Analyzing Output from Vulnerability Scanners Flashcards
A commonly used scheme for identifying vulnerabilities developed by MITRE and
adopted by NIST
Common Vulnerabilities and Exposures (CVE)
A superset of the CVE database, maintained by NIST, that contains additional
information such as analysis, criticality metrics (CVSS), and fix information or
instructions
National Vulnerability Database (NVD)
A knowledge base maintained by MITRE that classifies specific attack patterns
focused on application security and exploit techniques
Common Attack Pattern Enumeration and Classification (CAPEC)
Scheme for identifying hardware devices, operating systems,
and applications
▪ cpe:/{part}:{vendor}:
{product}:{version}:
{update}:{edition}:{language}
Common Platform Enumeration (CPE)
Scheme for provisioning secure configuration checks across multiple sources
Common Configuration Enumeration (CCE)
A risk management approach to quantifying vulnerability data and then taking
into account the degree of risk to different types of systems or information
Common Vulnerability Scoring System (CVSS)
Physical (P), Local (L), Adjacent network (A), or Network (N)
Access Vector (AV)
High (H) or Low (L)
Access Complexity (AC)
None (N), Low (L), or High (H)
Privileges Required (PR)
Unchanged (U) or Changed (C)
Scope (S)
High (H), Medium (M), or Low (L)
Confidentiality (C)
High (H), Medium (M), or Low (L)
Integrity (I)
High (H), Medium (M), or Low (L)
Availability (A)
A vulnerability report that is not validated is useless
o True Positives
o False Positives
o True Negatives
o False Negatives
Vulnerability Reports
An alert that matches a vulnerability and the vulnerability exists on the system
True Positive
