If multiple vulnerabilities are detected in your assets, you may be unable to identify the vulnerability that needs to be fixed at the earliest opportunity. To address this issue, Security Center provides the vulnerability scoring system that evaluates vulnerabilities and prioritizes remediation for the vulnerabilities. This way, you can determine the priorities to fix vulnerabilities based on the score of urgency to fix a vulnerability. This topic describes the vulnerability scoring system.

Background information

The Common Vulnerability Scoring System (CVSS) can evaluate the scopes and impacts of vulnerabilities. The CVSS can also evaluate the possibility of exploiting a vulnerability and inform you about the consequences of the vulnerability. However, in actual vulnerability prevention scenarios, the CVSS cannot accurately determine whether a vulnerability is at risk of being exploited. Therefore, the CVSS cannot prioritize vulnerabilities.

Published statistics show that approximately 60% of all Common Vulnerabilities and Exposures (CVEs) are rated as high or critical by the CVSS. However, only less than 3% of the CVEs that are rated as high or critical are most likely to be exploited. For example, if the description of a vulnerability includes keywords such as Adobe or arbitrary code execution, the CVSS gives a high score (usually from 8 to 10) to the vulnerability. However, in most cases, this type of vulnerability has the lowest possibility of being exploited.

Alibaba Cloud analyzes the severity levels of vulnerabilities that are detected in actual attack and defense scenarios, and then develops a vulnerability scoring system based on the principles of CVSS.

Alibaba Cloud vulnerability scoring system

The Alibaba Cloud vulnerability scoring system determines the score of urgency to fix a vulnerability based on the severity level of the vulnerability in the actual cloud-based attack and defense scenarios, the exploitability of the vulnerability in the threat detection model, and the status of exploits that are disclosed on the Internet. The severity level can be low, medium, high, or critical, and the severity level is converted from the score that the CVSS gives to the vulnerability. The threat detection model is provided by Security Center. This way, the system helps enterprises remediate vulnerabilities that are at high risk of being exploited and ensures the effectiveness of vulnerability remediation.
Note The severity level of a vulnerability is based on the following factors:
  • Technology.
  • Exploitability, which can be a proof of concept (PoC), an exploit, a weaponized worm, or a weaponized virus.
  • Threat. This factor indicates whether the vulnerability can be exploited to obtain server permissions.
  • Number of IP addresses that are affected after the vulnerability is exploited. This factor indicates how much possible the vulnerability is exploited by attackers.
Vulnerability score

Formula for the score of urgency to fix a vulnerability

The score of urgency to fix a vulnerability dynamically changes. After a vulnerability is disclosed, the Alibaba Cloud vulnerability scoring system gives a score to the vulnerability based on the impacts that may be caused by the vulnerability. The score is called the Alibaba Cloud vulnerability score. When operating systems are updated, some vulnerabilities are fixed. Therefore, fewer vulnerabilities are detected on these systems, and the threat of existing vulnerabilities on the systems is reduced. This lowers the score of urgency to fix this type of vulnerability. In addition, the score of urgency to fix a vulnerability is affected by the deployment environment and the importance of the asset.

Alibaba Cloud provides the following formula to calculate the score of urgency to fix a vulnerability:

Score of urgency to fix a vulnerability = Alibaba Cloud vulnerability score × Time score × Environment score × Asset importance score

The following table describes the elements in the formula.
Element Description Remarks
Alibaba Cloud vulnerability score The score is generated based on the Alibaba Cloud vulnerability scoring system. The score is used to evaluate the severity level of a vulnerability.
Time score A dynamic time curve is used. The curve is generated based on factors such as the postponement in the deployment of vulnerability mitigation and the popularization of vulnerability exploit methods. Valid values: 0 to 1. Within three days after a vulnerability is exposed, the possibility that the vulnerability is exploited significantly increases. During this period, the time score increases from 0 to a temporary peak value, which is less than 1. After this period, the time score significantly decreases. Vulnerabilities become easier to be exploited over time due to increased exploitability. The time score increases and approaches 1 within 100 days.
Environment score The score indicates the environmental condition of your server. Security Center calculates the environment score based on factors such as the conditions of exploiting a vulnerability and the status of your server. The environment score is an important element in the preceding formula.

The following list describes the factors that determine the environment score:

  • Your server is connected to the Internet:
    • If a vulnerability can be remotely exploited, the environment score is 1.5.
    • If a vulnerability can be exploited, the environment score is 1.2.
    • If a vulnerability can be locally exploited, the environment score is 1.
    • If a vulnerability can be exploited only in a complex cloud environment, Security Center adjusts the environment score based on the actual conditions of your server.
  • Your server is connected to an internal network instead of the Internet:
    • If a vulnerability can be remotely exploited, Security Center adjusts the environment score based on the actual conditions of your server.
    • If a vulnerability can be exploited, the environment score is 1.2.
    • If a vulnerability can be locally exploited, the environment score is 1.
    • If a vulnerability can be exploited only in a complex cloud environment, Security Center adjusts the environment score based on the actual conditions of your server.
Asset importance score If you have a large number of servers, the system calculates asset importance scores for different servers based on their importance in different scenarios. The asset importance score is an important element in the preceding formula. The default value is 1. On the Assets page, you can attach one of the following tags to your assets: Important Assets, General Assets, and Test Assets. The asset importance score varies based on the following types of assets:
  • Important Assets: The asset importance score is 1.5.
  • General Assets: The asset importance score is 1.
  • Test Assets: The asset importance score is 0.5.

Priorities to fix vulnerabilities

You can fix vulnerabilities based on priorities, which are determined by the score of urgency to fix a vulnerability.

The following table describes the mappings between the score of urgency to fix a vulnerability and each priority.
Priority to fix a vulnerability Description Score of urgency to fix a priority Suggestion on fixing
High This priority is assigned to a vulnerability that can be easily exploited by an unauthenticated remote attacker. The vulnerability can be exploited to compromise systems over arbitrary code execution without user interactions. In most cases, this type of vulnerability is exploited by worms or ransomware. Greater than 13.5 We recommend that you fix this type of vulnerability at the earliest opportunity.
Medium This priority is assigned to a vulnerability that may adversely affect the confidentiality, integrity, or availability of resources. In most cases, this type of vulnerability cannot be exploited. However, this type of vulnerability is given a high score by the CVSS when they are disclosed on the Internet or at an official website. We recommend that you attach importance to this type of vulnerability. 7.1 to 13.5 We recommend that you fix this type of vulnerability based on your business requirements.
Low This priority is assigned to a vulnerability that has the lowest possibility of being exploited or does not pose risks after it is exploited. In most cases, this type of vulnerability is a bug in the source code of a program or a vulnerability that affects compliance and service performance. Less than 7 We recommend that you ignore this type of vulnerability.
Note
  • If the environment score of a vulnerability cannot be calculated due to reasons such as network jitters, the priority to fix the vulnerability is Low.
  • Urgent and Web-CMS vulnerabilities are assigned the High priority, which is confirmed by Alibaba Cloud security engineers. We recommend that you fix urgent and Web-CMS vulnerabilities at the earliest opportunity.

References

How often does Security Center detect vulnerabilities?

What are the differences between baselines and vulnerabilities?

What do I do if I cannot enable the vulnerability detection feature for a server on the Assets page?