Initial commit - 611 cybersecurity skills across all subdomains

2026-08-02 09:07:41 +03:00 · 2026-02-25 10:47:44 +01:00
commit 22a7ab1462
1765 changed files with 280648 additions and 0 deletions
@@ -0,0 +1,38 @@
+# Standards and References - CVSS Scoring
+
+## Official CVSS Documentation
+- CVSS v4.0 Specification: https://www.first.org/cvss/specification-document
+- CVSS v4.0 User Guide: https://www.first.org/cvss/v4.0/user-guide
+- CVSS v4.0 Calculator: https://www.first.org/cvss/calculator/4.0
+- NVD CVSS v4 Calculator: https://nvd.nist.gov/vuln-metrics/cvss/v4-calculator
+- Red Hat CVSS v4 Calculator: https://github.com/RedHatProductSecurity/cvss-v4-calculator
+
+## Complementary Scoring Systems
+- EPSS (Exploit Prediction): https://www.first.org/epss/
+- SSVC (Stakeholder-Specific): https://www.cisa.gov/ssvc
+- CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
+
+## Industry Standards
+- **NIST SP 800-40 Rev 4**: Guide to Enterprise Patch Management Planning
+- **NIST NVD**: National Vulnerability Database uses CVSS for all CVEs
+- **PCI DSS v4.0**: Requires CVSS scoring for vulnerability prioritization
+- **ISO 27001:2022 A.8.8**: Technical vulnerability management
+
+## CVSS v4.0 vs v3.1 Key Differences
+| Feature | CVSS v3.1 | CVSS v4.0 |
+|---------|-----------|-----------|
+| Metric Groups | 3 (Base, Temporal, Environmental) | 4 (Base, Threat, Environmental, Supplemental) |
+| Attack Requirements | N/A | New metric (AT) |
+| User Interaction | None/Required | None/Passive/Active |
+| Scope | Changed/Unchanged | Replaced by Subsequent System metrics |
+| Temporal -> Threat | Report Confidence, RL, E | Only Exploit Maturity |
+| Supplemental | N/A | Safety, Automatable, Recovery, etc. |
+
+## Severity Thresholds
+| Rating | CVSS v3.1 | CVSS v4.0 |
+|--------|-----------|-----------|
+| None | 0.0 | 0.0 |
+| Low | 0.1 - 3.9 | 0.1 - 3.9 |
+| Medium | 4.0 - 6.9 | 4.0 - 6.9 |
+| High | 7.0 - 8.9 | 7.0 - 8.9 |
+| Critical | 9.0 - 10.0 | 9.0 - 10.0 |
@@ -0,0 +1,53 @@
+# Workflows - CVSS Vulnerability Prioritization
+
+## Workflow 1: Vulnerability Scoring Pipeline
+
+```
+┌──────────────────┐     ┌──────────────────┐     ┌──────────────────┐
+│ Receive CVE /    │────>│ Look Up NVD      │────>│ Extract CVSS     │
+│ Scan Results     │     │ Base Score       │     │ Vector String    │
+└──────────────────┘     └──────────────────┘     └──────────────────┘
+                                                          │
+        ┌────────────────────────────────────────────────┘
+        v
+┌──────────────────┐     ┌──────────────────┐     ┌──────────────────┐
+│ Enrich with EPSS │────>│ Check CISA KEV   │────>│ Apply Env Metrics│
+│ Threat Score     │     │ Catalog          │     │ (Asset Context)  │
+└──────────────────┘     └──────────────────┘     └──────────────────┘
+        │
+        v
+┌──────────────────┐     ┌──────────────────┐
+│ Calculate Final  │────>│ Assign Priority  │
+│ Risk Score       │     │ & SLA            │
+└──────────────────┘     └──────────────────┘
+```
+
+## Workflow 2: Risk-Weighted Prioritization
+
+```
+For each vulnerability:
+    1. base_score = NVD CVSS v4.0 base score (0-10)
+    2. epss_score = FIRST EPSS probability (0-1)
+    3. asset_score = CMDB criticality rating (1-5)
+    4. exposure_score = Network exposure (1=internal, 3=DMZ, 5=internet)
+    5. kev_bonus = 2.0 if in CISA KEV, else 0
+
+    risk_score = (base_score * 0.25) +
+                 (epss_score * 10 * 0.25) +
+                 (asset_score * 2 * 0.20) +
+                 (exposure_score * 2 * 0.15) +
+                 kev_bonus * 0.15
+
+    priority = map_to_sla(risk_score)
+```
+
+## Workflow 3: Continuous Re-Scoring
+
+| Trigger | Action |
+|---------|--------|
+| New CVE published | Score with base metrics, schedule review |
+| EPSS update (daily) | Refresh EPSS scores, re-prioritize |
+| Exploit published | Update Exploit Maturity to POC or Attacked |
+| Added to CISA KEV | Elevate priority to P1/P2 |
+| Patch available | Add to remediation queue |
+| Asset decommissioned | Close associated findings |