Security/VMT-Metrics - Revision history

Robert-clark at 12:15, 12 November 2014

2014-11-12T12:15:55Z

Robert-clark: /* DREAD */

2014-11-12T11:44:31Z

‎DREAD

Robert-clark: /* Damage Potential */

2014-11-12T11:11:43Z

‎Damage Potential

Robert-clark: /* Reproducibility */

2014-11-12T11:07:11Z

‎Reproducibility

Robert-clark: /* DREAD */

2014-11-12T10:49:08Z

‎DREAD

Robert-clark: /* DREAD */

2014-11-12T09:58:13Z

‎DREAD

Robert-clark: /* DREAD */

2014-11-12T09:55:33Z

‎DREAD

Robert-clark: /* Introduction */

2014-11-12T09:42:49Z

‎Introduction

Robert-clark: /* Introduction */

2014-11-12T09:42:12Z

‎Introduction

Robert-clark: Created page with "== Introduction == The OpenStack Security Group suggests that when OpenStack Security Advisories are created by the VMT use the following metrics to score the potential impact..."

2014-11-12T09:41:40Z

Created page with "== Introduction == The OpenStack Security Group suggests that when OpenStack Security Advisories are created by the VMT use the following metrics to score the potential impact..."

New page

== Introduction ==
The OpenStack Security Group suggests that when OpenStack Security Advisories are created by the VMT use the following metrics to score the potential impact of vulnerabilities on OpenStack Deployments

As with all scoring systems this will not be universally applicable but will provide basic guidance to the severity of each vulnerability.

The OSSG has adapted the [[DREAD|https://www.owasp.org/index.php/Threat_Risk_Modeling]] metric as a basis for OpenStack vulnerability impact assessment. We adapted each of the scoring categories to better reflect the impact of a vulnerability in a cloud context.

== DREAD ==
DREAD scores five categories, which are summed together and divided by five, the result is a score from 0-5 where 0 indicates no impact and 5 is the worst possible outcome:

Risk = ('''D'''AMAGE + '''R'''EPRODUCIBILITY + '''E'''XPLOITABILITY + '''A'''FFECTED USERS + '''D'''ISCOVERABILITY) / 5

@@ Line 5: / Line 5: @@
 The OSSG has adapted the [https://www.owasp.org/index.php/Threat_Risk_Modeling DREAD] metric as a basis for OpenStack vulnerability impact assessment. We adapted each of the scoring categories to better reflect the impact of a vulnerability in a cloud context.
 == DREAD ==
@@ Line 10: / Line 13: @@
 Risk = (DAMAGE + REPRODUCIBILITY + EXPLOITABILITY + AFFECTED USERS + DISCOVERABILITY) / 10
 ==== Damage Potential ====
 * If the vulnerability is exploited, how much damage will be caused?
 ** 0 = Nothing
-** 3 = Individual user data is compromised or affected
+** 3 = Individual user data is compromised, affected or availability denied
-** 5 = All individual tenant data is compromised or affected
+** 5 = All individual tenant data is compromised, affected or availability denied
-** 7 = All tenant data is compromised or affected
+** 7 = All tenant data is compromised, affected or availability denied
 ** 9 = Underlying cloud management and infrastructure data is compromised or affected
-** 10 = Complete system or data destruction
+** 10 = Complete system or data destruction, failure or compromise
 ==== Reproducibility ====
@@ Line 52: / Line 54: @@
 ** 10 = The information is visible in the web browser address bar or in a form
-== Discussion ==
+== Calibration ==
-Boopity boop
+Here we take a number of recent OpenStack Security Advisories and attempt to apply the above metrics. Scoring will always be subjective but the hope is we can use these previous vulnerabilities to first tune the scoring for each category and use them later to validate scores for new vulnerabilities.

← Older revision		Revision as of 11:44, 12 November 2014
Line 10:		Line 10:

	Risk = (DAMAGE + REPRODUCIBILITY + EXPLOITABILITY + AFFECTED USERS + DISCOVERABILITY) / 10		Risk = (DAMAGE + REPRODUCIBILITY + EXPLOITABILITY + AFFECTED USERS + DISCOVERABILITY) / 10
		+
		+	=== Public vs Private Cloud ===
		+	One of the difficulties we face when trying to determine the impact of a vulnerability in OpenStack is understanding how it affects different deployment types. An argument can be made that authenticated users on a private cloud could be more trusted than in a public cloud. However, in designing this threat metric we assert that you cannot confidently trust all employees using a private cloud any more than you can trust users of a public cloud - an assertion somewhat validated by the regular identification of [malicious insiders http://en.wikipedia.org/wiki/Insider_threat] as one of the biggest threats to any organisation<ref name="r1">[http://www.cert.org/insider-threat/research/case-analysis-and-best-practices.cfm]</ref>.

	==== Damage Potential ====		==== Damage Potential ====

@@ Line 13: / Line 13: @@
 ==== Damage Potential ====
 * If the vulnerability is exploited, how much damage will be caused?
-** 0 = X
+** 0 = Nothing
-** 5 = Y
+** 3 = Individual user data is compromised or affected
-** 10 = Z
+** 5 = All individual tenant data is compromised or affected
 ==== Reproducibility ====

@@ Line 19: / Line 19: @@
 ==== Reproducibility ====
 * How reliably can the vulnerability be exploited?
-** 0 = X
+** 0 = Very hard or impossible, even for administrators. The vulnerability is unstable and statistically unlikey to be reliably exploited
-** 5 = Y
+** 5 = One or two steps required, tooling / scripting readily available
-** 10 = Z
+** 10 = Unauthenticated users can trivially and reliably exploit using only a web browser
 ==== Exploitability ====

@@ Line 12: / Line 12: @@
 ==== Damage Potential ====
 ** 0 = X
 ** 5 = Y
@@ Line 17: / Line 18: @@
 ==== Reproducibility ====
 ** 0 = X
 ** 5 = Y
@@ Line 22: / Line 24: @@
 ==== Exploitability ====
-** 0 = X
+* How difficult is the vulnerability to exploit?
-** 5 = Y
+** 0 = N/A We assert that every vulnerability is exploitable, given time and effort. All scores should be 1-10
-** 10 = Z
+** 1 = Even with direct knowledge of the vulnerability we do not see a viable path for exploitation
 ==== Affected Users ====
-** 0 = X
+* How many users will be affected?
-** 5 = Y
+** 0 = None
-** 10 = Z
+** 5 = Specific to a given project
 ==== Discoverability ====
-** 0 = X
+* How easy is it to discover the threat, to learn of the vulnerability (By convention this is set to 10 even for privately reported vulnerabilities)
-** 5 = Y
+** 0 = Very hard to impossible to detect even given access to source code and privilege access to running systems
-** 10 = Z
+** 5 = Can figure it out by guessing or by monitoring network traces
 == Discussion ==
 Boopity boop

@@ Line 7: / Line 7: @@
 == DREAD ==
-DREAD scores five categories, which are summed together and divided by five, the result is a score from 0-5 where 0 indicates no impact and 5  is the worst possible outcome:
+DREAD scores five categories, which are summed together and divided by five, the result is a score from 0-10 where 0 indicates no impact and 10  is the worst possible outcome:
-Risk = ('''D'''AMAGE + '''R'''EPRODUCIBILITY + '''E'''XPLOITABILITY + '''A'''FFECTED USERS + '''D'''ISCOVERABILITY) / 5
+Risk = (DAMAGE + REPRODUCIBILITY + EXPLOITABILITY + AFFECTED USERS + DISCOVERABILITY) / 10

@@ Line 4: / Line 4: @@
 As with all scoring systems this will not be universally applicable but will provide basic guidance to the severity of each vulnerability.
-The OSSG has adapted the [[https://www.owasp.org/index.php/Threat_Risk_Modeling|DREAD]] metric as a basis for OpenStack vulnerability impact assessment. We adapted each of the scoring categories to better reflect the impact of a vulnerability in a cloud context.
+The OSSG has adapted the [https://www.owasp.org/index.php/Threat_Risk_Modeling DREAD] metric as a basis for OpenStack vulnerability impact assessment. We adapted each of the scoring categories to better reflect the impact of a vulnerability in a cloud context.
 == DREAD ==