-: The CVSS temporal score.
So we talked about the base score,
now's let's talk about the temporal score.
A temporal score changes over
the lifetime of the vulnerability,
where the bay score always stays the same.
So in the example of the last one we looked at.
It was a 10.0 or critical when it first came out.
But as exploits are developed, disclosed,
and mitigations are made available.
The score will change and in this case the CVSS score now,
about six months later is down to a 7.8,
because patches have become available
and mitigations have been put in place.
Let's look at how this score breaks down
to get an understanding of the temporal score.
Now before we do that, I want to remind you,
that the temporal score is not covered by CSA+ exam.
But it is very good to know during real world analysis.
And that's why we're gonna cover it here.
Temporal metrics are made up of three things.
The exploitability, the remediation level,
and the report confidence.
The exploitability piece of the temporal metric
is the current state of exploitation techniques
or automated exploitation that's available.
When we look at that exploitability metric
it is gonna show five different categories.
Unproven, proof of concept, functional,
high and not defined.
And as you go up those scores are gonna get
higher and higher because if it's unproven,
it's kinda like in beta,
there may be something that's exploitable,
but we're not sure.
Proof of concept means somebody has proven it
at least once and done some research to show it.
Functional means there is a workable exploit
that's out there in the wild
and everyone pretty much knows how to use it.
And high means there's pretty much automated code
like a worm or a Trojan that can use this
and do the exploitation on it's own
making that very, very dangerous.
So you'll see as those scores are gonna rise,
as the exploitability gets better and better.
The next one we look at is our remediation level,
or the RL metric.
This is used to decrease temporal scores
as mitigations and fixes become available.
Because as we start patching and mitigating things
we need to start lowering that score,
going from that 10 down to that
seven point something, right.
Now when we get to report confidence,
this is our third piece of the temporal score.
It's used to show the level of confidence
in the existence of the vulnerability
and the technical details of that report.
And this is broken down into four areas as well.
Unconfirmed, uncorroborated, confirmed and not defined.
Just like we talked about in the last slide,
we have those same type of things.
Single unconfirmed source,
multiple sources that kind of agree, but not exactly,
and then acknowledged and confirmed
by the vendor or manufacturer themselves.
And you can see that those scores go up
showing the level of confidence is higher in those reports.
Now when we put all those together
we get a temporal score and this is how you calculate it.
The temporal score equals the base score,
times the exploitability, times the remediation level,
times the report confidence
and that will actually bring those scores down over time,
going from that 10 to the 7.8 as that thing has been out.
We have confirmed that the reports are good.
We have confirmed that the vulnerability does exist
and we have confirmed that there are
working patches out there.
That score is gonna keep dropping down.
And that's the idea of a temporal report
and a temporal score.
I want you to understand this just a little bit,
but again, if you're studying for the CSA+,
don't worry too much about it,
except to know that it exists.
If you're doing this in real life though.
Temporal scores are actually
a little bit more important that a base score.
Because a vulnerability that came out in 1999
that was a 10, may not be a 10 today.
And so it may not be the most important thing
for you to focus on.
And so you have to take that into account
as you're prioritizing what you're gonna fix
and thinking about what your network is exposed to.