BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Why Exploitability Matters

Posted July 19, 2011    Morey Haber

The most common vulnerability scoring system used by vendors and regulatory initiatives is CVSS (the Common Vulnerability Scoring System). It provides a vendor agnostic open scoring standard to model vulnerability severity and provide guidance on prioritization of remediation efforts. The basic metrics allows for rating a vulnerability based on the severity of its components like Access Vector, Access Complexity, Authentication Method, etc.

One of the key components outside of the base scoring for CVSS are the Temporal Metrics. These represent three time dependent descriptors for the vulnerability. They are:

  1. Exploitability provides a measure of how complex the process is to exploit the vulnerability in a specific target system. This is vulnerability specific.
  2. Remediation Level provides a measurable level of an available solution. This can be everything from an official security fix to no solution is, and will be, available.
  3. Report Confidence measures the confidence in the existence of the vulnerability, as well as the credibility of its existence.

The Exploitability metric is the most important in this calculation. It provides guidance using four different criteria:

  • Unproven: No exploit code is yet available (time dependent)
  • Proof of Concept: Proof of concept exploit code is available at the time of scoring
  • Functional: Functional exploit code is available
  • High: Exploitable by functional mobile autonomous code or no exploit required and can be a manual trigger

This metric allows for a vulnerability to be graded using the CVSS scoring system based on the possibility of exploitation.

So why does this matter?

The vulnerability risk score is not enough to prioritize remediation efforts for your environment. The base calculation fails to take into consideration whether someone (or something) can easily exploit the vulnerability, how difficult it will be mitigate the risk, and real world confidence at any point in time that the reported vulnerability is credible especially related to assets contained within your infrastructure. This is why CVSS Temporal Metrics are so important and why the Exploitability Metric is crucial for prioritization efforts. It takes into consideration not only the vulnerability severity, but also how real the threat is for exploitation in your environment at a given time.

Retina CS 2.5 provides for CVSS Temporal and Environmental Scoring and the ability to adjust the values for Exploitation to meet your organization needs. This value weights the score based on your knowledge of the vulnerability in relationship to your infrastructure and conditions for remediation and credibility.

It is important to note that eEye provides references for penetration testing and exploitability code within exploit-db.com, Metasploit Framework, and Core Impact, but this is by no means the end all be all source for the complete existence of exploits available. This is only a partial list from the most well known sources that are publicly and commercially available. This can assist you in setting the Exploitability metric, but as indicated, is not an absolute source. In fact, there is no global source since many exploits occur in the wild and may appear as zero days first, or the front pages of a newspaper with minimal technical details. This is why this feature is user definable and critical for understanding why exploitability matters for your business. Without it, understanding the vulnerability is solely based on risk and not if it can be truly exploited within your infrastructure.

For more information on how Retina CS can help you manage your vulnerabilities and their potential exploitation, please click here. eEye understands prioritizing your time and effort for remediation is just as important as indentifying the vulnerability in the first place. We provide the best solutions for both.

Morey J. Haber
Product Management

 

Additional articles

VMware Hardening Guidelines-img3

How to Audit VMware ESX and ESXi Servers Against the VMware Hardening Guidelines with Retina CS

Posted February 27, 2015    BeyondTrust Research Team

Retina CS Enterprise Vulnerability Management has included advanced VMware auditing capabilities for some time, including virtual machine discovery and scanning through a cloud connection, plus the ability to scan ESX and ESXi hosts using SSH. However, in response to recent security concerns associated with SSH, VMware has disabled SSH by default in its more recent…

Tags:
, , , ,
dave-shackleford-headshot

Privileged Passwords: The Bane of Security Professionals Everywhere

Posted February 19, 2015    Dave Shackleford

Passwords have been with us since ancient times. Known as “watchwords”, ancient Roman military guards would pass a wooden tablet with a daily secret word engraved from one shift to the next, with each guard position marking the tablet to indicate it had been received. The military has been using passwords, counter-passwords, and even sound…

Tags:
, , ,
Privileged Account Management Process

In Vulnerability Management, Process is King

Posted February 18, 2015    Morey Haber

You have a vulnerability scanner, but where’s your process? Most organizations are rightly concerned about possible vulnerabilities in their systems, applications, networked devices, and other digital assets and infrastructure components. Identifying vulnerabilities is indeed important, and most security professionals have some kind of scanning solution in place. But what is most essential to understand is…

Tags:
, , , , ,