Rethinking CVSS for Penetration Testing

In penetration testing reports, it's crucial to provide organizations with a risk estimate for findings, so the development teams can prioritize items on their product backlogs. These risk assessments provide the organization with much-needed prioritization and context. An often-seen method is the Common Vulnerability Scoring System (CVSS). However, relying solely on the CVSS to interpret these results may inadvertently overlook critical business-specific risk factors.

The CVSS score: A Generalized Approach

The CVSS score is a widely accepted standard for assessing the severity of vulnerabilities. It's an invaluable tool, offering a standardized framework to rank vulnerabilities based on their potential impact and exploitability. The CVSS score categorizes vulnerabilities into critical, high, medium, or low severity, aiding in prioritization and resource allocation for remediation efforts.

CVSS scores are especially important for communicating risks associated with common vulnerabilities. Say a vulnerability is discovered in Microsoft Exchange: Microsoft does not know the context of the usage of the application and can therefore only communicate a generalized impact assessment. Penetration testers, however, do not have this limitation.

The Limitations of CVSS Scores in Penetration Testing

While CVSS scores provide a standardized assessment of vulnerability severity, they fall short when applied directly to penetration testing results. Penetration tests often uncover vulnerabilities within a specific context, including understanding an organization's unique infrastructure, its applications, and the potential impact on critical business processes.

Penetration tests should be tailored to align with an organization's specific risk criteria. A vulnerability that may seem informational based on CVSS scores might hold greater importance when considering the business context. On the other hand, a high CVSS score might not be critical to an organization, based on the specific characteristics of the application or business process.

Code Guardian once encountered a finding which CVSS scored as High. On further investigation though, we found that the business context for the application brought the actual risks way down. Without correcting for this risk, the organization might have prioritized its remediation efforts differently.

Calculating CVSS Scores

CVSS scores are often calculated using the CVSS calculator. The calculator requires the user to fill in details about the vulnerability, such as the attack complexity and the impact on confidentiality, availability, and integrity of the system. It subsequently generates a score on a scale from 0 to 10, and a vector containing all metrics. The final score might look something like this:

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N

The elements in the string tell the reader, among other things, the Attack Vector (AV) is Network (N) and the Attack Complexity (AC) is High (H). The final scoring for this vulnerability based on the CVSS calculator would be 7.0/High, mainly caused by the High (H) impact on the system's confidentiality (SC).

Integrating Environmental Factors in CVSS

An often overlooked feature of the CVSS score is the environmental score. This feature within the calculator allows the users to take into consideration the systems' requirements for confidentiality, availability, and integrity in calculating the final score.

In the earlier example, the score was calculated without using the environmental factors. The impact of the vulnerability was High on confidentiality, and None on both Integrity and Availability. Using this example, and considering the requirements of the systems, we can recalculate the CVSS score and look for the implications for the final score.

In this example, we'll set the system's confidentiality requirements (CR) to Low (L), Integrity (IR) to Medium (M), and the system's availability requirements (AR) to High (H). Recalculating, the CVSS calculator now presents us with the same vector, but with the additional environmental information:

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N/CR:L/IR:M/AR:H

The final CVSS score is now set to 5.7/Medium. Depending on your organization's policies, this might have a tremendous impact on the prioritization of this issue. Fixing this vulnerability might otherwise have delayed implementing new features, and resources might have been misallocated.

How to Use Environmental Factors as a Customer

In this article, we presented the method for calculating CVSS scores. You can recalculate the CVSS scores from previous penetration tests by entering the presented vectors in the CVSS calculator and adding the environmental factors. Please ask your application security partner what steps they take to consider your system's requirements and environmental factors. Don't assume they use the environmental score: it is an often-overlooked part of the CVSS calculator.

Curious about how Code Guardian takes into consideration your business context and your system's requirements? Contact us through [email protected] or visit www.codeguardian.nl.