|
|
Each security risk and area of concern is measured based on the following
metrics:
- Exploitation.
Is the risk easy to exploit, or difficult?
Does it require special knowledge, or can anyone do it?
Can it be exploited every time, or do the stars need to be aligned just right?
Does exploitation require specific privileges
(e.g., a local login on the LAN, or a specific type of system access)?
- Scope.
What systems are affected? Just one?
All with a specific component?
Every system with the software installed?
- Impact.
What happens when it is exploited?
Does it cause a denial-of-service (DoS), grant elevated privileges, or
provide internal information that may be used by a different exploit
(e.g., account listings, log files, or directory browsing).
- Future Impact.
(White-box evaluations only.)
Some security risks cannot be exploited with the system's current state,
but may become exploitable if parts of the system change.
For example, a function may contain a buffer overflow condition,
but is never called with the specific exploit requirements.
Later code revisions, such as adding a new calling function or removing
a validation step, may permit exploitation.
As an alternate example, many systems rely on firewalls rather than
system hardening. Changing the firewall configuration may permit
system exploitation.
Although "Future Impact" areas do not currently pose an exploitable risk,
they should not be ignored during future development or deployment.
Each of these risk metrics are weighted on a three point scale:
- Low.
Low risk or minimal impact, unlikely even with knowledge of the exploit.
- Medium.
Serious risk with inside knowledge, but unlikely from an outsider.
- High.
Easy to exploit, serious damage, no internal knowledge required, etc.
|
|