BeyondTrust

Security In Context

Bringing you news and commentary on solutions and strategies for protecting your critical IT infrastructure.

Why Exploitability Matters

Post by Morey Haber July 19, 2011

The most common vulnerability scoring system used by vendors and regulatory initiatives is CVSS (the Common Vulnerability Scoring System). It provides a vendor agnostic open scoring standard to model vulnerability severity and provide guidance on prioritization of remediation efforts. The basic metrics allows for rating a vulnerability based on the severity of its components like Access Vector, Access Complexity, Authentication Method, etc.

One of the key components outside of the base scoring for CVSS are the Temporal Metrics. These represent three time dependent descriptors for the vulnerability. They are:

  1. Exploitability provides a measure of how complex the process is to exploit the vulnerability in a specific target system. This is vulnerability specific.
  2. Remediation Level provides a measurable level of an available solution. This can be everything from an official security fix to no solution is, and will be, available.
  3. Report Confidence measures the confidence in the existence of the vulnerability, as well as the credibility of its existence.

The Exploitability metric is the most important in this calculation. It provides guidance using four different criteria:

  • Unproven: No exploit code is yet available (time dependent)
  • Proof of Concept: Proof of concept exploit code is available at the time of scoring
  • Functional: Functional exploit code is available
  • High: Exploitable by functional mobile autonomous code or no exploit required and can be a manual trigger

This metric allows for a vulnerability to be graded using the CVSS scoring system based on the possibility of exploitation.

So why does this matter?

The vulnerability risk score is not enough to prioritize remediation efforts for your environment. The base calculation fails to take into consideration whether someone (or something) can easily exploit the vulnerability, how difficult it will be mitigate the risk, and real world confidence at any point in time that the reported vulnerability is credible especially related to assets contained within your infrastructure. This is why CVSS Temporal Metrics are so important and why the Exploitability Metric is crucial for prioritization efforts. It takes into consideration not only the vulnerability severity, but also how real the threat is for exploitation in your environment at a given time.

Retina CS 2.5 provides for CVSS Temporal and Environmental Scoring and the ability to adjust the values for Exploitation to meet your organization needs. This value weights the score based on your knowledge of the vulnerability in relationship to your infrastructure and conditions for remediation and credibility.

It is important to note that eEye provides references for penetration testing and exploitability code within exploit-db.com, Metasploit Framework, and Core Impact, but this is by no means the end all be all source for the complete existence of exploits available. This is only a partial list from the most well known sources that are publicly and commercially available. This can assist you in setting the Exploitability metric, but as indicated, is not an absolute source. In fact, there is no global source since many exploits occur in the wild and may appear as zero days first, or the front pages of a newspaper with minimal technical details. This is why this feature is user definable and critical for understanding why exploitability matters for your business. Without it, understanding the vulnerability is solely based on risk and not if it can be truly exploited within your infrastructure.

For more information on how Retina CS can help you manage your vulnerabilities and their potential exploitation, please click here. eEye understands prioritizing your time and effort for remediation is just as important as indentifying the vulnerability in the first place. We provide the best solutions for both.

Morey J. Haber
Product Management

 

Additional articles

smart rules manager for vulnerabilities

Staying on Top of the Latest Vulnerabilities with BeyondInsight v5.1

It’s no secret that dozens of new OS and application vulnerabilities are revealed every day. Staying on top of these new exposures normally requires paying for services or subscribing to multiple RSS feeds. BeyondInsight 5.1 provides customers with another option: a built-in, customizable vulnerability alerting system that delivers up-to-date information on the latest vulnerabilities in…

Post by Morey Haber April 21, 2014
Tags:
, , , , , ,
BI-Qualys-Connector-IMG1

Getting More Value from QualysGuard Vulnerability Data with BeyondInsight v5.1

If your vulnerability assessment scans can’t produce meaningful and actionable reports, performing a scan does no good for anyone. If you’ve read my other blog posts, you know I have no qualms about stating that BeyondTrust provides the best vulnerability reporting in the industry. Ask your favorite analyst and they’ll tend to agree. Of course,…

Post by Morey Haber April 18, 2014
Tags:
, , , , , , , ,
insider-threat-fed

Mitigating Inside Threats to U.S. Federal IT Environments

Recent high-profile cases have increased the perceived risks that go along with disclosure and usage of confidential information. One of the most difficult security threats to mitigate is an attack from the inside. When an over-privileged user, such as an unhappy current or former employee, contractor, or consultant, begins navigating your network, how will you…

Post by BeyondTrust Software April 17, 2014
Tags:
, , , , ,