Let us continue with little assessment in the previous lectures.
We saw what is meant by a vulnerability assessment and the phases of vulnerability assessment.
But the main question is, how do security experts define the range of uncertainty?
How do they retreat?
And therefore they use the vulnerability scoring systems.
Now, what are these scoring systems?
There are three major types of vulnerabilities, scoring systems, which are, as you can see on the
screen.
The first is common vulnerabilities scoring system that is sevices.
Second is common vulnerability and exposure.
That is key.
And the last one is national vulnerability database.
And really all of this we're going to see in a couple of minutes.
So without wasting any much time, I will directly take you to the website of Common Volatility's scoring
system that is C.V SS.
So right now on Google, just type common.
Vulnerability scoring system, you can see this just click into now the forced website that is forced
dot or you have to click there and the common vulnerability scoring system provides a way to capture
the principal characteristics.
Now, what does that mean?
That means CVN Services provides an open framework for communicating the characteristics and impact
of I.T. vulnerabilities, its quantitative model, and choose that repeatable and accurate measurement
while enabling users to see underlying vulnerability characteristics that were used to generate the
scores.
So how to generate the scores?
I will show you a quick demonstration.
If you go to the calculator section here, you can see calculator and now you have to input the values
in the base score tab and depending upon the base score tab, the final score gets calculator to see
how.
Now suppose you find out of an error in a website and according to that you have to give the Choose
the Values calculator.
So how did you attack the network?
Using network, using actors and apps using physical or local?
Now, since it was a website, I will choose a network.
It was built on network.
OK, now scope of the negative.
What was the school?
Whether it was what does a scope define.
So does a successful attack impact a component other than the one level component?
If so, the base code increases.
So now what was the scope, the scope change after the attack or.
No, no.
It remained unchanged, so unchanged at that complexity was low or high and there is no medium option.
So to just register the score, please select low confidentiality if it revealed any database or any
admin passwords.
Well, let's for for our example, let's click on the database was revealed integrity.
It was high and availability was low because, you know, it is not a vulnerability which actually made
an effect on the availability, not privileges required law, because we found not the admin password.
So we didn't actually require to attack the admin account and user interaction was required.
Yes, it was required.
So you can see after clicking Disvalue, the automatically the score of the calculator.
Now the base code is seven point six.
And now if not, let's say you find find this vulnerability and then submit it to some organization
and it easily accepted Norm.
You have to provide other measures.
You have to provide a proof of concept and then they will actually analyze and then they'll provide
the score.
If you scroll down, exploit code maturity.
Now, whether it is unproven, proof of concept, functional or high iSelect proof of concept, so it
clue, then the report confirms now how you are reporting this vulnerability.
Now, if you are a security expert and you tell that probably, yes, I have got the database fully
confirmed and let's say you got a name and password and then you try accessing the website using those
passwords and more successful, which means the confidence is confirmed, then modified attack vector,
multiple attack complexity.
These are the values you have to fill and then you will get the final scores.
For example, confidentiality requirement was medium integrity of medium and availability.
Let's say confidentiality was high and presto, things are medium now modified attack vector network
at local level it was network.
Then multiple attack complexity was high, then modified privileges required were law modified user
interaction none.
Then modify the scope, Ms unchanged, modify the confidentiality, none, so it became medium or let's
say high, and it changes to a high modifier integrity, high quality high.
So this is the final score.
So base score is seven point six and seven point two.
And this is the final attack string.
So you can see a hell of a liberty confidential.
These are high, low values.
So this vector string you have to submit to the organization and then they will decide and give credit
to your vulnerability.
So this is how a common vulnerability score system works.
You have to provide the input and it will give you the output in the form of the score.
The next scoring system is common vulnerability and exposure to start with common vulnerability and
exposure.
This team.
So as you can see on the Google just type.
Seifi and hit Enter it is a website of Mitre organization, so just click the first website.
Now, yes, you can see the latest TV news become a numbering authority and let us see sort the civilised.
Here we can see if I just click on S.V. of Askew Injection, let us see what I can get here.
Oh, yes, so as conviction has these are these are the sleeves, so you can see the force stands for
the year and this number stands that if the next number stands for the number total number of vulnerabilities
reported in that year.
So you can see in 2020, around nine thousand one, they have already reported.
And if you click anywhere on the vulnerability, you can see the vulnerability number.
See, this is the number we learn more about national voluntary database.
We'll see it in a couple of minutes.
Then assigning CNN, who has assigned this CV to the person, then description and proposed.
Now it is in this case, no one has shared the name they have kept it confidential for, I don't know,
for public purposes or what.
So this is how CV works, particularly if you look at national vulnerability database.
We can see that.
Yes.
So see the explosion, see any Biscoe?
It's critical vulnerability.
You can see these are the possible vectors that impact expertise.
Kuris three point nine attack victories, network attack complexities, law prevents requirements and
no privileges are required to modify this vulnerability, which is a very critical thing.
So weaknesses, changes to, etc..
So this was all for this lecture.
From the next lecture onwards, we will start with automating one liberty assessment using the necessary
tool.