Vulnerability classification (CVSS) in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does CVSS stand for in cybersecurity?

CVSS stands for Common Vulnerability Scoring System. It is a standardized way to measure the severity of security vulnerabilities.

intermediate

Name the three metric groups used in CVSS to score vulnerabilities.

The three metric groups are:<br>1. Base Metrics - intrinsic qualities of a vulnerability.<br>2. Temporal Metrics - characteristics that change over time.<br>3. Environmental Metrics - specific to a user’s environment.

beginner

What does the Base Score in CVSS represent?

The Base Score represents the fundamental severity of a vulnerability. It is calculated from metrics that do not change over time or across environments.

intermediate

Why are Temporal Metrics important in CVSS?

Temporal Metrics adjust the Base Score based on factors like exploit code maturity, remediation level, and report confidence, reflecting how the risk changes over time.

intermediate

How do Environmental Metrics affect the CVSS score?

Environmental Metrics customize the CVSS score to reflect the impact of a vulnerability in a specific environment, considering factors like security controls and importance of affected systems.

What is the primary purpose of CVSS?

A To measure the severity of security vulnerabilities

B To create software patches

C To encrypt data

D To monitor network traffic

CVSS is designed to provide a standardized way to measure how severe a vulnerability is.

Which CVSS metric group includes factors like exploit code maturity?

A Environmental Metrics

B Base Metrics

C Temporal Metrics

D Network Metrics

Temporal Metrics include factors that change over time, such as exploit code maturity.

Which CVSS metric group is specific to the user’s environment?

A Temporal Metrics

B Environmental Metrics

C Base Metrics

D Physical Metrics

Environmental Metrics adjust the score based on the specific environment where the vulnerability exists.

What does a higher CVSS Base Score indicate?

A Higher severity

B Lower severity

C More network traffic

D Better system performance

A higher Base Score means the vulnerability is more severe.

Which of the following is NOT a CVSS metric group?

A Base Metrics

B Temporal Metrics

C Environmental Metrics

D Operational Metrics

Operational Metrics is not part of CVSS; the three groups are Base, Temporal, and Environmental.

Explain the three main metric groups of CVSS and their roles in vulnerability scoring.

Think about what stays the same, what changes over time, and what depends on your environment.

Describe why CVSS is useful for organizations managing cybersecurity risks.

Consider how knowing severity helps in fixing problems.