Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Info

This document covers the various scoring calculations and methods used for the Asset(s) Risk Scoring and various point systems.

Table of Contents
stylenone

...

Severity and Risk Scoring Descriptions

Severity

This indicates the seriousness or criticality of a vulnerability. Common severity levels include low, medium, high, and critical. Higher-severity vulnerabilities typically pose a greater risk and require immediate attention and mitigation.

...

The Impact Score evaluates the potential impact of a vulnerability on the affected system or organization. It considers factors such as data loss, system compromise, service disruption, regulatory compliance impact, and financial repercuss

...

How is Severity Calculated?

Severity information is imported from the standard vulnerability databases.  

...

In summary, the Severity score for vulnerabilities is calculated based on the Base Score, which is, in turn, calculated from the Impact and Exploitability metrics. The Severity score indicates the seriousness of a vulnerability, ranging from low to critical, based on its potential impact and ease of exploitation.

For more information, check these sources out below:
https://nvd.nist.gov/vuln-metrics/cvss
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator

https://www.first.org/epss/

...

How is EPSS Calculated?

You can find the general calculation on EPSS in the link below:

...

https://epss.cyentia.com/epss_scores-current.csv.gz

...

Asset Risk Scoring Details

Assets are scored individually and assigned a letter grade: A, B, C, D, E, or F, just like in grade school. Tap on the letter grade of any asset to see the Rubrix breakdown of how we score based on vulnerabilities.

...

Asset Average Risk Score Calculation

The sum of present Problem Category scores divided by the sum of all Severity Problem Category scores + other Problem Category Scores that are present.

The Severity Problem Category refers to the severity-based vulnerability classifications below.

We use these base weights for the Risk Score calculations based on ‘severity.

...

'

  • Critical Severity Vulnerabilities = .90 (or 90%)

  • High Severity Vulnerabilities = .80 (or 80%)

  • Medium Severity Vulnerabilities = .50 (or 50%)

  • Low Severity Vulnerabilities = .30 (or 30%)

To obtain your asset’s present Problem Category scores, tap on the letter grade, check for the ‘Exists?’ column for a 'Y' and add that Score value up. See below for a sample.

...

So we have 50.

Take the 50 and divide that by the ‘Sum of all the Severity Problem Category scores' as shown below:

  • Critical = 90

  • High = 80

  • Medium = 50

  • Low = 30

Total Score for All Severity Categories = 250 possible

250 / 50 = 20 (Asset Risk Score)

...

Security and Compliance Report Card Grading

Info

The table values below are used for our Security Report Card and Compliance Report Card grades.

 Category

Grades

Description

Antivirus

5

Anti-virus is installed and up to date

4

Anti-virus is installed but not up to date

1

Anti-virus is not installed

Local Firewall

5

Local firewall is enabled for both public and private networks

4

Local firewall is not enabled for private networks

3

Local firewall is not enabled

1

Local firewall is not enabled

Insecure Listening Ports

 5

There are no insecure listening ports

3

One insecure listening port detected

1

More than one insecure listening port detected

 Failed Login

5

No failed interactive logins in the past 7 days

4

7 or fewer failed interactive logins in the past 7 days

3

14 or fewer failed interactive logins in the past 7 days

1

15 or more failed interactive logins in the past 7 days

Network Vulnerabilities

5

No network vulnerabilities

4

Low network vulnerabilities found (CVSS < 4.0)

3

Medium network vulnerability found (CVSS >= 4.0)

1

Critical network vulnerability found (CVSS >= 9.0)

System Aging

5

All computers are less than 2 years old

4

Some computers between 3 and 4 years old

3

Some computers between 4 and 7 years old

1

Some computers over 8 years old

 Supported OS

5

All computers have supported Operating Systems

4

Some Operating Systems are in extended support

3

Some Operating Systems are within 1 year of end of life

1

Some unsupported Operating System

 LLMNR

2

LLMNR not Allowed

5

LLMNR Disabled

1

LLMNR Enabled

NBTNS

2

NBTNS not Allowed

5

NBTNS Disabled

1

NBTNS Enabled

 NTLMV1

2

NTLMV1 not Allowed

5

NTLMV1 Disabled

1

NTLMV1 Enabled

 SMBV1Server

2

SMBV1 Server not Allowed

5

SMBV1 Server Disabled

1

SMBV1 Server Enabled

SMBV1Client

 

 

2

SMBV1 Client not Allowed

5

SMBV1 Client Disabled

1

SMBV1 Client Enabled

 SMB Signing

2

SMB Signing Disabled

5

SMB Signing Enabled

1

SMB Signing Disabled

Security Report Card

...

Compliance Report Card

...

End of Life

ConnectSecure checks against Assets to categorize end-of-life (EOL) in two ways.

...

This is found in the Problem Group of ‘Informational’ as shown in the example below:

...

Risk Level Descriptions for EOL on Active/Security Support

Level

Description

1

Both Active and Security Support have ended; no support is available

3

If the operating system is within 1 year of its security support end date; limited support

4

If the operating system is within its Active support but past its Security support; extended support

5

If the operating system is within both Active and Security support timelines; full support

...

Need Support?

Contact our support team by sending an email to support@connectsecure.com or by visiting our Partner Portal, where you can create, view, and manage your tickets.

...