Analyzing Output from Vulnerability Scanners Flashcards
A commonly used scheme for identifying vulnerabilities developed by MITRE and
adopted by NIST
Common Vulnerabilities and Exposures (CVE)
A superset of the CVE database, maintained by NIST, that contains additional
information such as analysis, criticality metrics (CVSS), and fix information or
instructions
National Vulnerability Database (NVD)
A knowledge base maintained by MITRE that classifies specific attack patterns
focused on application security and exploit techniques
Common Attack Pattern Enumeration and Classification (CAPEC)
Scheme for identifying hardware devices, operating systems,
and applications
▪ cpe:/{part}:{vendor}:
{product}:{version}:
{update}:{edition}:{language}
Common Platform Enumeration (CPE)
Scheme for provisioning secure configuration checks across multiple sources
Common Configuration Enumeration (CCE)
A risk management approach to quantifying vulnerability data and then taking
into account the degree of risk to different types of systems or information
Common Vulnerability Scoring System (CVSS)
Physical (P), Local (L), Adjacent network (A), or Network (N)
Access Vector (AV)
High (H) or Low (L)
Access Complexity (AC)
None (N), Low (L), or High (H)
Privileges Required (PR)
Unchanged (U) or Changed (C)
Scope (S)
High (H), Medium (M), or Low (L)
Confidentiality (C)
High (H), Medium (M), or Low (L)
Integrity (I)
High (H), Medium (M), or Low (L)
Availability (A)
A vulnerability report that is not validated is useless
o True Positives
o False Positives
o True Negatives
o False Negatives
Vulnerability Reports
An alert that matches a vulnerability and the vulnerability exists on the system
True Positive
An alert that matches a vulnerability and the vulnerability does not exist on the
system
False Positive
Exception Management
Exception Management
An alert is not generated because there is no matching vulnerability on the
system
True Negative
An alert is not generated even though there is a matching vulnerability on the
system
False Negative
Reconcile results because scanners can misinterpret the information, they receive
from their probes
Validating Scan Reports
A commercial vulnerability scanner produced by Tenable Network Security for on-premise and cloud-based vulnerability scanning
Nessus
Open source vulnerability scanner that began its development from the Nessus
codebase when Nessus was converted to commercial software
OpenVAS
A cloud-based vulnerability management solution with installed sensor agents at
various points in their network and the sensors upload data to the cloud platform
for analysis
Qualys
