When we talk about scanning and we often refer to our CV SS
scores as the resigning factor of what gets prioritized or fixed first.
Usually a high CVSs score indicates that we have
a critical vulnerability that's easy to pull off.
And in return, we want to prioritize that fix to be at the top of priority list, right?
However, context awareness is something that we need to be aware of.
If I have a high CV SS score for an
item that is air gapped with behind a system,
meaning that it doesn't have access to a network, it's behind lock and key,
but it's a critical vulnerability,
but it costs like an enormous amount of money to fix. Do I really need to fix that?
That high CV SS score item right away.
When we think about prioritization of critical
components or critical vulnerabilities within our network,
we always have to keep in mind our context awareness,
usually we dictate this by who, what, when, where and sometimes how the,
how being already written into the CV SS score
of how easy is it to pull off this vulnerability
or I should say this exploit against this vulnerability,
who would be going after it.
This is where we kind of look at it from who has the capability.
Uh I could have a critical vulnerability that could take root access,
but if it's behind it in your gap system,
the chances as something being able to actually get into that system
that who would only be our internal employees,
meaning that unless you're an internal employee,
you don't have access to the system.
It may not pay off to fix that vulnerability right away.
On the flip side if I have a critical vulnerability,
but it has very high technical requirements.
The CV SS score may be in the middle somewhere
but who has the actual capabilities of pulling it off?
Windows is notorious for having vulnerabilities
in
something like Windows seven or older Windows XP systems that when they came out,
they had critical vulnerabilities that Microsoft knew about.
However,
the capabilities to actually exploit
those vulnerabilities didn't actually exist.
And so while yes, it was a critical vulnerability,
the capability to actually enact or exploit those vulnerabilities was
so enormously high that it really wasn't worth fixing.
We call this context awareness
when we think about context and errors.
The other crucial aspect is internal, external or isolated.
Now,
I kind of referred to this a little bit already when I
talked about an air gap system being isolated for the rest of
my network and we talked about how it really didn't make sense
for anybody to gain access to it outside of our normal environment,
it would take an internal employ.
However, we also have context awareness to internal aspects of it being that hey,
is an internal flaw that only
somebody inside my network can see and take advantage of
while we have internal flaws or internal employees,
that can take advantage of those we have to understand also that not every
internal employee necessarily has the capability to
enact or to exploit a specific vulnerability.
If I have a vulnerability with a critical component to it,
meaning that it has a critical point which allows root access into the system,
but it takes a high degree of capability to gain access to it,
then there's probably only a handful of employees within
my enterprise environment that could actually take advantage of that
vulnerability. So we need to look at the internal aspects of it.
We also need to look at the external aspects of it.
Do I have a high vulnerability with a low technical
component to it where you have to be a mastermind of
technology to not only see the vulnerability but able to exploit
the vulnerability as well and we call those external components?
Right? So is it external to our network?
Is it internal to our network or is it an
isolated network aspect that we need to be aware of?
Remember when we're looking at vulnerabilities
when we're looking at the exploited
ness of a vulnerability we always have to have context awareness.
How easy is it for this vulnerability to actually
be attacked from internal forces from external forces?
Or is it an isolated incident that could take place
or looking at context awareness? Be aware of your surroundings, be aware?
Hey,
does it make sense to spend the amount of money to cover this
vulnerability or does it make more sense to let it go and,
and hide it or mitigate it behind a defense in depth infrastructure?