BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Why Exploitability Matters

Posted July 19, 2011    Morey Haber

The most common vulnerability scoring system used by vendors and regulatory initiatives is CVSS (the Common Vulnerability Scoring System). It provides a vendor agnostic open scoring standard to model vulnerability severity and provide guidance on prioritization of remediation efforts. The basic metrics allows for rating a vulnerability based on the severity of its components like Access Vector, Access Complexity, Authentication Method, etc.

One of the key components outside of the base scoring for CVSS are the Temporal Metrics. These represent three time dependent descriptors for the vulnerability. They are:

  1. Exploitability provides a measure of how complex the process is to exploit the vulnerability in a specific target system. This is vulnerability specific.
  2. Remediation Level provides a measurable level of an available solution. This can be everything from an official security fix to no solution is, and will be, available.
  3. Report Confidence measures the confidence in the existence of the vulnerability, as well as the credibility of its existence.

The Exploitability metric is the most important in this calculation. It provides guidance using four different criteria:

  • Unproven: No exploit code is yet available (time dependent)
  • Proof of Concept: Proof of concept exploit code is available at the time of scoring
  • Functional: Functional exploit code is available
  • High: Exploitable by functional mobile autonomous code or no exploit required and can be a manual trigger

This metric allows for a vulnerability to be graded using the CVSS scoring system based on the possibility of exploitation.

So why does this matter?

The vulnerability risk score is not enough to prioritize remediation efforts for your environment. The base calculation fails to take into consideration whether someone (or something) can easily exploit the vulnerability, how difficult it will be mitigate the risk, and real world confidence at any point in time that the reported vulnerability is credible especially related to assets contained within your infrastructure. This is why CVSS Temporal Metrics are so important and why the Exploitability Metric is crucial for prioritization efforts. It takes into consideration not only the vulnerability severity, but also how real the threat is for exploitation in your environment at a given time.

Retina CS 2.5 provides for CVSS Temporal and Environmental Scoring and the ability to adjust the values for Exploitation to meet your organization needs. This value weights the score based on your knowledge of the vulnerability in relationship to your infrastructure and conditions for remediation and credibility.

It is important to note that eEye provides references for penetration testing and exploitability code within exploit-db.com, Metasploit Framework, and Core Impact, but this is by no means the end all be all source for the complete existence of exploits available. This is only a partial list from the most well known sources that are publicly and commercially available. This can assist you in setting the Exploitability metric, but as indicated, is not an absolute source. In fact, there is no global source since many exploits occur in the wild and may appear as zero days first, or the front pages of a newspaper with minimal technical details. This is why this feature is user definable and critical for understanding why exploitability matters for your business. Without it, understanding the vulnerability is solely based on risk and not if it can be truly exploited within your infrastructure.

For more information on how Retina CS can help you manage your vulnerabilities and their potential exploitation, please click here. eEye understands prioritizing your time and effort for remediation is just as important as indentifying the vulnerability in the first place. We provide the best solutions for both.

Morey J. Haber
Product Management

 

Additional articles

Sudo_logo

Don’t Create a Different sudoers File for Each System

Posted May 20, 2015    Randy Franklin Smith

What if you have multiple Linux and/or Unix systems? Sudo management can become onerous and unwieldy if you try to manage a different sudoers file on each system. The good news is that sudo supports multiple systems.

password-safety

What Does Microsoft Local Administrator Password Solution Really Do?

Posted May 19, 2015    Morey Haber

LAPS is a feature that allows the randomization of local administrator accounts across the domain. Although it would seem that this capability overlaps with features in BeyondTrust’s PowerBroker Password Safe (PBPS), the reality is it is more suited for simple use cases such as changing the local Windows admin account and not much more.

Tags:
, ,
webinar_ondemand

On Demand Webinar: Securing Windows Server with Security Compliance Manager

Posted May 14, 2015    BeyondTrust Software

On Demand Webinar: Security Expert Russell Smith, explains how to use Microsoft’s free Security Compliance Manager (SCM) tool to create and deploy your own security baselines, including user and computer authentication settings.

Tags:
, ,