From the course: Vulnerability Management: Assessing the Risks with CVSS v3.1

Unlock the full course today

Join today to access over 24,700 courses taught by industry experts.

Security scope in CVSS

Security scope in CVSS

From the course: Vulnerability Management: Assessing the Risks with CVSS v3.1

Start my 1-month free trial Buy for my team

Security scope in CVSS

“

- [Instructor] The concept of scope in CVSS addresses whether a vulnerability in one component impacts other resources beyond its security scope. It's represented by S in the vector string. Well, what is security scope then? Think about a house with several rooms. Likely, they're separated by walls or other defining architectural features. Each room is a distinct security scope. Typically, the activities and features of one room only affect that particular room. Typically, computing system components don't cross outside of their security scope boundaries. In essence, they stay in their own rooms. So, if the TV is on in the living room, you're probably not going to hear it in the bedroom. Exploiting a vulnerability that only affects the vulnerable component is reflected as unchanged or U. Unchanged scope has less impact on the overall risk calculation. If exploiting a vulnerability impacts other system components, then the…

Contents