-: Interpreting the CVSS score.
So, the CVSS score
is the Common Vulnerability Scoring System,
also known as CVSS.
It is an industry standard for identifying
the severity of a given vulnerability.
So as we talked about in a previous lecture
when we talked about EternalBlue, it was a critical.
And that was based on the score that it got from its CVSS.
Now, analysts use this score
to help prioritize remediation efforts.
Things that have a higher CVSS score
should probably get fixed first
before things that have a lower CVSS score.
Now that's not always true,
and this is why we need humans in the loop
to figure out what impacts your particular network,
and determine what is more important.
But the CVSS score is a good starting point to consider.
Now this is measured in six categories.
There are six measures.
Three of them are an exploitability,
and three of them are an impact.
And the way these CVS scores look
is shown there on the bottom of the screen.
We're gonna cover each of those six metrics in this lesson.
Now, there are two versions of CVSS.
There's CVSS, and CVSS 3.0.
If you're studying for the CSA+ exam,
you need to focus on CVSS,
which this lesson is gonna focus on,
not the CVSS 3.0.
CVSS 3.0 really is very similar to CVSS.
The big difference, though,
is that it adds two more measures.
It adds a user interaction measure
underneath the exploitability metrics,
and it adds a scope metric which is covered in both
the exploitability and the impact metrics.
If you wanna see what the difference to those is,
look at the bottom of the screen here and you'll see,
the CVSS is smaller because it has two less metrics
than the CVSS 3.0 scores.
Now, let's cover some of these metrics.
The first one is the Access Vector, or AV metric.
This is gonna describe the method
that an attacker would have to exploit
to be able to use the vulnerability.
Now there's three categories here:
Local, Adjacent Network, and Network.
If it's a Local category,
it has the lowest metric because it's the least dangerous.
That means that attacker, to have used this exploit,
has to have physical or logical access to the local system,
meaning they pretty much have to be able to be
at the keyboard, touching it.
The next one, when you go to the medium,
is they have to be on the same network.
So they have to be inside your intranet
to be able to exploit you.
And then the third, most dangerous one
is if they can exploit it over the wide-area network,
or over the internet, because they can reach out
and touch you from across the world.
That is the most dangerous,
and you can see that its score is a 1.0,
so it has a much higher value,
which is gonna factor into that CVSS score
when we combine all of these metrics later on.
Access Complexity, or AC metric,
is gonna describe the difficulty that an attacker would have
to exploit a given vulnerability.
And again, this is a low-medium-high rating,
and if it's a low complexity,
it's gonna have the most danger to you
because there's no specialized conditions required.
The medium has somewhat specialized conditions,
and the high requires a very difficult,
or specialized set of conditions for it to be successful,
so its value is the lowest.
That one's a little backwards there, right?
High is actually less dangerous than a low,
which is more dangerous.
Now, the next one we're gonna talk about is Authentication,
or the Au Metric.
Authentication describes the number of times
than an attacker is gonna have to authenticate
to gain access during this exploit.
And again this goes, from low to high,
it's multiple, single, or none.
If you have multiple authentications,
like they'd have to do it two or more times,
that's not as dangerous as if they only had to do it once,
or singularly.
Now, if they don't have to authenticate at all,
that's really dangerous.
And so that none is gonna have no authentication required
has the highest-scoring part of that metric.
Now we get into the other metrics with Confidentiality,
and Confidentiality is gonna describe the impact
to the confidentiality of data processed on the system.
Now, the least would be if there is no impact
to confidentiality, and you can see it has a score of zero.
Partial would have some disclosure of information,
that's 0.275,
and then complete is gonna have a high at 0.660.
Now again, as we go through all these tables,
we do not have to memorize these scoring charts,
because Nessus and the other vulnerability measurement tools
will use this and do it automatically for us.
This is just for your reference
if you're trying to figure out
what each of these categories mean,
and how that score actually looks.
Now, with a complete,
that means every piece of information has been disclosed.
So for instance, if there was a data breach,
but the file they stole was encrypted,
that might be listed as a partial.
But if it was a complete, because it was in plain text,
that would be a complete.
Integrity, this measures the integrity of the system, right?
It describes the impact to the integrity of the data
processed by the system.
Again, None, Partial and Complete,
same as we did with Confidentiality,
but in this case we're looking at integrity.
The next one is Availability, and it's the same thing:
None, Partial, and Complete.
This describes the impact to the availability of the system.
So again, those three are the CIA triad.
So on this screen you can see the CVSS Vector
and the way that it's put together.
This gives you a single-line format
to show the vulnerability ratings across all six metrics.
So if you look here on the first line,
you'll see the CVSS base score was 10.0.
That's a critical vulnerability.
In the case of this one, it was calculated using the CVSS
two-scoring mechanism,
and we have the six different categories.
For the first category, AV, Access Vector,
it was over the network,
meaning somebody can get to it over the internet,
making this very, very dangerous.
Next, you have the complexity of that access.
And the Access Complexity here was low
because it didn't take much to do it.
There was no specialized tools needed.
That makes it, again, very dangerous.
Now, when we talk about the authentication,
there was none required.
You didn't need a username and password
to be able to use this exploit.
So therefore, again, very dangerous.
We have three very dangerous things in a row,
you can start to see why this is a critical vulnerability.
And then we look at the CIA triad, right?
Confidentiality was complete, Integrity was complete,
and Availability was complete.
All those are the three most dangerous.
So this one, across the board,
was a very, very dangerous vulnerability
to have on your system,
and that's why it got a critical, or 10.0 score.
We'll talk about those scores in a little bit more detail
in a future lesson.
That's why I give you an idea
of how this is all put together
as you interpret the CVSS score.
(audio logo)