Amaqela okhuseleko lwe-cyber ajongene nobuthathaka obuninzi imihla ngemihla. Ukufumanisa ukuba zeziphi izoyikiso ezifuna ingqalelo kuqala kubalulekile. Kulapho iCommon Vulnerability Scoring System (CVSS) ingena khona. I-CVSS sisikhokelo samanqaku omngcipheko, inika ixabiso lenani kubuthathaka, inceda amaqela ukuba abeke phambili ubungozi ngokufanelekileyo. Ngokusebenzisa izixhobo ezifana ne-CVSS calculator kunye nokuhlola ukuba loluphi ulwazi olubonelelwa yi-CVSS, amaqela okhuseleko angenza ubuchwephesha obukhawulezayo nobukrelekrele.cisii-ions ukuze zigxile kwezona zisongelo zibalulekileyo.
Kwiinjineli zeDevSecOps kunye CISOs, i-CVSS yenza kube lula ukuvavanya umngcipheko. Inceda ekugxileni kwiindawo ezibuthathaka ezibaluleke kakhulu. Nge-CVSS, amaqela anokuhlala phambili kunezoyikiso kwaye aqinise ukhuseleko.
ukuqonda I-CVSS inqaku lomngcipheko kunye neeMetriki zalo
Inkqubo yokuBala iCommon Vulnerability Scoring System (i-CVSS, isakhelo samanqaku omngcipheko) inika ulwazi olwaziwayo kwihlabathi liphela standard yokuvavanya ubuthathaka besoftware. EKUQALENI (iForam of Incident Response and Security Teams) iphuhlise iCVSS ukuze idale indlela ecwangcisiweyo yokulinganisa umngcipheko. Njengoko i-FIRST ichaza kuxwebhu lwabo olusemthethweni lweenkcukacha, le nkqubo inika imibutho standardukuqonda okuphuculweyo, okubanceda ukuba babeke phambili ubuthathaka ngokufanelekileyo kwaye baphendule ngokukhawuleza.
Ukususela ngo-2026, uninzi lweenkqubo zokhuseleko ezivuthiweyo ziyatshintsha ukusuka kwi-CVSS v3.1 ukuya kwi-CVSS v4.0, uhlaziyo olutshintsha indlela abakhuseli abacinga ngayo ngobunzima bobuthathaka kunye nokubaluleka. Nangona kunjalo, olu tshintsho aluyonto ilula ukuhlaziya: I-NVD ngoku ipapasha amanqaku e-CVSS 4.0 kunye ne-CVSS 3.1 yee-CVE ezisandula ukupapashwa, kodwa ukuphinda ubhale amanqaku kwakhona kwisiseko sedatha esipheleleyo sembali akucetywanga, oko kuthetha ukuba ii-CVE ezindala ziya kugcina amanqaku azo e-CVSS 3.1 njengesalathiso esiphambili ngokungenasiphelo. Ukuba wakha okanye uhlaziya inkqubo yolawulo lobuthathaka ngo-2026, lindela ukusebenza nazo zombini iinguqulelo ecaleni kwelinye kwixesha elizayo elibonakalayo.
Ngaphezu koko, i-CVSS inika uvavanyo olupheleleyo lobuthathaka besoftware kusetyenziswa indlela yokubeka amanqaku ecwangcisiweyo. Inika amanqaku aqala ku-0 ukuya kwi-10, apho amanqaku aphezulu abonisa ubuthathaka obubaluleke ngakumbi.
Loluphi ulwazi olubonelelwa yiCVSS kuLawulo loMngcipheko?
The INkqubo yokuSebenza okuQhelekileyo yokuSebenza (CVSS) Ibonelela ngesakhelo esicwangcisiweyo sokuvavanya ubukhali kunye nempembelelo yobuthathaka. Ngokuhlalutya uhlobo kunye neziphumo zeziphene zokhuseleko, i-CVSS inceda imibutho ukuba ibeke phambili imizamo yokulungisa. Le nkqubo inika iindlela ezibalulekileyo zokulinganisa kuzo zonke iinkalo ezintathu eziphambili:
Iimetriki ezisisiseko: Ezi zilinganisa iimpawu zangaphakathi zobuthathaka ezingatshintshiyo ngokuhamba kwexesha okanye kwiindawo ezingqongileyo. Iinkcukacha eziphambili ziquka:
- IVektha yoHlaselo (i-AV): Indlela obu buthathaka obunokusetyenziswa ngayo (umz., kude okanye ekuhlaleni).
- Ubunzima boHlaselo (i-AC): Ubunzima bokusebenzisa kakubi ubuthathaka.
- Amalungelo afunekayo (PR): Inqanaba lokufikelela elifunekayo ukuze kusetyenziswe ubuthathaka.
- igalelo: Uvavanya iziphumo zobumfihlo, ukuthembeka, kunye nokufumaneka.
IiMetriki zeXeshanaEzi metriki zivavanya ubuthathaka njengoko iimeko zitshintsha, ezinje:
- Ukuvuthwa kweKhowudi yokuSebenzisa: Nokuba ikhowudi yokuxhaphaza ifumaneka esidlangalaleni na.
- Inqanaba lokulungisa: Ukufumaneka kwezilungiso okanye iindlela zokulungisa iingxaki.
- Xela Ukuzithemba: Ukuthembeka kolwazi oluxeliweyo.
Iimetriki zokusiNgqongileyo: Ezi zinto zilungelelanisa amanqaku ngokwemeko ethile yombutho, zibonisa impembelelo ekhethekileyo yoshishino yobuthathaka. Izinto eziphambili ziquka:
- IiMetriki zeMpembelelo eziGuquliweyo: Ilungiswe ngokusekelwe kukubaluleka kweenkqubo ezithile.
- IiMfuno zoKhuseleko: Ukubaluleka kokugcinwa kwemfihlo, ukuthembeka, kunye nokufumaneka kwindawo ethile.
Olu lwazi lubonelela amaqela okhuseleko lwe-intanethi ngolwazi olusebenzayo lokuqonda ubuthathaka ngokweenkcukacha, okwenza ukubekwa phambili kube lula ngakumbicise. Ngokusebenzisa izixhobo ezifana ne-CVSS calculator, amaqela anokuguqulela ezi metrics zibe ngamanqaku alungiselelwe wona ahambelana nemida yomngcipheko wentlangano.
Ukusebenzisa i-CVSS Calculator ukubeka phambili iingongelo
Isibali seCVSS sinceda ukuguqula amanqaku eCVSS abe ziingqiqo ezisebenzisekayo. Amaqela okhuseleko ongeza iinkcukacha ezithile zobuthathaka ukuze abale amanqaku omngcipheko ahambelana neendawo zawo. Le nkqubo iqinisekisa ukuba babeka phambili ngokusekelwe kwiimeko zehlabathi lokwenyani endaweni yeemeko zethiyori.
Umzekelo, isixhobo sokubala seCVSS sivumela amaqela ukuba ahlole loluphi ulwazi olubonelelwa yiCVSS, njengokuxhaphazeka, impembelelo enokubakho, kunye nendlela izinto ezahlukeneyo ezinciphisayo ezichaphazela ngayo amanqanaba omngcipheko. Izixhobo ezifana neNational Vulnerability Database's Isibali seCVSS v4 lula le nkqubo, inceda iingcali zokhuseleko ukuba zihlalutye ubuthathaka ngempumelelo.
Le ndlela ilungiselelweyo ivumela imibutho ukuba igxile kubuthathaka obubeka umngcipheko omkhulu kwiinkqubo ezibalulekileyo. Njengoko kuchaziwe ngaphambili, amaqela asebenzisa izixhobo ezifana ne-CVSS calculator ukuphonononga i-CVSS, isakhelo samanqaku omngcipheko, ngokweenkcukacha ezithe vetshe. Ngaphezu koko, idibanisa uvavanyo lobuchwephesha kunye ne-strategic decisii-ion, ezivumela iinjineli zeDevSecOps kunye CISOs ukuze baqondise izixhobo apho bazifuna khona kakhulu.
Ukongeza, ukudibanisa i-CVSS calculator nezinye izixhobo kuphucula unxibelelwano lweqela. Le ndlela iqinisekisa ukuba amaqela acacisa iinkqubo kwaye alawula ubuthathaka ngokufanelekileyo. Ngokusebenzisa ulwazi lweCVSS ngokufanelekileyo, imibutho iyomeleza kwaye igcina imeko yokhuseleko ethembekileyo.
Ngaba ufuna ukufunda okungakumbi malunga nokuhlala uphambi kwezoyikiso ngexesha langempela?
Khuphela iphepha lethu elimhlophe, elithi 'Isilumkiso Kwangethuba: Ukufunyanwa Kobungozi Ngexesha Langempela Nokubekwa Phambili,' uze ufumane indlela yokukhusela uthotho lwakho lobonelelo lwesoftware.
Iingenelo eziphambili zeCVSS amanqaku omngcipheko
I-CVSS, isakhelo samanqaku omngcipheko, ayipheleli nje ekubekeni amanani kwiindawo ezibuthathaka. Inika ulwazi olunentsingiselo olunceda amaqela e-DevSecOps kunye CISOs yenza ngcono decisngokuhlola ukuba loluphi ulwazi olubonelelwa yiCVSS kunye nokulusebenzisa ukuze kusetyenziswe amaqhinga okhuseleko akrelekrele ngakumbi.
Ibonelela ngoVavanyo loMngcipheko oluQhubekekayo kunye neCVSS iRisk Score
Okokuqala, iCVSS isebenzisa standardindlela yokufumana amanqaku ephuculweyo, okwenza kube lula kumaqela ukuvavanya ubuthathaka rhoqo. Le ndlela ifanayo inciphisa ukudideka kwaye inceda wonke umntu kwiqela ukuba asebenze ngokuqonda okufanayo ngemingcipheko. Ngenxa yoko, imibutho inokulungelelanisa imizamo yayo kwaye igxile kwimiba ebalulekileyo ngaphandle kokuchitha ixesha.
Ivumela iDe engconocisUkwenza ii-ion
Ukongeza, njengoko besitshilo ngaphambili, i-CVSS inika ulwazi oluneenkcukacha ngokwahlulahlula ubuthathaka bube yimilinganiselo yesiseko, yexeshana, kunye neyokusingqongileyo. Olu lwazi ludlula nje ekuchongeni ubukhali besongelo. Lukwabonisa ukuba kunokwenzeka kangakanani ukuba ubuthathaka buya kusetyenziswa. Ngolu lwazi, amaqela angenza ngokukhawuleza ukwenziwa kwezintocisbajolise kwizixhobo zabo ekusombululeni iingozi ezingxamisekileyo.
Ukuphucula unxibelelwano kuwo onke amaQela
Ngaphezu koko, inkqubo yamanqaku e-CVSS yenza kube lula ukuchaza ubuthathaka. Amaqela okhuseleko angasebenzisa iindlela ezilula zokulinganisa ukunceda abachaphazelekayo abangengabo abaqeqeshi, njengabaphathi okanye abaphathi, baqonde iingozi. Oku kuqondana okwabelwana ngako kukhokelela kwintsebenziswano engcono, ngokukhawulezacisukwenziwa kwee-ion, kunye neempendulo ezisebenzayo ngakumbi kwizisongelo.
Isebenza Ngokungashukumiyo Ngezixhobo Eziphambili
Enye inzuzo yeCVSS kukuba idibana kakuhle kangakanani nezinye izixhobo zokhuseleko lwe-cyber. Umzekelo, amaqonga afana neXygeni aphucula iCVSS ngokongeza uhlalutyo lokusetyenziswa ngexesha langempela kunye nomxholo wexesha lokusebenza. Olu dibaniso lunceda ukuphucula ukubekwa phambili, okwenza kube lula nangakumbi kumaqela ukugxila kubuthathaka obubaluleke kakhulu.
Ihambelana noShishino Standards
Okokugqibela, i-CVSS ihambelana ne-global standardkwaye ithembekile yimibutho kwihlabathi liphela. Olu kwamkelwa ngokubanzi kwenza kube lula kwiinkampani ukuthobela iindlela ezilungileyo zoshishino kunye neemfuno zomthetho. Ngenxa yokuba i-CVSS isetyenziswa kakhulu, amaqela okhuseleko anokuyithemba njengesixhobo esithembekileyo sokulawula nokubeka phambili ubuthathaka.
Imida yoku CVSS amanqaku omngcipheko
Nangona i-CVSS isisixhobo esiluncedo ekuvavanyeni ubuthathaka, inemida ebalulekileyo ekufuneka ijongwe ngamaqela okhuseleko ukuphucula ukusetyenziswa kwayo.
Amanqaku Angaguqukiyo Anemida
Okokuqala, i-CVSS ixhomekeke ekufumaneni amanqaku ngendlela engaguqukiyo, oko kuthetha ukuba amanqaku obuthathaka awatshintshi nangona kuvela izoyikiso ezintsha. Oku kunokubangela ukuba amaqela agxile kakhulu kwimiba enobungozi obuphantsi okanye angawahoyi amasoyikiso asebenzayo, nto leyo ekhokelela ekuchitheni ixesha kunye nomgudu.
Akukho Zihlaziyo Zokutshintsha Kwezisongelo
Okwesibini, i-CVSS ayiziqhelanisi nezisongelo ezitshintsha ngokukhawuleza. Umzekelo, ubuthathaka bunokuba yingozi ngakumbi ukuba abaphangi bakhupha i-public exploit okanye ukuba inkqubo ebalulekileyo iyavezwa. Ngaphandle kohlaziyo lwangempela, amaqela anokuphoswa zizisongelo ezingxamisekileyo.
Idatha yokuxhatshazwa engekhoyo
Ukongeza, i-CVSS ilinganisa ukuba ubuthathaka bukhulu kangakanani kodwa ayibonisi ukuba kunokwenzeka kangakanani ukuba busetyenziswe. Izixhobo ezifana ne-EPSS zinokunceda ngokuqikelela amathuba okuxhaphaza. Umzekelo, amanqaku aphezulu e-CVSS asenokungadingi nyathelo likhawulezileyo ukuba ukuxhaphaza kuphantsi, kodwa amanqaku aphakathi anokuxhaphaza okuphezulu anokufuna ingqalelo ekhawulezileyo.
Ukwenziwa ngokwezifiso okulinganiselweyo kokusingqongileyo
Okokugqibela, nangona i-CVSS ivumela uhlengahlengiso oluthile olusekelwe kulungiselelo lombutho, olu hlengahlengiso ludla ngokungalandelwa okanye lusetyenziswe gwenxa. Oku kunokukhokelela kumanqaku angabonisi ngokupheleleyo iingozi, njengalawo akwiinkqubo ezijongene noluntu ezibonakala ngakumbi kunezixhobo zangaphakathi.
Ukunyuka kwamaxabiso okunzima yingxaki ekhulayo
Lo mda awungowokuqikelelwa. Ngo-2025, I-8.3% yazo zonke ii-CVE zifumene amanqaku abalulekileyo kwaye ama-31.1% afumene amanqaku aphezulu. Xa phantse ama-40% azo zonke iziphene ezipapashiweyo ziphethe ilebhile ethi “Phezulu” okanye “Ebalulekileyo”, ezo bhendi ziyeka ukwahlula umngcipheko wokwenyani kumngcipheko oqhelekileyo, yiyo loo nto kanye i-CVSS yodwa ingenakuqhuba ukubekwa phambili ngokwayo.
Ngokongeza izixhobo ezifana EPSS kunye nokubeka esweni ngexesha langempela, amaqela anokujongana nezi zikhewu aze agxile ngcono kwezona zibuthathaka zibalulekileyo.
Ukoyisa Imida Ngeendlela Ezincedisayo
Ukuze kujongwane nale mida, imibutho kufuneka idibanise i-CVSS nezinye izixhobo kunye nemilinganiselo eyongeza umxholo oguqukayo kunye nokuqonda kokusetyenziswa. Umzekelo:
- Udibaniso lwe-EPSS: Phucula i-CVSS nge-EPSS ukuze kuqwalaselwe amathuba okuxhatshazwa, uqinisekise ukuba kuqala kunikwa ubuthathaka obuzisa umngcipheko wokwenyani nokhawulezileyo.
- Uhlalutyo lokufikelelekaSebenzisa izixhobo ukuze ubone ukuba ubuthathaka buyafikeleleka na kwindawo yakho ethile, unciphise ukugxila kwiingozi ezingenakufikeleleka.
- Umxholo wexesha lokusebenzaSebenzisa ukujonga ngexesha langempela ukuvavanya ukuba ubuthathaka busetyenziswa kakubi okanye buchaphazela iinkqubo eziphilayo.
- Udibaniso lwe-KEV: Ubuthathaka obuchasene neereferensi ezahlukeneyo CISIkhathalogu ye-A's Known Exploited Vulnerabilitys. Ii-884 vulnerability zongezwa kwi-KEV ngo-2025, kwaye i-28.96% yazo yayisele isetyenziswa ngaphambi okanye ngaphambi kosuku eyatyhilwa ngalo esidlangalaleni. Ngokungafaniyo namathuba okuqikelela e-EPSS, i-KEV iqinisekisa ukuba ukuxhaphaza kuye kwabonwa, nto leyo eyenza ukuba ibe yenye yezona mpawu zinamandla ezingezizo ezethiyori ezikhoyo zokubekwa phambili.
Ngokujongana nale mida kunye nokudibanisa i-CVSS nezixhobo ezongezelelweyo, amaqela okhuseleko angenza ulwazi oluthe kratya malungacisii-ions, ukuqinisekisa ukuba imizamo yabo igxile kwizinto ezibuthathaka ezibaluleke kakhulu.
I-CVSS kunye noMthetho woBuchule bokuHlala kwi-Intanethi we-EU (i-CRA)
Amanqaku e-CVSS aza kubaluleka ngaphezu kokubeka phambili izinto ngaphakathi. UMthetho woBuchule bokuXhatshazwa kweCyber we-EU (uMgaqo (i-EU) 2024/2847) ifuna abavelisi ukuba bahlole ubuthathaka, babulungise ngexesha, kwaye baxele ngokuxhaphaza okusebenzayo xa sele bekwazi oko. Imihla emibini ibalulekile apha: uxanduva lokunika ingxelo ngobuthathaka obusetyenziswa ngokukhutheleyo (Inqaku 14) lusebenza ukususela nge-11 kaSeptemba 2026, ngelixa imisebenzi ebanzi yokuphatha ubuthathaka, ukulungisa, kunye nokutyhila (Inqaku 13 kunye neSihlomelo I) isebenza ukususela nge-11 kaDisemba 2027.
Ingcaciso enye ebalulekileyo: i-CRA ayigunyazisi i-CVSS, i-EPSS, i-KEV, okanye nayiphi na inkqubo ethile yokunika amanqaku. Ifuna ukulungiswa ngexesha elifanelekileyo kodwa ishiya umlinganiselo wokusebenza kumenzi ngamnye. Oko kuthethiweyo, amanqaku e-CVSS okanye e-EPSS kuphela awaqali iwotshi yokunika ingxelo yeeyure ezingama-24, kuphela kukuqinisekiswa okuyinyani kokuba ubuthathaka busetyenziswa ngokukhutheleyo ngokuchasene nethagethi yokwenyani. Ngokwenyani, oku kuthetha ukuba imibutho ethengisa isoftware kwi-EU ifuna inkqubo yokunika amanqaku ebhaliweyo, ehambelanayo kunye nenkqubo yokufumanisa enokwahlula ngokuthembekileyo "ubunzima ngokwethiyori" "nokuxhatshazwa ngokukhutheleyo", kanye umsantsa oshiyeka uvulekile yi-CVSS yodwa.
Ukuba uthengisa isoftware okanye i-hardware enezinto zedijithali kwi-EU, ngoku lixesha lokwakha (okanye ukuhlola) amanqaku akho e-CVSS + EPSS + KEV pipeline, ngaphambi kokuba kufike umhla wokugqibela kaSeptemba 2026.
Indlela iXygeni ephucula ngayo iCVSS kwiSakhelo samanqaku oMngcipheko
Nangona i-CVSS isisiseko samanqaku omngcipheko, iyindawo entle yokuqala ukuvavanya ubuthathaka, i-Xygeni iyenza ibe ngcono ngakumbi ngokongeza ulwazi olukrelekrele, ukubeka phambili okungcono, kunye nokwenza izinto ngokuzenzekelayo. Ezi zixhobo zinceda amaqela okhuseleko ukuba agxile kwezona zisongelo zibalulekileyo ngelixa enciphisa izilumkiso ezingafunekiyo ezibangela ukudinwa. Amaqela anokusebenzisa ulwazi olubonelelwa yi-CVSS ukwenza ukhuseleko olukhawulezayo nolunolwazi oluthe kratya.cision.
I-Xygeni idibanisa i-CVSS nedatha yehlabathi lokwenyani, njengokuba ubuthathaka bunokusetyenziswa njani kunye noko kwenzekayo ngexesha langempela. Le ndlela yenza kube lula kumaqela ukuba abeke phambili kwaye aphendule ngokukhawuleza kwizisongelo zokwenyani.
- Uhlalutyo lokufikelelekaI-Xygeni ichonga ukuba ubuthathaka bunokusetyenziswa ngokukhutheleyo kwindawo okuyo. Oku kuqinisekisa ukuba imizamo yokhuseleko igxila kwizisongelo ezinempembelelo yokwenyani.
- Ukuhlanganiswa kwe-EPSS kunye ne-CVSSNgokudibanisa idatha yokuxhaphaza kunye ne-CVSS insights, i-Xygeni yenza kube lula ukusebenzisa i-decisii-ion. Umzekelo, njengoko kuchaziwe kwi Ibhlog yoHluko lwamanqaku lwe-CVE kaXygeni, olu manyano luqinisekisa ukubekwa phambili ngokuchanekileyo.
- Uhlalutyo lweMpembelelo yeShishini: I-Xygeni ibonisa ubuthathaka obuchaphazela izinto ezibalulekileyo ukuze ilungelelanise izinto eziza kuqala kukhuseleko neenjongo zoshishino. Ke ngoko, amaqela anokugxila kwimizamo yokulungisa izinto ezibalulekileyo kumbutho.
- Ulwazi lwexesha lokusebenza: I-Xygeni yongeza umxholo wexesha langempela, njengokuxhatshazwa okusebenzayo, okwenza ukubekwa phambili kube lula kwaye kube nokwenzeka ngaphambi kokuba kuqalwecise.
- Ulungiso oluzenzekelayo: I-Xygeni izenzekela ngokuzenzakalelayo iziphene zokulungisa iikhompyutha ngokukhawuleza nje ukuba izibone. Le nkqubo inciphisa umsebenzi owenziwa ngesandla, ikhawulezisa iimpendulo, kwaye ivumela abaphuhlisi ukuba bagxile kwikhowudi yabo ngaphandle kokuphazamiseka.
I-Xygeni idibanisa i-CVSS nezixhobo ezifana ne-EPSS kwaye isebenzisa ukuzenzekela ukwenza lula ulawulo lobuthathaka. Ngenxa yoko, le ndlela icacileyo negxileyo inceda iinjineli zeDevSecOps kunye CISOs gxila kwimisebenzi ebalulekileyo, unciphise iingozi, kwaye uqinise ukhuseleko.
Ngaphezu koko, iXygeni iphucula unxibelelwano lweqela ngokunika imisebenzi ecacileyo kunye nokuqonda okusebenzayo. Zizonke, ezi mpawu zinceda imibutho ukuba yakhe iinkqubo zokhuseleko eziqinileyo kwaye ihlale iphambi kwezoyikiso ezintsha.
Njengoko uMthetho we-EU Cyber Resilience Act usondela ngoSeptemba 2026, ukuba nenkqubo yokubeka phambili ebhalwe phantsi, ezenzekelayo ye-CVSS kunye ne-EPSS ayisiyondlela ilungileyo nje kuphela, kodwa iba yimfuneko yokuthobela imithetho. Indlela ye-Xygeni yokudibanisa i-CVSS kunye ne-EPSS kunye nomxholo wokufikeleleka inceda amaqela ukuba akhe uhlobo olunjalo lwenkqubo yokuzikhusela, elungele uphicotho ngaphambi komhla wokugqibela.
Lawula Ulawulo Lwakho Lokuchaphazeleka Komzimba Namhlanje
Musa ukuvumela ubuthathaka ukuba bukunciphise okanye bubeke iinkqubo zakho emngciphekweni. Endaweni yoko, sebenzisa izixhobo eziphambili zeXygeni ukuguqula ngokupheleleyo indlela olawula ngayo kwaye ubeke phambili izoyikiso. Ngokudibanisa ngaphandle komthungo amandla eCVSS kunye nokuqonda okunamandla okufana nokuxhaphazeka kunye nokufikeleleka, iXygeni ivumela iqela lakho ukuba ligxile kwizinto ezibaluleke kakhulu.
Ngaba ukulungele ukuthatha inyathelo elilandelayo? Hlola izisombululo zolawulo lobuthathaka zeXygeni uze ubone indlela esinokukunceda ngayo uhlale uphambili kwiingozi eziguqukayo. Cela idemo namhlanje ukuze ndibone ikamva lokhuseleko lwe-intanethi ngokwam.
FAQs
Yintoni umahluko phakathi kweCVSS v3.1 kunye neCVSS v4.0?
I-CVSS v4.0 yazisa amagama amatsha ukuze kwahlulwe amanqaku e-Base (CVSS-B), i-Base+Threat (CVSS-BT), i-Base+Environmental (CVSS-BE), kunye ne-Base+Threat+Environmental (CVSS-BTE), ithatha indawo yeqela le-Temporal metric elidala ngeqela le-Threat elinokusebenza ngakumbi, kwaye yongeza i-Supplemental Metric Group ekhethiweyo yomxholo wangaphandle njengempembelelo yokhuseleko kunye nokuziqhelanisa. Yenzelwe ukunciphisa ukungaqondakali okwenza ukuba ii-Temporal metrics ze-CVSS v3.1 zingasetyenziswa rhoqo ekusebenzeni.
Ngaba kufuneka ndiphinde ndibeke amanqaku kwi-backlog yam yobuthathaka phantsi kwe-CVSS v4.0?
Hayi. Ukuphinda ubhale amanqaku kwi-database epheleleyo ye-NVD phantsi kwe-CVSS v4.0 akucetywanga, kwaye ii-CVE zembali ziya kugcina amanqaku azo e-CVSS v3.1 njengesalathiso esiphambili. Amaqela okhuseleko kufuneka aqale ukusebenzisa amanqaku e-CVSS v4.0 kwii-CVE ezisandula ukupapashwa ukuya phambili, ngaphandle kokuphinda athethe ngezinto eziza kuqala ngaphambili.cision.
Kutheni ii-CVE ezininzi kangaka zifumana amanqaku athi “Critical” okanye “High”?
Ngowama-2025, i-8.3% yee-CVE zifumene amanqaku abalulekileyo kwaye i-31.1% ifumene amanqaku aphezulu, oko kuthetha ukuba phantse i-40% yazo zonke iziphene ezityhiliweyo ziphethe uphawu lobunzima obuphezulu. Olu "kunyuswa kobunzima" luphambicisKutheni i-CVSS yodwa ingelona sixhobo sokubeka phambili esaneleyo, ayibonisi isiphene esinzima ngokwethiyori kodwa esingenakufikeleleka kweso sisetyenziswa ngokukhutheleyo.
Yintoni i-KEV, kwaye yahluke njani kwi-EPSS?
I-KEV (i-Known Exploited Vulnerability), egcinwe yi CISA, idwelisa ubuthathaka kunye nobungqina obuqinisekisiweyo bokuxhatshazwa okusebenzayo endle. I-EPSS, ngokuchaseneyo, yimodeli enokwenzeka eqikelela amathuba okuba ubuthathaka buya kusetyenziswa kwiintsuku ezingama-30 ezizayo. Ubuthathaka obungama-884 bongezwe kwi-KEV ngo-2025, phantse ama-29% sele esetyenziswa ngokusebenzayo ngaphambi kokuba kutyhilwe esidlangalaleni. Ukusebenzisa i-KEV kunye ne-EPSS kunye kunika zombini uphawu lomngcipheko oluqinisekisiweyo kunye nolujonge phambili.
Ngaba i-CVSS yanele ngokwayo ekubekeni phambili ubuthathaka?
Hayi. Uphando olusebenzisa ubuchule lubonisa rhoqo ukuba uninzi lweengxaki ezifunyenwe “ziphezulu” okanye “zibalulekile” yiCVSS azibonwa njengezisetyenziswa kakubi. Indlela yeCVSS kuphela ichitha ixesha lobunjineli kumngcipheko wethiyori ngelixa iingxaki ezisetyenziswa ngokwenene zisenokungalungiswa. Ukudibanisa iCVSS neEPSS, KEV, kunye nohlalutyo lokufikeleleka yindlela yangoku ecetyiswayo kushishino.
