In this section I'm going to talk about the common vulnerability scoring system version 3.0.
The CV ask US provides a way to capture the characteristics of a vulnerability and produce a numerical
score reflecting its spirity the numerical score can then be translated into a representation such as
low medium high and critical to help organizations properly assess and prioritize their vulnerability
management processes.
You can find information about the CBS asked by going to w w w first dot org for Slash CV assets.
Let's take a look at the factors used for the calculations to determine Bonner ability scoring unattacked
factor is the path that an attacker uses to access a system for malicious activity.
This could be an email an open layer for poor or a web page.
This score increases the more remote an attacker needs to be logically or physically to use an attack
vector
attack.
Complexity describes the conditions that are outside of an attacker's control to exploit a vulnerability.
So if an attacker had access to a network all the time then the attack complexity would be low.
But if an attacker had to wait for a certain condition to arise like a pivot point then the attack complexity
would be high privileges required describes the level of privilege that the attacker must have before
exploiting a vulnerability.
So if a system requires admin credentials for access then the risk would be low.
But if a system only required basic user cancels or no logging at all then the risk would be high user
interaction describes the requirement for some type of user activity before an attack can be launched
such as a user logon the score is highest when no user interaction is required.
The scope of an attack refers to the ability for an attack to affect other resources.
Separate from the original target.
An example would be an attacker compromising a web server and then corrupting the database server by
pivoting from the web server.
Then finally we have the CIA a triage of confidentiality integrity and availability you've probably
learned about these topics in earlier security studies.
But just as a refresher.
Confidentiality refers to limiting information access integrity refers to the trustworthiness of information
and availability refers to the loss of availability of the impacted components to calculate your vulnerability
score.
You simply just have to select the values for the base metrics and the website will generate a score
for you.
So let's say my attack factor had to have local access the attack complexity is high high privileges
required user interaction and will say SCO changed.
And then our CIA will be high all the way through.
So with these values we have a score of 7.2 in the high range.
One of the coolest things on this Web site are the example scores.
So if you go over here to the C-v asks us Berzon 3.0 examples it actually takes you through some bonder
ability examples and how the scores were determined based on the criteria for the vulnerability.
So to take a look at this one here we have a reflected cross the site scripting vulnerability.
And I'll kind of just skip down to the person 3.00 base score and let's read through each Mattrick and
the comments to see why it determine the value for each matra.
So for attack vector it chose network because the vulnerability is a web application and reasonably
requires network interaction with the server.
Attack complexity is low because that attacker would need to perform some type of reconnaissance attack
on the targeted system privileges required.
The value is not because an attacker requires no privileges to mount an attack.
User interaction required a successful attack requires the victim to visit the vulnerable component
by clicking a malicious URL for example
scope is changed because the vulnerable component is the web server running the PH P my admin software
and the impacted component as the victims browser.
The confidentiality impact is low because even though the information in the victim's web browser can
be around and sent to an attacker it is constrained to certain information.
The integrity impact is low as well because the information maintained in the victim's web browser can
be modified but only information associated with the Web site running ph my admin.
And then finally we have none for the availability impact because it does not have a major impact on
the availability of the victim's system.
So take some time to look through these different examples.
It really helps to provide some context for each metric and what type of value should be chosen based
on each scenario.