analyzing output from vulnerability scanners

common vulnerabilities and exposures(CVE)

a commonly used scheme for identifying vulnerabilties developed by MITRE and adopted by NIST

national vulnerability database(NVD)

a superset of the CVE database, maintained by NIST, that contains additional information such as analysis, criticality metrics(CVSS), and fix information or instructions

common weakness enumeration(CWE)

a list of software weaknesses or flaws that could potentially lead to vulnerabilities

common attack pattern enumeration and classification(CAPEC)

a knowledge base maintained by MITRE that classifies specific attack patterns focused on application security and exploit techniques

common platform enumeration(CPE)

scheme for identifying hardware devices, operating systems, and applications

common configuration enumeration(CCE)

scheme for provisioning secure configuration checks across multiple sources

common vulnerability scoring system(CVSS)

a risk management approach to quantifying vulnerability data and taking into account the degree of risk to different types of systems or information

Score|Description

0 | None

0.1 - 3.9 | Low

4.0 - 6.9 | Medium

7.0 - 8.9 | High

9.0 - 10.0 | Critical

access vector(AV)

does the attacker need to have physical access(P), local(L), adjacent network(A)(adjacent network: where the attacker must launch teh attack from the same shared physical or logical network, or a limited adminsitrative domain such as VPN or MPLS), or network(N)

access complexity(AC)

high complexity or low complexity exploit(H) or (L)

privileges required(PR)

none(N),low(L), high(H)

user interaction(UI)

none(N) or required(R)

scope(S)

unchanged(U) or changed(C)

confidentiality(C), integrityu(I), availability(A)

high, medium, low(H,M, L)

exception management

a defined process to closely monitor systems that cannot be patched or remediated and must be exempted from scans

nessus

a commercial vulnerability scanner produced by Tenable Network Security for on-premise and cloud-based vulnerability scanning

• plug ins can be created using Nessus Attack Scripting Language(NASL)

OpenVAS

open source vulnerability scanner that began its development from the Nessus codebase when Nessus was converted to commercial software

qualys

a cloud based vulnerability management solution with installed sensor agents at various points in their network which upload data to the cloud platform for analysis