In this episode,
we're going to discuss CBS S common vulnerability
scoring system as well as threat modeling.
We're going to decide or go into action with how
threat modeling corresponds with the CV SS scoring and prioritization.
When we go through these different episodes,
I want you to pay close attention to different
threat modeling frameworks that we're going to decide on.
And I also want to point out CV SS and how that can be utilized
for your
prioritization through different vulnerability management
that we discussed earlier.
The common vulnerability scoring system or CV
SS is currently utilizing version three.
Now,
this differs slightly from version two as in we just put in
the medium category of which was that used to be there.
But you just need to be aware that
that's just the newer system that's being utilized.
When we talk about CV SS, it's broken in from 0 to 10 with 10 being the most critical and
zero being there's no threat whatsoever. Very rarely.
Are you going to see a no threat or a zero whenever we see a vulnerability?
Uh As a matter of fact,
I don't think I've seen one ever in my entire
time as a cybersecurity expert at the critical level,
you usually have root level access,
which is easily accessible and requires an immediate response.
We identify this as anything from 9.0 all the way to 10.0
and has different variations based on
you're looking for the import part here for
critical level is that root level access.
So it is easily accessible.
If we take impact and we multiply by ease, then we get our CV SS score.
That's the easiest way to explain it.
So I have something that's very easy to access ie a
tool that's on uh MS F Venom or maybe uh metasploitable.
And that tool is able to use on a live system
that gains root access,
that will give us a very high score because it doesn't take a lot
of technical knowledge or knowledge of the system in order to exploit that problem.
This is where a majority of our prioritization is going to come into play.
They recommend an immediate response when it comes to something
in the 9.0 to 10.0 atmosphere of a CBS.
Now,
I want to point out that we also want to utilize a little bit of common sense in here.
If we just took the pure logic, the scoring system,
then we really wouldn't need cybersecurity analysts.
You need to remember that you're an expert in your field.
If I've got something that is a window based vulnerability,
but the vulnerability is only for a Linux
based system,
then we have a false positive and you as a cybersecurity expert need to be able to
go in and annotate that is a false positive and doesn't need to be looked at.
You'll see little problems and idiosyncrasies as you become
more and more experienced in the analyst process.
But while it's one of the big ones next week, we have high, now,
high means usually that we have escalated privileges with the vulnerability,
you have to have some technical knowledge and they
recommend within four weeks that we fix this problem.
Now,
that's a big jump from an immediate response
ie something really bad is going to happen.
So we have to fix it now versus four weeks from now
uh with an escalated privileges, this usually doesn't provide us root access,
but it does mean that they have some administrative control and they
have to use some technical skill to actually get into it.
However,
you could have something with root level access that has some technical skill,
it's not an all or none atmosphere.
So be aware of that when you're looking for
CV SS scores,
then we have a medium,
this provides us limited access or requires
knowledge in order to exploit the problem.
This usually means that I've got something that has limited access.
They don't really have
admin access,
but maybe they can log in as the user and do some damage to the machines or the network.
It also has some required knowledge requirements,
meaning you're not going to get somebody that just is fresh off the boat.
Never seen a computer before being able to access this. Your script kit
usually are going to be dividing on those medium access.
But again, it does come in different flavors.
I could have limited access with easy accessible.
Usually we denote a high but maybe a very high on the medium charts that we have low,
low is usually minimal business impact.
Meaning that there, yes, there's a vulnerability.
But if somebody gets access to it,
they're really not gonna be able to affect systems,
maybe they can read data and the data isn't sensitive.
So yeah, it's a problem but it's not a big problem. This also usually requires
physical access,
meaning that the user or the malicious actor has to physically be able
to access our machines either through a port or through the keyboard itself.
This is where the low comes into play.
Now, in terms of exploitation,
they can also have something that requires root access,
but usually require physical access as well.
And may score into the medium to high range depending
on the different level or access or ease of usability.
Once they give physical access,
it's important to note that CBS S scoring system is an arbitrary system.
It really is in the eyes of the beholder and what they feel at the time.
When that comes into play,
you may have somebody that views a vulnerability or a
problem with a high impact different than somebody else.
This is the problem and the best thing about a CV SS score,
which means that it's arbitrary.
You really have to take your grain of science into it and you
have to use some common sense when negotiating the CV SS scoring system.
However, with that said, as an analyst,
you may be called into question if you see a
high CV SS score that you didn't have any need
jerk reaction too,
managers that don't truly understand cybersecurity always go to that number
as a predetermined range that they want to fix first.
This is also a problem. It could also lead you to additional confines as well.
But be aware of that your job as
a cybersecurity analyst is to understand the technical perspectives
of those scores and how they interplay with
the systems that you have within your network,
but also be able to speak as a business analyst and go
and go. Yes, it's a critical, but it's not that critical to a system.
And here's why be prepared to write those reports on this slide.
You can understand how CV SS metrics or scores come into play.
They're broken into three different groups.
We have our basic method group,
our temporal metric group and our environmental metric group.
Now each group is responsible for a different aspect of the CV SS scoring process.
The basic group usually includes different things like that
vector, the compatibility of the impact where the integrity comes into play,
how the user interaction comes into play.
This is pure and simple,
the basics of any type of vulnerability that we may see on a system.
Then we take the
oral metric group. This is the exploit code maturity. How long is the code
bits in our metasploitable framework that somebody just can gain easy access to
tempor
metrics are fundamentally just what kind of ease is the environment that I'm using
for or the tool in which I'm utilizing to break into the system.
Again,
if I have a highly complex tool that somebody has
to write brand new code for and the basic metric group
is the attack vector where it's very easy to go through
a port SSH 22 to gain access into the system,
we may have a higher or lower CV SS score based on that
algorithm
easy to get access to the system,
but very high code probably landed somewhere in the middle.
Finally, we have the environmental metric group.
This is the confidentiality, integrity,
availability and modified base metric when it comes into play,
meaning that I could have a basic metric group plus a temporal metric group.
But I also need to include that environmental environmental metric group,
meaning that
if it's impacting the integrity of my data, maybe the confidentiality,
my data,
the availability of my networks or systems and at
what level they're impacting those different aspects as well.
If I've got something that is hard to, to access with an ease of vector,
meaning that the attack vector could be on that port 22 we talked about,
but it takes a lot of good scripting and coding to actually pull
this code off or this attack off and that it affects my,
I don't know availability by 1%
that may land us on a low CBS
if I flip that around.
And we said, well,
it affects my availability because it is a dial a service
attack and they can knock the entire network off ground.
Maybe that moves that low up to a medium or even a high level understanding.
These three
basic basic metric groups associated with CV SS
scoring isn't really required at an indepth level.
But you should have a high level understanding,
understanding the basic of temporal and the
environmental and what those constitute on each
level threading comes in different aspects of where our threat comes into play.
That means if I have a threat, I need to identify the capability,
the attack vector and surface that they're most likely to
come on the likelihood of that attack coming into play.
And what impact it has.
Now, we kind of touched on this a little bit with our CV S scoring metric,
but you need to understand it from a threat modeling aspect as well.
Capability of a threat. How capable is the threat that we're coming into play?
Is it a script kitty
or an A pt those matter when we're looking at different threats and threat modeling?
What's the attack surface? Is it a Windows machine or a Linux machine?
Maybe it's a Mac,
maybe it's a firewall of a specific vendor that we don't even have in our network.
What vector are they utilizing it?
Does it have to be physical ie in person or can it be over a simple port like HTTP,
we need to understand the threat vector or the attack
factor that this threat is most likely to utilize.
What's the likelihood of this threat taking place?
Is it is an easy threat ie if it's a
script kitty and there's a tool already out for there
and all they have to do is press the enter button after punching in our IP address,
probably a very high likelihood.
However, again,
if we have to do high scripting and they have to program the tool themselves,
probably a very unlikely likelihood
and then find
impact. What's the impact of our, all of our network infrastructure?
Is it going to take down our entire system or is it barely
going to be touched that impact really comes into play on different levels?
Are they able to utilize a tool with a high likelihood of a
attack factor?
Maybe the attack surface is our entire network and the capability of the attacker is
very high because it's a easily readily available
tool that a script kitty might use,
then our impact is very low. Well, that means to a high likelihood but low impact.
When we talk about threat modeling,
you need to understand from a cybersecurity
analytical point of view that thread modeling encompasses
how busy or how in depth we need to be with our threat hunting,
meaning that if I have a very complex virus that's going to go into our system,
but it takes a lot of fortitude, a lot of uh of technical knowledge,
its impact is quite low and the likelihood is quite low,
then my CV SS score would also be quite low.
But we're looking at from a diverse perspective without that CV SS score,
I need to make an intellectual decision on how much we go into that threat
as far as defensive structure comes into
play when you're going about threat modeling.
Understand that as a cybersecurity analyst,
you need to understand your threats from an intrinsic level.
This is where understanding your network, your capability,
your mitigations
and your impact your systems based on those
different vulnerabilities or threads really comes into play.
This is what separates the experts from the novices with
threat modeling. We have two basic frameworks that you need to be familiar with.
The first one is Stride,
this was developed by Microsoft several years ago and it
still is used today and it stands for spoofing,
tampering information, disclosure, denial service and elevation of privileges.
This is fairly easy model to identify when it comes into threads.
And we utilize this in such a way that if I see
a threat such as maybe internal access to our systems via malware,
I can go through and say, oh is it spoofing an IP address?
If it is, then there's something to be aware of. What is it tampering with?
What is it interacting with? How is it fooling around with that system?
That is something I need to be aware.
You can literally go step by step and identify each portion of the stride
model to impact how it would utilize
for threat modeling within your internal systems.
This is the posta model.
Now, this is process for attack simulation and threat analysis.
It's a risk centric modeling framework that uses seven stages
to encourage analysts to solicit input from operations governance architecture.
And of course development,
this comes into play where we really want our
network analysts or security analysts to really understand that,
hey, I'm not alone in this field, I can reach out to other
experts and get their input as well.
If you're living in this little bubble within cybersecurity,
you're probably going to lose track of what's going on.
We can't be experts at everything.
And this is where the pasta model really comes into play.
It really encourages you as an analyst to reach out and go hey,
I see this problem operations.
Have you seen this before? What are you doing on your end? What do you think?
What about governance?
What about the network architects and the architecture that comes into play?
How are they utilizing the different uh hardware within the
network architecture to develop different vulnerabilities associated with it?
And then finally our application development,
what are they doing on their side that could impact
cybersecurity when it comes out of the post model.
It really is all about touching bases with those different people and those
different departments to get a better picture of the cybersecurity as a whole.
Now that we've gone through the CV SS scoring and how it's implemented,
I really wanted to take an opportunity to go
through and explain some of the questions you might see
on the CYS A exam and how you need
to prepare yourself in order to answer those questions.
For instance, under the first.org website, you can see a basic introduction.
And if we scroll down,
you can start to see how the metrics are calculated.
You can see the basic metric group that's oral, the environmental.
And if we scroll down some more,
you can see the different little abbreviations that
they provide based on each of those.
It's important that you actually read through and
understand these abbreviations because you might have a question
that literally uses those abbreviations and you're required to pick the
highest or the most likely metric that you would tackle.
If you understand the abbreviations,
it makes the question very easy if you don't understand it,
it's like picking out a needle in a haystack.
You really don't know what you're looking at.
So as we're going through, if you scroll down a little bit more,
you can see the attack vector and we have an N for network and A for adjacent,
an L for local and A P for physical, the attack complexity is either low or high L and
accordingly.
And then finally, the privilege requirements are either in L or H
according to what it's looking for. Finally, user interaction, it's either in or R.
So if you see a question
that has a required user interaction but is
considered high and you're meeting up with that.
Uh And in comparison to say something that has a low or no user interaction
with a high, which one would be more likely for you to spend your time on.
Well, obviously,
having no user interaction compared to a uh a required user action,
we would go after the no user interaction as our primary purpose, right?
So it's really important
for you to be able to look at these abbreviations
and then accordingly answer questions uh corresponding to them.
So again, it's not as simple as just saying UI as in user interaction,
you'll literally see something that says UI colon
and then N or R or you might see something that says
pr colon and then it may have an N an L or
an H and you need to be able to read that in
order to answer the questions that they may be posts a exam,
same with confidentiality, integrity and availability.
So be aware that while I've only covered the
very first portions of it in the basic metrics,
you could also see something for temporal or even environmental.
And you need to know those little abbreviations as you're going through the exam.
The other website that I wanted to show you is ns.gov calculator and it provides a
great scenario to kind of give it more of an easier way to look at it.
For me. I actually memorize things better when I can go through and play with it. In
this case, I can look at the base score metrics and
it pretty much provides it for me. I can go attack a VA V and then call it in
which is much what like you would see
on the basic uh uh exam.
And so I can go through and I can play with
these and then in the temporal metrics and environmental metrics,
you could also see impact metrics and
then the impact subco or confidentiality requirement.
So cr so as you're going through this,
I highly recommend that you go through this website,
definitely play around with it,
kind of see what they're asking for and the capabilities if you go in there blind
it wouldn't surprise me if you don't view
very well on those specific exam questions.
Within this episode, we talked about CV SS scores and how they're utilized,
what makes up the score and how those scores impact,
what we're trying to do as far as prioritization goes.
We also talked about different threat modeling and how
that threat modeling imposes a process as an analyst.
And we discovered both the stride as well as the post model
and how those come into play with us as a cybersecurity analyst
for the cys A uh exam. What you really need to take it from?
This is CBS S we really need to understand from a
basic high level overview of how those scores are come into play
and where we need to utilize prioritization based on that
threat modeling or based on that CBS S score.
When it comes to threat modeling,
how do we impact the different threads?
They're impacting our different networks and
the different trends associated with it.
We need to understand how Stride works as
well as the pasta model and what separates those
two models and how we should interfere with them or interact with them as an analyst.
You should expect to see questions on pasta as in, hey,
what are the different aspects or departments that I might need to reach out to?
If I was utilizing the
pasta model methodology,
you also need to look at the Stride model
and understand the different acronym associated with it smoothing.
So on all the way down to elevation of privileges,
you need to understand CV SS scoring and expect to see against the
based questions based on both of them.
You may see something where, hey, I've got this threat associated with my
uh with my systems and it's talking about tampering with specific items.
Now, they won't use the word tampering,
they'll use a different word that means tampering.
And you're expected to know, hey,
this corresponds with tampering of the t of the stride model.
Expect to see different scenario based questions on
that and you should be good to go.