BeyondTrust

Security In Context

Bringing you news and commentary on solutions and strategies for protecting your critical IT infrastructure.

Why Exploitability Matters

Post by Morey Haber July 19, 2011

The most common vulnerability scoring system used by vendors and regulatory initiatives is CVSS (the Common Vulnerability Scoring System). It provides a vendor agnostic open scoring standard to model vulnerability severity and provide guidance on prioritization of remediation efforts. The basic metrics allows for rating a vulnerability based on the severity of its components like Access Vector, Access Complexity, Authentication Method, etc.

One of the key components outside of the base scoring for CVSS are the Temporal Metrics. These represent three time dependent descriptors for the vulnerability. They are:

  1. Exploitability provides a measure of how complex the process is to exploit the vulnerability in a specific target system. This is vulnerability specific.
  2. Remediation Level provides a measurable level of an available solution. This can be everything from an official security fix to no solution is, and will be, available.
  3. Report Confidence measures the confidence in the existence of the vulnerability, as well as the credibility of its existence.

The Exploitability metric is the most important in this calculation. It provides guidance using four different criteria:

  • Unproven: No exploit code is yet available (time dependent)
  • Proof of Concept: Proof of concept exploit code is available at the time of scoring
  • Functional: Functional exploit code is available
  • High: Exploitable by functional mobile autonomous code or no exploit required and can be a manual trigger

This metric allows for a vulnerability to be graded using the CVSS scoring system based on the possibility of exploitation.

So why does this matter?

The vulnerability risk score is not enough to prioritize remediation efforts for your environment. The base calculation fails to take into consideration whether someone (or something) can easily exploit the vulnerability, how difficult it will be mitigate the risk, and real world confidence at any point in time that the reported vulnerability is credible especially related to assets contained within your infrastructure. This is why CVSS Temporal Metrics are so important and why the Exploitability Metric is crucial for prioritization efforts. It takes into consideration not only the vulnerability severity, but also how real the threat is for exploitation in your environment at a given time.

Retina CS 2.5 provides for CVSS Temporal and Environmental Scoring and the ability to adjust the values for Exploitation to meet your organization needs. This value weights the score based on your knowledge of the vulnerability in relationship to your infrastructure and conditions for remediation and credibility.

It is important to note that eEye provides references for penetration testing and exploitability code within exploit-db.com, Metasploit Framework, and Core Impact, but this is by no means the end all be all source for the complete existence of exploits available. This is only a partial list from the most well known sources that are publicly and commercially available. This can assist you in setting the Exploitability metric, but as indicated, is not an absolute source. In fact, there is no global source since many exploits occur in the wild and may appear as zero days first, or the front pages of a newspaper with minimal technical details. This is why this feature is user definable and critical for understanding why exploitability matters for your business. Without it, understanding the vulnerability is solely based on risk and not if it can be truly exploited within your infrastructure.

For more information on how Retina CS can help you manage your vulnerabilities and their potential exploitation, please click here. eEye understands prioritizing your time and effort for remediation is just as important as indentifying the vulnerability in the first place. We provide the best solutions for both.

Morey J. Haber
Product Management

 

Additional articles

insider-threat-fed

Mitigating Inside Threats to U.S. Federal IT Environments

Recent high-profile cases have increased the perceived risks that go along with disclosure and usage of confidential information. One of the most difficult security threats to mitigate is an attack from the inside. When an over-privileged user, such as an unhappy current or former employee, contractor, or consultant, begins navigating your network, how will you…

Post by BeyondTrust Software April 17, 2014
Tags:
, , , , ,

Are you a Target? Investigating Security Breaches with Kevin Johnson

Last week, over 1,000 IT security professionals watched as Kevin Johnson, CEO of Secure Ideas, presented his expert opinion on lessons learned from recent, high-profile retail breaches. Here’s a summary of key takeaways from the webcast plus an on-demand recording of the full, 60-minute presentation. Understanding the “why” behind attacks According to Kevin, the primary…

Post by Chris Burd April 17, 2014
Tags:
, , , , ,

Vulnerability Expert Forum Highlights: April 2014

We had a great turnout for last week’s April 2014 Vulnerability Expert Forum (VEF) webcast. BeyondTrust Research experts, Carter and DJ, provided in-depth knowledge about the latest vulnerabilities and their potential impacts on network environments. Below are highlights from the Forum, plus an on-demand video of the presentation. Latest critical vulnerabilities, vendor patches, and zero-day…

Post by Chris Burd April 16, 2014
Tags:
, , , , ,