Cyberstudy
PDF p.240 In progress

Common Vulnerabilities and Exposures

Open PDF at p.240 26 flashcards

Summary

PDF p.240

Common Vulnerabilities and Exposures (CVE) is a dictionary of publicly known information security vulnerabilities and exposures. It provides a standardized identifier for each vulnerability, facilitating the sharing of data across different platforms and tools.

In plain words

Supplementary — not from your PDF

CVE is the public dictionary of known vulnerabilities. Each gets an identifier such as CVE-2023-1234, a description, references and a date. NIST's National Vulnerability Database (NVD) adds severity, affected versions and fixes. CVSS scores severity from 0 to 10: Low 0.1+, Medium 4.0+, High 7.0+, Critical 9.0+. Scanners stay current through vulnerability feeds (Nessus plug-ins, OpenVAS NVTs), often delivered with SCAP.

Detailed explanation

PDF p.240
  • Vulnerability Feeds
    • Definition: Information about known vulnerabilities used to keep automated scanners up to date.
    • Examples: Nessus refers to these as plug-ins, OpenVAS calls them network vulnerability tests (NVTs).
    • Importance: Essential for maintaining the effectiveness of vulnerability scans.
  • National Vulnerability Database (NVD)
    • Definition: A repository maintained by NIST providing detailed information about known software vulnerabilities.
    • Content: Vulnerability descriptions, severity ratings, affected software versions, mitigation measures.
    • Website: NVD
  • Security Content Automation Protocol (SCAP)
    • Definition: A protocol used by many vulnerability scanners to obtain feed or plug-in updates.
    • Function: Compares system configurations to secure baselines and uses common identifiers for consistency.
  • Common Vulnerabilities and Exposures (CVE)
    • Definition: A dictionary of vulnerabilities in published operating systems and application software.
    • Elements
      • Identifier: Format CVE-YYYY-#### (e.g., CVE-2023-1234).
      • Description: Brief summary of the vulnerability.
      • Reference List: URLs for more information.
      • Creation Date: When the entry was created.
    • Principal Input: Provides data for NIST's NVD.
  • Common Vulnerability Scoring System (CVSS)
    • Definition: A system maintained by the Forum of Incident Response and Security Teams to score vulnerabilities.
    • Scoring: Generates a score from 0 to 10 based on characteristics like remote triggerability, local access, user intervention.
    • Score Bands
      • 0.1+: Low
      • 4.0+: Medium
      • 7.0+: High
      • 9.0+: Critical

Important terms

taken from the text above
Vulnerability Feeds
Information about known vulnerabilities used to keep automated scanners up to date.
National Vulnerability Database (NVD)
A repository maintained by NIST providing detailed information about known software vulnerabilities.
Website
NVD
Security Content Automation Protocol (SCAP)
A protocol used by many vulnerability scanners to obtain feed or plug-in updates.
Common Vulnerabilities and Exposures (CVE)
A dictionary of vulnerabilities in published operating systems and application software.
Identifier
Format CVE-YYYY-#### (e.g., CVE-2023-1234).
Reference List
URLs for more information.
Creation Date
When the entry was created.
Principal Input
Provides data for NIST's NVD.
Common Vulnerability Scoring System (CVSS)
A system maintained by the Forum of Incident Response and Security Teams to score vulnerabilities.
Scoring
Generates a score from 0 to 10 based on characteristics like remote triggerability, local access, user intervention.
0.1+
Low
4.0+
Medium
7.0+
High
9.0+
Critical
CVE Common Vulnerabilities and Exposures NVD National Vulnerability Database SCAP Security Content Automation Protocol CVSS Common Vulnerability Scoring System

Examples & real-world scenarios

Supplementary — not from your PDF
  • Looking up a CVE in the NVD to see affected versions.
  • A CVSS 9.8 rated Critical.
  • A scanner updating its plug-ins before a scan.

Scenario

A scan report lists a CVE with CVSS 7.5. The analyst checks the NVD entry to confirm the affected versions match what's installed before scheduling the patch.

Common mistakes

Supplementary — not from your PDF
  • Mixing up CVE (the identifier dictionary) and CVSS (the scoring system).
  • Getting the CVSS bands wrong. 7.0 is High, 9.0 is Critical.

Practical skills

Supplementary — not from your PDF
  • Read a CVE entry and map its CVSS score to a severity band.

What I should remember

Key Points PDF p.240
  • Vulnerability Feeds
    • Definition: Updates for automated scanners.
    • Examples: Nessus plug-ins, OpenVAS NVTs.
  • National Vulnerability Database (NVD)
    • Definition: Repository of detailed vulnerability information.
    • Content: Descriptions, ratings, versions, mitigation.
  • Security Content Automation Protocol (SCAP)
    • Definition: Protocol for feed updates.
    • Function: Configuration comparison, common identifiers.
  • Common Vulnerabilities and Exposures (CVE)
    • Definition: Dictionary of known vulnerabilities.
    • Elements: Identifier, description, references, creation date.
  • Common Vulnerability Scoring System (CVSS)
    • Definition: System for scoring vulnerabilities.
    • Scoring: 0 to 10 based on characteristics.
    • Score Bands: Low, Medium, High, Critical.