When we talk about exploitability and weaponization of a system,
we usually refer to the CVS as a tax complexity rating
when it comes to prioritization of the exploit. In question, what do I mean by that?
We have a vulnerability
and we look at a vulnerability within a system,
we need to be able to prioritize how quickly or how soon
or how much cost we should associate with fixing that specific vulnerability.
We do this by two notions, right? The first one is the ease of exploitation.
If I have a vulnerability, how easy is it to exploit that vulnerability?
Is it something simple where a script kitty could do it?
You literally go in you push a button and boom,
it takes advantage of the vulnerability.
There's a tool called orbital strike where you literally take into account,
you plug in an IP address and you hit the little start
button and it doesn't design a service attack against that IP address.
This would be indicative of a script kitty tool that takes a very low
uh use of tools or low use of knowledge to perform the attack,
making the ease of exploitation very high.
That's the first foundation of any attack.
The second aspect we need to take into account is the severity of the attack.
While a denial of service attack isn't that
high on the criticality of the severity list.
The ease of exploitation is this would rate our prioritization to be somewhat low.
Yes,
it is easy for somebody to take advantage of
a denial of service attack against our system.
But the severity of a denial of service attack with today's technology
is quite low and so it wouldn't require a high prioritization.
However, what about an attack that has very easy use of
or very ease of use of exploitation against that specific vulnerability?
And the severity would be root access into our systems.
This would be high ease of exploitation and
high severity constituting a high priority list.
When we talk about prioritization of a specific vulnerability,
we must always take into account how easy
it is to take advantage of the vulnerability.
And what's the severity if someone does get a hold of that vulnerability?
The other key role that we need to take into account is the asset value?
Is it a sensitive item?
Does the asset and value in question have sensitive information?
Are we talking about P?
Is there a list of databases inside of that asset
that increases the asset value past what we would normally consider
for the hardware itself?
What do I mean by that? If I've got a hard drive,
a hard drive by itself in today's terms, is only
couple 100 bucks even for a one Terabyte drive.
However,
what if the data on that hard drive has a high sensitivity and
increases the cost of the asset value associated with that hard drive?
Remember, data is money in our technology world of today.
And so the asset value needs to be linked to two primary factors.
How sensitive is the data and how critical is the data?
If it getss into somebody's hands,
when we talk about
data breaches, we're often referring back to, hey, is this data critical in nature?
Is it going to severely hurt our company or organization?
You can refer back to the complexity of sensitivity values when it comes to data?
And when I mean by that is, is it secret top secret or
just confidential when it comes to that asset value or that data within that device?
When we talk about the criticality, we're really referring to how,
how
vital is that information against our company? Are we gonna see lawsuits?
Are we going to get fines because we, we messed up our compliance issues.
How critical if that data were to be lost or
given up to somebody else through a data breach,
would that cause in essence to our company as a whole?
Sometimes the critical nature of the data is just, well,
they have access to our price list that we were going to establish next week.
Is that a high critical value. Probably not. Is it sensitive nature?
Yeah, it's probably sensitive nature,
especially if we're having a giant sale before Black Friday.
But is the asset value going to glean a high value because of it? Probably not.
When we look at asset value,
we must always take into account how sensitive the data is and how critical it
is to the company's wellbeing if that data was to be taken advantage of.
Finally, I want to talk about zero day attacks.
Zero day attacks are attacks that nobody knows about.
When we talk about a zero day attack, you're talking about a malware or
attack against a vulnerability that was not yet discovered.
A zero day attack could be something as simple as, hey,
I found a vulnerability within the SSH complex
which allows me to take advantage of performance,
denial of service attack against SSH because there's a vulnerability
that was not normally known or unknown at the time that I've taken advantage of
that would be still considered a zero
attack.
However,
most people associate a zero day attack would be something that is high value
that we didn't normally know about or we did have was previously unknown that now
all of a sudden ie zero day somebody takes advantage of that vulnerability and is
able to pull off an attack that
takes advantage of that previously unknown vulnerability.
And that in essence is a zero day attack.