Vulnerability Management: Assessing the Risks with CVSS v3.1

Prioritize the vulnerabilities in your environment using the Common Vulnerability Scoring System (CVSS). Learn how to apply CVSS scores to effectively assess risk.

Introduction

• Welcome to this course
• Case study: Red30 technology

1. Vulnerability Basics

• Vulnerability risk assessment
• Vulnerability types and their causes
• Methods for fixing vulnerabilities
• Common terms in vulnerability management

2. CVSS Overview

• Intro to the Common Vulnerability Scoring System (CVSS)
• Core elements of CVSS v3.1
• CVSS v3.1 formula
• Making sense of the CVSS vector string

3. Base Metric Group

• The CVSS base metric group
• The attack vector metric
• How attack complexity affects risk
• The effects of the privileges required metric on risk
• User interaction and vulnerability risk
• Confidentiality, integrity, and availability impact metrics
• Security scope in CVSS
• Challenge
• Solution

4. Temporal Metrics Group

• How exploit code maturity affects risk
• How remediation level affects risk
• How report confidence affects risk

5. Environment Metrics Group

• Confidentiality, integrity, and availability requirement
• Modified base metrics in CVSS

6. Putting CVSS into Practice

• Using CVSS scores
• CVSS severity rating scale
• Using CVSS scoring in the enterprise
• Remediating vulnerabilities
• Accepting vulnerability risks
• Challenge
• Solution

Conclusion

• Next steps