ConnectSecure Scoring Standards

Severity and Risk Scoring Descriptions

Severity

This indicates the seriousness or criticality of a vulnerability. Common severity levels include low, medium, high, and critical. Higher-severity vulnerabilities typically pose a greater risk and require immediate attention and mitigation.

Base Score

A numerical value is assigned to a vulnerability based on its characteristics and potential impact. It is often calculated using a standardized formula, such as the Common Vulnerability Scoring System (CVSS), which considers factors like exploitability, impact, and other metrics.

Impact Score

The Impact Score evaluates the potential impact of a vulnerability on the affected system or organization. It considers factors such as data loss, system compromise, service disruption, regulatory compliance impact, and financial repercuss

Exploitability Score

Indicates the ease with which an attacker could exploit the vulnerability to launch an attack. Factors such as the availability of exploits, complexity of exploitation, and required privileges may contribute to this score.

To see these scores, tap on the CVE-ID and then tap on the Base Score link (be sure you are on the correct CVSS Version).

EPSS Score

Exploit Prediction Scoring System is sourced from first.org/epss.

EPSS is a daily estimate of the probability of observed exploitation activity over the next 30 days. It is designed from the ground up to make the best use of all of the information available, and it does this in five steps:

1. Collect as much vulnerability information as we can from a variety of sources

2. Collect evidence of daily exploitation activity

3. Train a model: discover/learn the relationship between the vulnerability information and the exploitation activity

4. Measure the performance of the model, tweak and repeat step 3 to optimize the model

5. Daily: refresh the vulnerability information (step 1) and use the model (step 3) to produce daily estimates of the probability of exploitation in the next 30 days for each published CVE.

How is Severity Calculated?

Severity information is imported from the standard vulnerability databases.

So, the standard calculation below is followed by these vulnerability databases.

The Severity score for vulnerabilities is typically derived from the Base Score in the Common Vulnerability Scoring System (CVSS). The Base Score itself is calculated based on the Exploitability and Impact metrics.

Here's a breakdown of how the Severity score is calculated:

Base Score Calculation
The Base Score in CVSS is calculated using the following formula:

Base Score = (0.6 * Impact) + (0.4 * Exploitability)

Impact: This component of the Base Score represents the potential impact of a successful exploit. It is derived from the Confidentiality Impact (C), Integrity Impact (I), and Availability Impact (A) metrics in CVSS, each of which is scored from 0 to 10.

Exploitability: This component of the Base Score represents the ease of exploitation. It is derived from the Attack Vector (AV), Attack Complexity (AC), Privileges Required (PR), User Interaction (UI), and Scope (S) metrics in CVSS, each of which is scored from 0 to 10.

Severity Mapping
Once the Base Score is calculated and mapped to a predefined Severity level. The mapping is typically as follows:

Base Score 0.0 - 3.9: Low Severity
Base Score 4.0 - 6.9: Medium Severity
Base Score 7.0 - 8.9: High Severity
Base Score 9.0 - 10.0: Critical Severity

These ranges are defined by the CVSS standard and are used to categorize vulnerabilities based on their potential impact and exploitability.

Environmental Metrics (Optional):
In some cases, environmental metrics such as the Environmental Score (EPSS Score) may also influence the Severity rating. These factors can modify the Base Score to reflect the risk in a particular deployment context.

In summary, the Severity score for vulnerabilities is calculated based on the Base Score, which is, in turn, calculated from the Impact and Exploitability metrics. The Severity score indicates the seriousness of a vulnerability, ranging from low to critical, based on its potential impact and ease of exploitation.

For more information, check these sources out below:
https://nvd.nist.gov/vuln-metrics/cvss
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator

https://www.first.org/epss/

How is EPSS Calculated?

You can find the general calculation on EPSS in the link below:

https://www.cyentia.com/epss-version-2-is-out/

We are calculating using the tool from the below link derived from the above website:

https://epss.cyentia.com/epss_scores-current.csv.gz

Asset Risk Grade Scoring Details

Assets are scored individually and assigned a letter grade: A, B, C, D, E, or F, just like in grade school. Tap on the letter grade of any asset to see the Rubrix breakdown of how we score based on vulnerabilities.

Asset Average Risk Score Calculation

The sum of present Problem Category scores divided by the sum of all Severity Problem Category scores + other Problem Category Scores that are present.

The Severity Problem Category refers to the severity-based vulnerability classifications below.

We use these base weights for the Risk Score calculations based on ‘severity.'

• Critical Severity Vulnerabilities = .90 (or 90%)

• High Severity Vulnerabilities = .80 (or 80%)

• Medium Severity Vulnerabilities = .50 (or 50%)

• Low Severity Vulnerabilities = .30 (or 30%)

To obtain your asset’s present Problem Category scores, tap on the letter grade, check for the ‘Exists?’ column for a 'Y' and add that Score value up. See below for a sample.

Asset Risk Score is 20

1. Add up the total Score for any Problem Category where vulnerabilities Exist.

2. Divide that total by the total Weightage possible, which is the sum of each severity category + any existing custom.

• Critical Severity = .9 or 90

• High Severity = .8 or 80

• Medium Severity = .5 or 50

• Low Severity = .3 or 30

The sum of Severity Problem Categories is 250

Asset Risk Score = Total Score / Total Weightage

20 = 250 (Sum of Severity Categories) / 50 (Total Weightage of Problem Categories that Exist)

Company Risk Score Details

Company Risk Score Grade Factors

Company Risk Score Grade: A (0 - 40) = Very Low

Company Risk Score Grade: B (40 - 45) = Low

Company Risk Score Grade: C (45 - 60) = Medium

Company Risk Score Grade : D (60 - 75) = High

Company Risk Score Grade: E (75 - 90) = Critical

Company Risk Score Grade: F (90 - 100) = Very Critical

Company Risk Score Grade Descriptions

Risk Score Grade: A (0 - 40) represents Very Low.

Problems are present, and an organization should aim to be in the 0 to 40 range; however, all significant issues have been addressed broadly.

Risk Score Grade: B (40 - 45) represents Low.

Problems are present, and the value ranges from 40 to 45. However, significant issues have been addressed.

Risk Score Grade: C (45 - 60) represents Medium.

A few problems need immediate attention, with the score ranging from 45 to 60.

Risk Score Grade: D (60 - 75) represents High.

Many problems require attention, with a score ranging from 60 to 75.

Risk Score Grade: E (75 - 90) represents Critical.

The network is susceptible to attack and needs remediation; the value ranges from 75 to 90.

Risk Score Grade: F (90 - 100) represents Very Critical.

The network is highly susceptible to attack and needs remediation; the value ranges from 90 to 100.

External Scan Risk Scoring Details

External Assets are configured and maintained at the Company level under the portal's Assets > External Assets section. The Results tab displays a table view of any scanned asset, including various details and the Security Grade.

Tap on the external asset IP to see the details:

Tap directly on the letter grade assigned to see the scoring details:

External Scan Risk Score Calculation

The sum of the present Problem Category scores divided by the sum of all Severity Problem category scores and other Problem Category score(s) if present.

The Severity Problem Category refers to the severity-based vulnerability classifications below.

We use these base weights for the Risk Score calculations based on ‘severity.' The total score for all severity category groups is 250. (90+80+50+30).

• Critical Severity Vulnerabilities = .90 (or 90%)

• High Severity Vulnerabilities = .80 (or 80%)

• Medium Severity Vulnerabilities = .50 (or 50%)

• Low Severity Vulnerabilities = .30 (or 30%)

To obtain your asset’s present Problem Category scores, tap on the letter grade, check for the ‘Exists?’ column for a 'Y' and add that Score value up. See below for a sample.

Pay attention to the ‘Exists’ to determine if the ‘Weightage’ is included in the sum calculations.

In the above example, the Asset Risk Score is shown as 60.

1. Add up the total Score for any Problem Category where vulnerabilities Exist. (260)

2. Divide that by the Sum of all the Severity Problem Category scores + any other Problem Category Score if present)

The sum of the present Problem Category scores is 260

The sum of the Severity Problem Categories plus other present is 430 (250+180)

260 / 430 = .60% or 60

Security and Compliance Report Card Grading

Security Report Card

Compliance Report Card

End of Life

ConnectSecure checks against Assets to categorize end-of-life (EOL) in two ways.

1. OS-OUT-OF-SECURITY-SUPPORT

2. OS-OUT-OF-ACTIVE-SUPPORT

Risk Level Descriptions for EOL on Active/Security Support

Viewing Discovered Vulnerabilities (Problems) and Scoring Data

Calculation of Vulnerability Risk

• ConnectSecure uses CVSS 3.0 as a base system for calculating vulnerability risk. Click here for more information on CVSS calculations: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator

• The Common Vulnerability Scoring System (CVSS) is a free and open industry standard for assessing the severity of computer system security vulnerabilities.

• CVSS attempts to assign severity scores to vulnerabilities, allowing responders to prioritize responses and resources according to the threat.

• Scores are calculated using a formula that depends on several metrics that approximate the ease of exploitation and its impact. Scores range from 0 to 10, with 10 being the most severe.

• While many utilize only the CVSS Base score to determine severity, temporal and environmental scores also exist to factor in the availability of mitigations and the widespread vulnerability of systems within an organization.

Viewing Discovered Vulnerabilities and Scoring Data

Navigate to the Vulnerabilities module to see the details of discovered vulnerabilities, including their respective Severity, Base Score, Impact Score, Exploitability Score, and EPSS Score.

Tap on the Problem Name link to see additional scoring details from the source:

Need Support?

Contact our support team by sending an email to support@connectsecure.com or by visiting our Partner Portal, where you can create, view, and manage your tickets.

https://cybercns.freshdesk.com/en/support/login