Ruslan Rakhmetov, Security Vision
Nowadays on any topic one can find a manual or reference book that will help to understand the task, find ways to solve it and generally better understand the chosen topic. This happens in everyday life and work tasks, and the world of information security is no exception. In the current article we will talk about universal directories and databases about IS vulnerabilities - how they appeared, what they are and how they changed forever the approach to classification and searching for the necessary information about threats.
In the 90's, public (available to anyone with an internet connection) threat directories began to appear. Until then, individual companies or industries could use their own directories and ask their neighbours for useful data, but due to the lack of a unified approach, even when naming individual articles and describing threats, searching was too difficult and only made things more complicated. The most popular CVE (Common Vulnerabilities and Exposures) database today was published for everyone in 1999. It is public and funded by the US-CERT division of the National Cybersecurity Directorate of the US Department of Security. Carnegie Mellon University supports this Department project, and the database itself is maintained by MITRE. The current database is a dictionary of computer security vulnerability identifiers. CVE is now an internationally accepted standard used to uniquely identify and share information about various vulnerabilities in software, hardware devices and other technologies that companies use in their incident and vulnerability management processes, as well as in managing and developing operating system (OS) and software updates.
Several factors are driving the emergence of the framework:
With the increasing use of computers and networks
- At the end of the 20th century, it became apparent that information systems were increasingly at risk of attack and vulnerabilities;
- As cyber-attacks increased and interest in cybersecurity grew, organisations around the world began to make greater use of vulnerability databases to better detect and prevent attacks;
- Standardisation has become a key element in information security.
A unified approach has made it easier to share information between organisations and individual users regardless of country, industry and job specifics.
How the CVE database is structured and what role standardisation plays in it
Each record in the database is a unique identifier in the form ‘CVE-year-number’, where ‘year’ indicates the year the identifier was created and ‘number’ represents a unique vulnerability number.
Following the publication of MITRE's CVEs, NIST (National Institute of Standards and Technology) launched the NVD (National Vulnerability Database) in 2005. As you can see in the screenshot above, NVD is closely related to CVE and allows you to:
- Aggregate data from various sources;
- Assign a unique number that is easy to search and categorise;
- Share information with interested users around the world.
For simplicity, we can compare these directories to the alphabet in the Russian language or to algebra in mathematics: CVE, like an ordinal number, allows you to uniquely associate some NVD description with a particular object. It is also similar to the description of data in Excel spreadsheets, where any text is unambiguously defined behind a particular column and row, making it easier to search and analyse.
Even more recently, in 2005, a universal method of quantifying vulnerabilities also emerged to help professionals understand the priority of fixing them. The open standard CVSS (Common Vulnerability Scoring System) provides a numerical assessment that allows to evaluate the impact of vulnerabilities and determine the timing and importance of IS and IT tasks.
The vulnerability scoring method has been improved over time and has several versions:
CVSS v1.0.
The first version provided basic assessments focusing on three aspects: level of access, impact, and attack complexity.
CVSS v2.0.
In 2007, the threat assessment model was modified to include new metrics and extensibility.
CVSS v3.0.
The latest version, which introduces additional metrics:
1) Baseline metrics: access level, exposure and attack complexity (from the first version);
2) Temporal metrics: current circumstances and threat relevance;
3) Ambient metrics: taking into account the individual characteristics of the organisation and the environment, such as the company's region or the industry in which it operates.
In this way, the CVE base allows unambiguous identification of the threat and avoids the need for a complex search for duplicates, the CVSS metric helps to understand the importance and criticality of the job, and various analysts (e.g. from NVD) have access to a description of the features and remediation methods that will be available to everyone in the world in order to better understand the task and protect important data and assets in time.
Vulnerability classification methods and sources of information
All vulnerabilities, because of their large number and variety, are commonly categorised in order to make them easier to find and remediate. It is similar to the shelves in modern freezers, where temperatures are selected for storing different products: meat, vegetables or sweet ice cream. Only the criteria for putting food in the drawers are several at once:
Type of vulnerability:
For example, web application vulnerabilities, operating system vulnerabilities, network vulnerabilities, etc.
Vulnerability source:
For example, software bug, configuration or design error.
Extent of Repeatability
If the vulnerability has been exploited in cyberattacks or has been discovered in other systems, it may be classified as more critical.
Confirmation and patch availability:
A vulnerability for which confirmed exploits and patches are available (available updates that prevent a hacker from exploiting it).
Access Level
For example, a vulnerability that requires remote access may be considered more critical than a vulnerability that requires physical access to the device because access to the protected server can be restricted at the level of ACS and the corresponding security regime, while remote access must be restricted when networking.
There are other ways to categorise them, such as the complexity of the attack, the impact of the vulnerability on security or how easy they are to detect by defenders.
Who keeps threat databases up to date
Because of the open approach, different users can be the editor of the database. Compare this approach to the creation and editing of Wikipedia articles, where each user of the system is involved in describing historical facts, biographies of famous personalities or descriptions of companies and their activities in the market. Specifically, CVSS evaluation is performed by:
- Cybersecurity researchers and experts;
- system and network administrators;
- software developers;
- Government security agencies; and other companies.
We have already mentioned NIST with its NVD base, but it is actually not the only institute that addresses IS challenges at the global and governmental levels. There are other bases, depending on the objectives, specialisation and methods of information collection.
MITRE ATT&CK, which focuses on describing the procedures, techniques and tactics used by attackers rather than specific vulnerabilities. This database helps to understand attack methods and develop detection and prevention strategies.
Exploit Database, which focuses on exploits and code that demonstrates vulnerabilities. Contains detailed descriptions and exploit codes and provides information that can be used for testing and training.
Vulners, which uses unique technologies to collect data on vulnerabilities, exploits, patches, and other aspects of cybersecurity.
CWE (Common Weakness Enumeration), which describes the types of weaknesses in software, including coding errors, architectural issues, and others.
CIRCL (Computer Incident Response Center Luxembourg) AIL (Analysis Information Leak) with tools to analyse potential information leaks.
Zero Day Initiative, which describes "zero-day ’ vulnerabilities (those that have been discovered recently and have not been patched).
Major analysts in different countries are also forming their own communities to find and describe threats, for example:
JVN (Japan Vulnerability Notes) for sharing security information in Japanese cyberspace.
US-CERT (United States Computer Emergency Readiness Team) provides the US National Security Agency (DHS) with useful data.
NCCI ( National Coordination Centre for Computer Incidents) is a Russian government agency that coordinates the activities of critical information infrastructure entities of the Russian Federation on issues of detection, prevention, and mitigation of computer attacks and response to computer incidents.
FSTEC (Federal Service for Technical and Export Control), which is responsible for ensuring information security and the use of technical means of information protection in Russia.
Transparency, accessibility, and unification have made it possible to efficiently collect and share information to ensure security. The approaches of CVE, CVSS, NVD, MITRE, NCSCI, FSTEC, etc. forever changed the attitude to cybersecurity as something secret and secretive. With the entire world sharing emerging threats and ways to combat them, every company can use best practices to protect its assets, customer, employee and counterparty data.
