
50845084
</li>
5085-
<li><strong>Extensible</strong></li>
5085+
<li><strong>Extensible</strong><ol>
50865086
<li>Organizations may want to extend, customize, or optimize a <abbr title="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Based Prioritization Scheme for their environment e.g. change the prioritization associated with a data source or add a new data source.</li>
5087-
<li>Some schemes do this by design e.g. <a href="https://github.com/CERTCC/SSVC"><abbr title="SSVC Stakeholder-Specific Vulnerability Categorization">SSVC</abbr></a> "<abbr title="SSVC Stakeholder-Specific Vulnerability Categorization">SSVC</abbr> aims to avoid one-size-fits-all solutions in favor of a modular decision-making system with clearly defined and tested parts that vulnerability managers can select and use as appropriate to their context."</li>
5087+
<li>Some schemes do this by design e.g. <em>"<a href="https://github.com/CERTCC/SSVC"><abbr title="SSVC Stakeholder-Specific Vulnerability Categorization">SSVC</abbr></a> aims to avoid one-size-fits-all solutions in favor of a modular decision-making system with clearly defined and tested parts that vulnerability managers can select and use as appropriate to their context."</em></li>
50885088
</ol>
5089+
</li>
5090+
</ol>
5091+
<h3 id="risk-takeaway-cvss-temporal-threat-metrics"><abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Temporal &amp; Threat Metrics<a class="headerlink" href="#risk-takeaway-cvss-temporal-threat-metrics" title="Permanent link">&para;</a></h3>
5092+
<p>It is possible to combine all the key risk factors into an overall <abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> score but...</p>
5093+
<div class="admonition quote">
5094+
<p class="admonition-title">Quote</p>
5095+
<p>The convenience of a single <abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> score comes with the cost of not being able to understand or differentiate between the risk factors from the score, and not being able to prioritize effectively using the score.</p>
5096+
<p><a href="#cvss-cvss"><abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr></a></p>
5097+
</div>
5098+
<p>But if you do chose this option then, see "Enriching the <abbr title="National Vulnerability Database">NVD</abbr> <abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> scores to include Temporal &amp; Threat Metrics" project referenced in <a href="#cvss-cvss"><abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr></a>.</p>
5099+
<h3 id="risk-takeaway-cvss-base-score-ratings-with-exploitation-focus"><abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base Score Ratings with Exploitation Focus<a class="headerlink" href="#risk-takeaway-cvss-base-score-ratings-with-exploitation-focus" title="Permanent link">&para;</a></h3>
5100+
<p><a href="#vendors-qualys-in-depth-look-into-data-driven-science-behind-qualys-trurisk">Qualys TruRisk Approach</a> is a good starting point. Any organization can apply this approach or similar.</p>
5101+
<p><abbr title="Exploit Prediction Scoring System">EPSS</abbr> should be included to inform "likelihood of exploitation".</p>
5102+
<ul>
5103+
<li>TODO provide code to implement this or similar</li>
5104+
</ul>
5105+
<h3 id="risk-takeaway-ssvc-decision-trees"><abbr title="SSVC Stakeholder-Specific Vulnerability Categorization">SSVC</abbr> Decision Trees<a class="headerlink" href="#risk-takeaway-ssvc-decision-trees" title="Permanent link">&para;</a></h3>
5106+
<p><a href="#ssvc-ssvc"><abbr title="SSVC Stakeholder-Specific Vulnerability Categorization">SSVC</abbr></a> Decision Trees can give more granularity than combining <abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Ratings and Exploitation factors i.e. better <abbr title="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Based Prioritization.</p>
5107+
<p>The <abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base score parameters are used instead of <abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> scores.</p>
5108+
<ul>
5109+
<li>Reference Code is provided in this guide.</li>
5110+
</ul>
50895111
<h2 id="risk-takeaway-risk-based-prioritization-summary-against-requirements"><abbr title="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Based Prioritization Summary against Requirements<a class="headerlink" href="#risk-takeaway-risk-based-prioritization-summary-against-requirements" title="Permanent link">&para;</a></h2>
50905112
<table>
50915113
<thead>
50925114
<tr>
50935115
<th>Requirement</th>
50945116
<th><abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr></th>
5095-
<th>Qualys</th>
5117+
<th><abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base Score Ratings with Exploitation Focus</th>
50965118
<th><abbr title="SSVC Stakeholder-Specific Vulnerability Categorization">SSVC</abbr> Decision Tree</th>
50975119
</tr>
50985120
</thead>
@@ -5115,28 +5137,14 @@ <h2 id="risk-takeaway-risk-based-prioritization-summary-against-requirements"><a
51155137
<td>✅</td>
51165138
<td>✅</td>
51175139
</tr>
5140+
<tr>
5141+
<td>Extensible</td>
5142+
<td><img alt="❌" class="twemoji" src="https://cdn.jsdelivr.net/gh/jdecked/twemoji@15.0.3/assets/svg/274c.svg" title=":x:" /></td>
5143+
<td>✅</td>
5144+
<td>✅</td>
5145+
</tr>
51185146
</tbody>
51195147
</table>
5120-
<h3 id="risk-takeaway-cvss-temporal-threat-metrics"><abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Temporal &amp; Threat Metrics<a class="headerlink" href="#risk-takeaway-cvss-temporal-threat-metrics" title="Permanent link">&para;</a></h3>
5121-
<p>It is possible to combine all the key risk factors into an overall <abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> score but...</p>
5122-
<div class="admonition quote">
5123-
<p class="admonition-title">Quote</p>
5124-
<p>The convenience of a single <abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> score comes with the cost of not being able to understand or differentiate between the risk factors from the score, and not being able to prioritize effectively using the score.</p>
5125-
<p><a href="#cvss-cvss"><abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr></a></p>
5126-
</div>
5127-
<p>But if you do chose this option then, see "Enriching the <abbr title="National Vulnerability Database">NVD</abbr> <abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> scores to include Temporal &amp; Threat Metrics" project referenced in <a href="#cvss-cvss"><abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr></a>.</p>
5128-
<h3 id="risk-takeaway-cvss-base-score-ratings-with-exploitation-focus"><abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base Score Ratings with Exploitation Focus<a class="headerlink" href="#risk-takeaway-cvss-base-score-ratings-with-exploitation-focus" title="Permanent link">&para;</a></h3>
5129-
<p><a href="#vendors-qualys-in-depth-look-into-data-driven-science-behind-qualys-trurisk">Qualys TruRisk Approach</a> is a good starting point. Any organization can apply this approach or similar.</p>
5130-
<p><abbr title="Exploit Prediction Scoring System">EPSS</abbr> should be included to inform "likelihood of exploitation".</p>
5131-
<ul>
5132-
<li>TODO provide code to implement this or similar</li>
5133-
</ul>
5134-
<h3 id="risk-takeaway-ssvc-decision-trees"><abbr title="SSVC Stakeholder-Specific Vulnerability Categorization">SSVC</abbr> Decision Trees<a class="headerlink" href="#risk-takeaway-ssvc-decision-trees" title="Permanent link">&para;</a></h3>
5135-
<p><a href="#ssvc-ssvc"><abbr title="SSVC Stakeholder-Specific Vulnerability Categorization">SSVC</abbr></a> Decision Trees can give more granularity than combining <abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Ratings and Exploitation factors i.e. better <abbr title="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Based Prioritization.</p>
5136-
<p>The <abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Base score parameters are used instead of <abbr title="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> scores.</p>
5137-
<ul>
5138-
<li>Reference Code is provided in this guide.</li>
5139-
</ul>
51405148
<h3 id="risk-takeaway-proprietary">Proprietary<a class="headerlink" href="#risk-takeaway-proprietary" title="Permanent link">&para;</a></h3>
51415149
<p>If you <strong>implement</strong> a proprietary <abbr title="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Based Prioritization scheme, keep the following in mind:</p>
51425150
<div class="admonition quote">

0 commit comments

Comments
 (0)