When we talk about scanning, and we often refer to our cvss scores as the resigning factor of what
gets prioritized or fixed first.
Usually, a high Cvss score indicates that we have a critical vulnerability that's easy to pull off,
and in return, we want to prioritize that fix to be at the top of the priority list.
Right.
However, context awareness is something that we need to be aware of.
If I have a high cvss score for an item that is air gapped with behind a system, meaning that it doesn't
have access to the network, it's behind lock and key.
But it's a critical vulnerability.
But it costs like an enormous amount of money to fix.
Do I really need to fix that, that high Cvss score item right away?
When we think about prioritization of critical components or critical vulnerabilities within our network,
we always have to keep in mind our context awareness Usually we dictate this by who, what, when,
where, and sometimes how.
The how.
Being already written into the Cvss score of how easy is it to pull off this vulnerability?
Or I should say, this exploit against this vulnerability?
Who would be going after it?
This is where we kind of look at it from, who has the capability.
I can have a critical vulnerability that could take root access, but if it's behind an air gapped system,
the chances of someone being able to actually get into that system, the who would only be our internal
employees, meaning that unless you're an internal employee, you don't have access to the system and
may not pay off to fix that vulnerability right away.
On the flip side, if I have a critical vulnerability, but it has very high technical requirements,
the Cvss score may be in the middle somewhere, but who has the actual capabilities of pulling it off?
Windows is notorious for having vulnerabilities, especially in something like Windows 7 or older windows
XP systems that when they came out, they had critical vulnerabilities that Microsoft knew about.
However, the capabilities actually exploit those vulnerabilities didn't actually exist.
And so while it yes, it was a critical vulnerability, the capability to actually enact or exploit
those vulnerabilities?
Was it so enormously high that it really wasn't worth fixing?
We call this context awareness when we think about context awareness.
The other crucial aspect is internal, external or isolated.
Now, I kind of referred to this a little bit already when I talked about an air gap system being isolated
from the rest of my network, and we talked about how it really didn't make sense for anybody to gain
access to it outside of our normal environment.
It would take an internal employee.
However, we also have context awareness to internal aspects of it.
Being that hey is an internal flaw that only somebody inside my network can see and take advantage of.
While we have internal flaws or internal, uh, employees that can take advantage of those.
We have to understand also that not every internal employee necessarily has the capability to enact
or to exploit a specific vulnerability.
If I have a vulnerability with a critical component to it, meaning that it has a critical point which
allows root access into the system, but it takes a high degree of capability to gain access to it,
then there's probably only a handful of employees within my enterprise environment that could actually
take advantage of that, uh, vulnerability.
So we need to look at the internal aspects of it.
We also need to look at it, the external aspects of it.
Do I have a high vulnerability with a low technical component to it, where you have to be a mastermind
of technology to not only see the vulnerability, but able to exploit the vulnerability as well?
And we call those external components.
Right.
So is it external to our network?
Is it internal to our network, or is it an isolated network aspect that we need to be aware of?
Remember, when we're looking at vulnerabilities, when we're looking at the exploited ness of a vulnerability,
we always have to have context awareness.
How easy is it for this vulnerability to actually be attacked from internal forces, from external forces,
or is it an isolated incident that could take place?
When we're looking at context awareness, be aware of your surroundings.
Be aware.
Hey, does it make sense to spend the amount of money to cover this vulnerability, or does it make
more sense to let it go and and hide it or mitigate it behind a defense in depth infrastructure?