When we talk about exploitability and weaponization of a system, we usually refer to the cvss attacks
complexity rating when it comes into prioritization of the exploit in question.
What do I mean by that?
We have a vulnerability and we look at a vulnerability within a system.
We need to be able to prioritize how quickly or how soon or how much cost we should associate with fixing
that specific vulnerability.
We do this by two notions, right?
The first one is the ease of exploitation.
If I have a vulnerability, how easy is it to exploit that vulnerability?
Is it something simple where a script kiddie could do it?
You literally go in, you push a button and boom, it takes advantage of the vulnerability.
There's a tool called Orbital Strike where you literally take into account, you plug in an IP address
and you hit the little start button, and it does a denial of service attack against that IP address.
This would be indicative of a script kiddie Tool that takes a very low, uh, use of tools or low use
of knowledge to perform the attack, making the ease of exploitation very high.
That's the first foundation of any attack.
The second aspect we need to take into account is the severity of the attack.
While a denial of service attack isn't that high on the criticality or the severity list, the ease
of exploitation is.
This would rate our prioritization to be somewhat low.
Yes, it is easy for someone to take advantage of a denial of service attack against our system, but
the severity of a denial of service attack with today's technology is quite low, and so it wouldn't
require a high prioritization.
However, what about an attack that has very easy use of exploitation, or very ease of use of exploitation
against that specific vulnerability, and the severity would be root access into our systems.
This would be high ease of exploitation and high severity constituting a high priority list.
When we talk about prioritization of a specific vulnerability, We must always take into account how
easy it is to take advantage of that vulnerability.
And what's the severity if someone does get Ahold of that vulnerability?
The other key role that we need to take into account is the asset value.
Is it a sensitive item?
Does the asset and value in question have sensitive information?
Are we talking about PII?
Is there a list of databases inside of that asset that increases the asset value past what we would
normally consider for the hardware itself?
What do I mean by that?
If I've got a hard drive, a hard drive by itself in today's terms is only a couple hundred bucks,
even for a one terabyte drive.
However, what if the data on that hard drive has a high sensitivity and increases the cost or the asset
value associated with that hard drive?
Remember, data is money in our technology world of today.
And so the asset value needs to be linked to two primary factors.
How sensitive is the data and how critical is the data.
If it gets into somebody's hands.
When we talk about data breaches, we're often referring back to hey, is this data critical in nature?
Is it going to severely hurt our company or organizations?
You can refer back to the complexity of sensitivity values when it comes to data.
And what I mean by that is is it secret, top secret, or just confidential when it comes to that asset
value or that data within that device?
When we talk about the criticality, we're really referring to how how vital is that information against
our company?
Are we going to see lawsuits?
Are we going to get fines because we we messed up on compliance issues.
How critical, if that data were to be lost or given up to somebody else through a data breach, would
that cause in essence, to our company as a whole, sometimes the critical nature of the data is just,
well, they have access to our price list that we were going to establish next week.
Is that a high critical value?
Probably not.
Is it sensitive nature?
Yeah, it's probably sensitive nature, especially if we're having a giant sale before Black Friday.
But is the asset value going to glean a high value because of it?
Probably not.
When we look at asset value, we must always take into account how sensitive the data is and how critical
it is to the company's well-being if that data was to be taken advantage of.
Finally, I want to talk about zero day attacks.
Zero day attacks are attacks that nobody knows about.
When we talk about a zero day attack, you're talking about a malware or an attack against a vulnerability
that was not yet discovered.
A zero day attack could be something as simple as hey, iPhone availability within the Ssz complex,
which allows me to take advantage of performance denial of service attack against SSH because there's
a vulnerability that was not normally known or unknown at the time that I've taken advantage of.
That would be still considered a zero day attack.
However, most people associate a zero day attack with being something that is high value that we didn't
normally know about or we have was previously unknown.
That now all of a sudden i.e. zero day, somebody takes advantage of that vulnerability and is able
to pull off an attack that takes advantage of that previously unknown vulnerability.
And that, in essence, is a zero day attack.