Cyber Threat Management, Part 4: Endpoint Vulnerability Assessment and CVSS
Before you can spot something unusual on a network, you need to know what normal looks like. This section covered how to build that picture (profiling), how to spot changes from it (anomaly detection), and how to score vulnerabilities so you know which ones to fix first (CVSS).
Network and server profiling
Profiling means building a detailed picture of normal behavior, so anything different stands out.
Network profiling
A network profile records what normal traffic looks like. The course listed four important elements:
- Session duration: how long connections normally last. A connection to an outside server that stays open for days is unusual.
- Total throughput: how much data normally flows. A sudden jump, especially outbound, could mean data is being stolen.
- Ports used: which ports and protocols are normally in use. A workstation suddenly using an unusual port might be talking to a command server.
- Critical asset address space: the IP addresses of the most important systems, like servers and databases, so traffic to and from them gets extra attention.
Server profiling
A server profile records the normal state of each server:
- Listening ports: which ports the server normally has open. A new listening port could be a backdoor.
- Logged-in users and accounts: who normally logs in, and when.
- Service accounts: the accounts that applications and services run under, and what they normally do.
- Software environment: which software, versions and processes normally run on the server.
On Linux, ss -tulpn shows listening ports, and who or last shows logins. On Windows, netstat -ano and Task Manager do similar jobs.
Network anomaly detection
Anomaly detection compares current activity against the baseline from profiling and flags anything that doesn’t fit. It can use simple thresholds (“alert if outbound traffic is ten times normal”), statistics, or machine learning. Its big advantage is that it can catch new attacks that have no known signature. Its downside is false positives, because not every unusual event is an attack. A backup job that runs once a month might look strange the first time.
Network vulnerability testing
Vulnerability testing combines several activities:
- risk analysis: deciding which assets matter most and what could happen to them
- vulnerability assessment: scanning for known weaknesses (with tools like Nessus or OpenVAS)
- penetration testing: confirming whether weaknesses can really be exploited
Together they show where the network is weak, and how badly.
The Common Vulnerability Scoring System (CVSS)
Overview
CVSS gives each vulnerability a score from 0.0 to 10.0, based on how easy it is to exploit and how much damage it can do. It’s maintained by FIRST. Because everyone uses the same system, a vendor, a scanner and a security team can all talk about severity the same way.
The scores map to severity ratings:
| Score | Rating |
|---|---|
| 0.0 | None |
| 0.1 – 3.9 | Low |
| 4.0 – 6.9 | Medium |
| 7.0 – 8.9 | High |
| 9.0 – 10.0 | Critical |
The course used CVSS version 3. A newer version, CVSS 4.0, was released in 2023 with some changes to the metric groups, but version 3.1 is still widely used.
CVSS metric groups
CVSS 3 has three groups of metrics:
- Base metric group: the qualities of the vulnerability itself, which don’t change over time or between organizations
- Temporal metric group: things that change over time, like whether working exploit code exists or a fix has been released
- Environmental metric group: how the vulnerability affects a specific organization, based on how important the affected system is to them
The base metric group
The base group has two parts. Exploitability metrics describe how easy it is to attack:
- Attack Vector: how the attacker reaches the vulnerable system (over the network, from the same local network, locally, or with physical access)
- Attack Complexity: whether special conditions are needed for the attack to work
- Privileges Required: what level of access the attacker needs first
- User Interaction: whether a user has to do something, like click a link
Impact metrics describe the damage: the effect on Confidentiality, Integrity and Availability. And Scope says whether a successful attack can affect systems beyond the vulnerable one.
All CVSS 3 metrics, initials and possible values
My notes said to list them all, so here’s the full set:
| Group | Metric name | Initials | Possible values |
|---|---|---|---|
| Base | Attack Vector | AV | Network (N), Adjacent (A), Local (L), Physical (P) |
| Base | Attack Complexity | AC | Low (L), High (H) |
| Base | Privileges Required | PR | None (N), Low (L), High (H) |
| Base | User Interaction | UI | None (N), Required (R) |
| Base | Scope | S | Unchanged (U), Changed (C) |
| Base | Confidentiality Impact | C | High (H), Low (L), None (N) |
| Base | Integrity Impact | I | High (H), Low (L), None (N) |
| Base | Availability Impact | A | High (H), Low (L), None (N) |
| Temporal | Exploit Code Maturity | E | Not Defined (X), High (H), Functional (F), Proof-of-Concept (P), Unproven (U) |
| Temporal | Remediation Level | RL | Not Defined (X), Unavailable (U), Workaround (W), Temporary Fix (T), Official Fix (O) |
| Temporal | Report Confidence | RC | Not Defined (X), Confirmed (C), Reasonable (R), Unknown (U) |
| Environmental | Confidentiality Requirement | CR | Not Defined (X), High (H), Medium (M), Low (L) |
| Environmental | Integrity Requirement | IR | Not Defined (X), High (H), Medium (M), Low (L) |
| Environmental | Availability Requirement | AR | Not Defined (X), High (H), Medium (M), Low (L) |
| Environmental | Modified Base Metrics | MAV, MAC, MPR, MUI, MS, MC, MI, MA | Same values as the base metrics, adjusted for the organization’s own environment |
The CVSS process
- The base score is calculated first, usually by the vendor or a security researcher who reports the vulnerability.
- The temporal score adjusts it as things change, for example going down once an official fix is released, or up when working exploit code appears.
- The environmental score is calculated by each organization for its own systems. A critical vulnerability on a test machine with no sensitive data may matter much less than the same one on a payment server.
The result is written as a vector string:
1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reading it: attack over the network, low complexity, no privileges needed, no user interaction, scope unchanged, and high impact on confidentiality, integrity and availability. That’s a base score of 9.8, Critical: anyone on the internet can fully take over the system without help. This is the kind of score Log4Shell got.
CVSS reports
Scan reports and advisories show the CVSS score and vector for each finding, so teams can sort by severity and fix the worst first. The US National Vulnerability Database (NVD) publishes CVSS scores for CVE entries, which many tools use.
Other vulnerability information sources
- CVE (Common Vulnerabilities and Exposures): the list of known vulnerabilities, each with a unique ID
- NVD: adds scores, details and references to each CVE
- EPSS (Exploit Prediction Scoring System, also from FIRST): estimates how likely a vulnerability is to be exploited in the next 30 days. CVSS measures how bad it would be; EPSS measures how likely it is to happen. Using both helps prioritize.
- Vendors also have their own ratings, like Microsoft’s severity ratings for its security updates.
One common mistake is treating the CVSS base score as the whole story. A 9.8 on an isolated lab machine can be less urgent than a 7.5 on an internet-facing server, which is exactly what the environmental metrics are for.
Why this matters for a SOC engineer
Baselines from network and server profiling are what make “unusual” alerts possible: a new listening port, a strange outbound connection, a login at 3 AM. CVSS scores decide which vulnerability alerts get attention first. And when a big CVE is announced, the SOC is usually the team checking logs to see if anyone has already tried to exploit it.
Questions I should be able to answer
- What four things does a network profile include? What does a server profile include?
- What’s the advantage and disadvantage of anomaly detection?
- What are the three CVSS metric groups?
- Name the base metrics and their possible values.
- Read this vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Why is it critical? - Why might the same vulnerability get different environmental scores in two companies?
- What’s the difference between CVSS and EPSS?
Next
Secure device management, risk management and security controls.