Unit 04: LO 4 - 4.1 - CVE / CVSS

Sure, let's think of cybersecurity as a game of hide-and-seek where the "seekers" are the good guys looking for vulnerabilities or "hiding spots" that could be exploited by the bad guys. In this game, Common Vulnerabilities and Exposures (CVE) and the Common Vulnerability Scoring System (CVSS) are important tools.

Common Vulnerabilities and Exposures (CVE)

• What it Means: CVE is like a big dictionary that lists known "hiding spots" or vulnerabilities in software and hardware. Each vulnerability gets a unique identifier, which makes it easier for everyone to know exactly which "hiding spot" we're talking about.

• Example: Imagine if every "hiding spot" in the game had a name like "HidingSpot123." If you know the bad guys are often using "HidingSpot123," you can work on making that spot less accessible.

Common Vulnerability Scoring System (CVSS)

• What it Means: Now that you have a list of "hiding spots" from CVE, CVSS helps you understand how good or bad each spot is for hiding. It provides a score from 0 to 10, with 10 being the most severe.

• Example: Let's say "HidingSpot123" has a CVSS score of 9. That means it's a really good spot for bad guys to exploit. You'll want to fix it ASAP!

Why Are CVE and CVSS Important?

• Standardization: Just like having specific names for "hiding spots" makes the game easier, CVE and CVSS create a standard way of identifying and discussing vulnerabilities.

• Prioritization: If you know which "hiding spots" are the most favorable for the bad guys (high CVSS score), you can focus on fixing those first.

• Communication: When everyone uses the same names and scoring system, it's easier to communicate. You don't have to explain what "HidingSpot123" is every time; people who are aware of CVE and CVSS will understand.

• Decision-making: The score can help organizations decide how much time and money should be allocated to fix a specific vulnerability.

So, in our game of cybersecurity hide-and-seek, CVE is the tool that helps you identify the "hiding spots," and CVSS is the tool that tells you how urgently you need to "seek" or secure each one.