diff --git a/draft/ssvc.html b/draft/ssvc.html index 33131090..a3305ddf 100644 --- a/draft/ssvc.html +++ b/draft/ssvc.html @@ -7,180 +7,184 @@ - - - - + - SSVC – Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization (SSVC version 2.1.edb7190) + + SSVC – Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization (SSVC) version 2.1.0-edb6c97 +html { +color: #1a1a1a; +background-color: #fdfdfd; +} +body { +margin: 0 auto; +max-width: 36em; +padding-left: 50px; +padding-right: 50px; +padding-top: 50px; +padding-bottom: 50px; +hyphens: auto; +overflow-wrap: break-word; +text-rendering: optimizeLegibility; +font-kerning: normal; +} +@media (max-width: 600px) { +body { +font-size: 0.9em; +padding: 12px; +} +h1 { +font-size: 1.8em; +} +} +@media print { +html { +background-color: white; +} +body { +background-color: transparent; +color: black; +font-size: 12pt; +} +p, h2, h3 { +orphans: 3; +widows: 3; +} +h2, h3, h4 { +page-break-after: avoid; +} +} +p { +margin: 1em 0; +} +a { +color: #1a1a1a; +} +a:visited { +color: #1a1a1a; +} +img { +max-width: 100%; +} +h1, h2, h3, h4, h5, h6 { +margin-top: 1.4em; +} +h5, h6 { +font-size: 1em; +font-style: italic; +} +h6 { +font-weight: normal; +} +ol, ul { +padding-left: 1.7em; +margin-top: 1em; +} +li > ol, li > ul { +margin-top: 0; +} +blockquote { +margin: 1em 0 1em 1.7em; +padding-left: 1em; +border-left: 2px solid #e6e6e6; +color: #606060; +} +code { +font-family: Menlo, Monaco, Consolas, 'Lucida Console', monospace; +font-size: 85%; +margin: 0; +hyphens: manual; +} +pre { +margin: 1em 0; +overflow: auto; +} +pre code { +padding: 0; +overflow: visible; +overflow-wrap: normal; +} +.sourceCode { +background-color: transparent; +overflow: visible; +} +hr { +background-color: #1a1a1a; +border: none; +height: 1px; +margin: 1em 0; +} +table { +margin: 1em 0; +border-collapse: collapse; +width: 100%; +overflow-x: auto; +display: block; +font-variant-numeric: lining-nums tabular-nums; +} +table caption { +margin-bottom: 0.75em; +} +tbody { +margin-top: 0.5em; +border-top: 1px solid #1a1a1a; +border-bottom: 1px solid #1a1a1a; +} +th { +border-top: 1px solid #1a1a1a; +padding: 0.25em 0.5em 0.25em 0.5em; +} +td { +padding: 0.125em 0.5em 0.25em 0.5em; +} +header { +margin-bottom: 4em; +text-align: center; +} +#TOC li { +list-style: none; +} +#TOC ul { +padding-left: 1.3em; +} +#TOC > ul { +padding-left: 0; +} +#TOC a:not(:hover) { +text-decoration: none; +} +code{white-space: pre-wrap;} +span.smallcaps{font-variant: small-caps;} +div.columns{display: flex; gap: min(4vw, 1.5em);} +div.column{flex: auto; overflow-x: auto;} +div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;} +ul.task-list{list-style: none;} +ul.task-list li input[type="checkbox"] { +width: 0.8em; +margin: 0 0.8em 0.2em -1.6em; +vertical-align: middle; +} +.display.math{display: block; text-align: center; margin: 0.5rem auto;} + +div.csl-bib-body { } +div.csl-entry { +clear: both; +} +.hanging-indent div.csl-entry { +margin-left:2em; +text-indent:-2em; +} +div.csl-left-margin { +min-width:2em; +float:left; +} +div.csl-right-inline { +margin-left:2em; +padding-left:1em; +} +div.csl-indent { +margin-left: 2em; +} @@ -188,17 +192,15 @@

Prioritizing Vulnerability Response: A -Stakeholder-Specific Vulnerability Categorization (SSVC version -2.1.edb7190)

+Stakeholder-Specific Vulnerability Categorization (SSVC) version +2.1.0-edb6c97

Jonathan M. Spring

Eric Hatleback

Allen D. Householder

-

Art Manion

-

Madison Oliver

-

Vijay Sarvapalli

-

Deana Shick

+

Vijay S. Sarvepalli

Laurie Tyzenhaus

-

Compiled Mon Jul 17 17:07:19 UTC 2023

+

Charles G. Yarbrough

+

2023-09-01T15:03:59-04:00

Introduction

This document defines a testable Stakeholder-Specific Vulnerability @@ -590,12 +592,12 @@

Representation choices

Likely Decision Points and Relevant Data). A CSV will typically be 30-100 rows that each look something like:

-
2,none,slow,diffuse,laborious,partial,minor,defer
-

Where “2” is the row number, none through minor are values for decision -points, and defer is a priority label or outcome. Different -stakeholders will have different decision points (and so different -options for values) and different outcomes, but this is the basic shape -of a CSV file to define SSVC stakeholder decisions.

+
2,none,laborious,partial,significant,scheduled
+

Where “2” is the row number, none through significant are values for +decision points, and scheduled is a priority label or outcome. +Different stakeholders will have different decision points (and so +different options for values) and different outcomes, but this is the +basic shape of a CSV file to define SSVC stakeholder decisions.

The tree visualization options are more diverse. We provide an example format, and codified it in src/SSVC_csv-to-latex.py. Why have we gone to this trouble when (for example) the R data.tree @@ -2710,14 +2712,15 @@

Supplier Involvement

This decision point accounts for the state of the supplier's work on addressing the vulnerability.

-

Prioritization

Given a specific stakeholder decision and set of useful decision points, we are now in a position to combine them into a comprehensive set of decisions about the priority with which to act. The definition of @@ -2730,8 +2733,8 @@

Prioritization

  • (Human Impact IS medium)
  • THEN priority is scheduled.
    • -

    This logical statement is captured in line 35 of the deployer -.csv file.

    +

    This example logical statement is captured in (line 35 of the +deployer .csv file)[https://github.com/CERTCC/SSVC/blob/main/data/csvs/deployer-options.csv#L35].

    There are different formats for capturing these prioritization decisions depending on how and where they are going to be used. In this paper, we primarily represent a full set of guidance on how one @@ -2743,7 +2746,7 @@

    Prioritization

    decisions. How this decision information might be stored or communicated is the topic of subsections on Asset Management and Communication.

    Supplier Tree

    -

    The example supplier tree PDF shows the proposed +

    The example supplier tree PDF shows the proposed prioritization decision tree for the supplier. Both supplier and deployer trees use the above decision point definitions. Each tree is a compact way of expressing assertions or hypotheses about the relative @@ -2764,19 +2767,19 @@

    Supplier Tree

    Deployer Tree

    -

    The example deployer tree PDF is depicted +

    The example deployer tree PDF is depicted below.

    @@ -2802,14 +2805,14 @@

    Triage Decision Tree

    as described in Tree Construction and Customization Guidance.

    Publication Decision Tree

    -

    Suggested decision values for this decision are available in CSV and PDF formats.

    +

    Suggested decision values for this decision are available in CSV and PDF formats.

    @@ -2853,12 +2856,12 @@

    Tree Construction communicate precisely the circumstances where they differ.

    When doing the detailed risk management work of creating or modifying a tree, we recommend working from text files with one line or row for -each unique combination of decision values. For examples, see SSVC/data. An -important benefit, in our experience, is that it is easier to identify a -question by saying “I'm unsure about row 16” than anything else we have -thought of so far. Once the humans agree on the decision tree, it can be -converted to a JSON schema for easier machine-readable communication, -following the provided SSVC +each unique combination of decision values. For examples, see SSVC/data. +An important benefit, in our experience, is that it is easier to +identify a question by saying “I'm unsure about row 16” than anything +else we have thought of so far. Once the humans agree on the decision +tree, it can be converted to a JSON schema for easier machine-readable +communication, following the provided SSVC provision JSON schema.

    Once the decision points are selected and the prioritization labels agreed upon, it is convenient to be able to visually compress the text @@ -2925,8 +2928,9 @@

    Parsimony

    comparing a fitness metric on the shuffled tree to the original. The change in fitness is taken to be the importance of the feature that was shuffled. Permutation importance is usually given as a number in the -interval [0,1]. Python's scikit-learn provides a permutation importance -method, which we used to evaluate our trees.

    +interval [0,1]. Python's scikit-learn (Pedregosa et al. 2011) +provides a permutation importance method, which we used to evaluate our +trees.

    Interpreting the results of a permutation importance computation on a tree involves nuance, but one rule we can state is this: any feature with a computed permutation importance of zero can be eliminated from @@ -3073,7 +3077,7 @@

    Decision Tree Scope

    should be treated as creating a new decision point. The new decision point should be given a distinct name as well.
  • defining a new tree entirely from existing or new decision -points
    • +points.

    Because tree customization changes the tree structure and implies the @@ -3148,9 +3152,8 @@

    Guidance for Evidence about Automatable, the safer answer to assume is yes. Value Density should always be answerable; if the product is uncommon, it is probably diffuse. The resulting decision set -{none, open, efficient, medium} -results in a scheduled patch application in our recommended deployer -tree.

    +{none, open, yes, medium} results in +a scheduled patch application in our recommended deployer tree.

    Relationship to asset management

    Vulnerability management is a part of asset management. SSVC can @@ -3306,10 +3309,9 @@

    Abbreviated Format

    5.6. This is a subset of the date format also commonly known as ISO8601 format.

    Based on this, an example string could be:

    -
    SSVCv2/Ps:Nm/T:T/U:E/2018-11-13T20:20:00Z/
    -

    For a vulnerability with no or -minor Public Safety -Impact, total Technical Impact, and efficient Utility, +

    SSVCv2/Ps:M/T:T/U:E/2018-11-13T20:20:00Z/
    +

    For a vulnerability with minimal +Public Safety Impact, total Technical Impact, and efficient Utility, which was evaluated on Nov 13,2018 at 8:20 PM UTC.

    While these abbreviated format vectors can be uniquely produced based on a properly formatted JSON object, going from abbreviated form to JSON @@ -3317,9 +3319,9 @@

    Abbreviated Format

    transmission method.

    Full JSON format

    For a more robust, self-contained, machine-readable, we provide JSON -schemas. The provision +schemas. The provision schema is equivalent to a decision tree and documents the full set -of logical statements that a stakeholder uses to make decisions. The computed +of logical statements that a stakeholder uses to make decisions. The computed schema expresses a set of information about a work item or vulnerability at a point in time. A computed schema should identify the provision schema used, so the options from which the information was @@ -3367,7 +3369,7 @@

    Partial or Incomplete need for a special “I don't know” marker.

    The merit in this “list all values” approach emerges when the stakeholder knows that the value for a decision point may be A or B, but -not C. For example, say the analyst knows that Value Density is diffuse but does not know the value for *Automatability. Then the analyst can +not C. For example, say the analyst knows that Value Density is diffuse but does not know the value for Automatability. Then the analyst can usefully restrict Utility to one of laborious or efficient. In abbreviated form, write this as U:LE. As discussed below, information can change over time. Partial information may be, but is not @@ -3413,8 +3415,7 @@

    Information Changes Over tree, but information polling frequency is also a risk tolerance decision and each organization may choose different time values.