-: Calculating your CVSS Score.
Now, I'm going to give you a warning up front.
We're going to do some math inside this lesson.
This lesson, you can feel free to skip ahead,
you really don't need it, because all the tools
are gonna calculate your CVSS score for you.
And, again, on the CSA+ exam, you're not gonna
be asked to calculate a CVSS score,
but I wanted to show you how they were broken down
so you can understand all those charts we went through
in the last lesson, how they come together
to get you that 10.0 number, or whatever number it is.
So we're going to get started here with the CVSS score.
This is based on the version two CVSS score.
How is your base score calculated?
Well, its calculated using this formula.
Exploitability, impact, and you put those together,
each with a different weighting function,
and then you're gonna assess it with the impact,
put it all together and you'll get a base score.
Now, I'm going to break this down
as we go through the last example,
the one here on the board, and calculate how we got to 10.0.
Exploitability, the first piece is your exploitability,
and we calculate that by doing exploitability,
which equals 20 times access vector times your
access complexity times you authentication.
So this is a pretty simple math problem.
So we take exploitability equals
20 times 1.0, which was our network rating, right,
times 7.10, our low rating, times .704,
which was our none rating for our access vector,
access complexity, and authentication.
You put all those together, you multiply 'em
in a calculator, you're gonna get 9.9968,
which, rounded up to two decimal places, is,
or to one decimal place, is 10.0.
That's just one piece, that's not our final CVSS base score.
That's just our index for exploitability itself.
Now, let's look at integrity, or excuse me the impact score.
The impact score is gonna be based
off the confidentiality, integrity, and availability, right,
and this one's a little bit more complicated,
as you can see on the screen here.
The impact is going to equal 10.41 times
one minus one minus confidentiality's impact
times one minus the integrity's impact
times one minus the availability's impact.
And in our case, all three of those were complete,
which does make our math a little bit easier,
because that means they're all .660.
I plugged that into the screen as you see,
and out comes another 10.0, so we have 10.0
for our exploitability and a 10.0 for our impact.
Now, how do we put those together
to get our final base score?
Well, our base score is going to be point six,
or 60% is based on impact, 40%,
or point four is based on exploitability,
and then we have this function of impact,
which, if the impact was zero, you get a zero,
otherwise you're going to use this factor of 1.176.
I told you this was a little bit of a math lesson,
but don't worry too much about that.
You plug all those in and out comes 9.996,
rounded up to one decimal place is 10.0,
which, again, gives us exactly what Nessus had calculated
for us, a 10.0 score, which means it was critical.
Now, why is that base score so important?
This is the part that you really want to understand.
Based on that number rating,
you're gonna get a risk category.
If you're less than 4.0, it's low.
If it's four to six, it's a medium.
And if it's between six and 10, it's a high.
And if you're a 10.0, you are critical.
In the case of this one, it was a 10.0,
it was a critical vulnerability.
But now you can see how it kind of breaks down
and how it's weighted between the exploitability
and the impact to a given system.
You put all that together and you get this final base score,
which is what we calculated in this lesson.
If you're gonna learn anything from this lesson,
the one thing you do want to memorize
is this chart right here,
it's where those break points are in the scoring.
Less than four is low, four to six is medium,
six to 10 is high, and 10 itself is a critical.
If you remember that, you'll do just fine on test day,
and you'll understand where criticality comes from,
based on your base score.