Thread by @RapidFortInc

Who determines how severe a vulnerability is?

Severity is how much damage a hacker can inflict exploiting a product using that vulnerability. It doesn’t mean this is the most critical risk facing your system, but many developers mistakenly think it is.

1/ Severity & other information related to a known issue are catalogued in a Common Vulnerabilities & Exposures (CVE) database.

Several orgs track CVEs, including the National Institute of Standards & Technology @NIST #severity #vulnerabilities

2/ The rubric for scoring severity is the Common Vulnerability Scoring System (CVSS), an open framework for communicating the characteristics & severity of software vulnerabilities.

Several factors are classified into three categories: base, temporal & environmental.

3/ Though vulnerabilities can be classified as low, medium, high, or critical, they all provide the potential for a bad actor to enter & operate in your environment.

4/ Hacking is not a linear process. A malicious attack could begin with a low-severity exploit that provides the opportunity to move laterally and find a more dangerous exploit.

5/ Severity is not an arbitrary rating of a vulnerability, but when an organization is facing a software component analysis (SCA) scanner report containing 7,000 vulnerabilities, they almost always think:

“Let’s just take care of the critical- and high-severity problems.”

6/ Which vulnerabilities present a higher risk? An available Proof of Concept (POC) makes a vulnerability much more dangerous. With Rapid Risk Score, identify which vulnerabilities have POCs & are riskier.

#RRS #RapidFort

7/ Our SCA scanner not only identifies vulnerabilities, it also provides a full SBOM & predicts both Proof of Concept availability & the % you could reduce your attack surface by if you hardened your containers.

Get a head start on your planning for free: loom.ly/PVL-YwE