Amaqembu ezokuphepha kwe-inthanethi abhekana nobuthakathaka obuningi nsuku zonke. Ukuthola ukuthi yiziphi izinsongo ezidinga ukunakwa kuqala kubalulekile. Yilapho i-Common Vulnerability Scoring System (CVSS) ingena khona. I-CVSS iwuhlaka lwamaphuzu obungozi, inika inani lezinombolo kobuthakathaka, isiza amaqembu ukuthi abeke phambili izingozi ngempumelelo. Ngokusebenzisa amathuluzi anjenge-CVSS calculator nokuhlola ukuthi yiluphi ulwazi olunikezwa yi-CVSS, amaqembu ezokuphepha angenza ubuhlakani obusheshayo nobuhlakaniphile.cisama-ion ukuze agxile ezinsongweni ezibucayi kakhulu.
Konjiniyela be-DevSecOps kanye CISOs, i-CVSS yenza kube lula ukuhlola ubungozi. Isiza ukugxila ebuthakathakeni obubaluleke kakhulu. Nge-CVSS, amaqembu angahlala phambili kunezinsongo futhi aqinise ukuphepha.
Ukuqonda I-CVSS amaphuzu obungozi kanye nama-Metrics awo
Uhlelo Lokulinganisa Amaphuzu Oluvamile Lokuhlushwa (i-CVSS, uhlaka lwamaphuzu obungozi) luhlinzeka ngesilinganiso esaziwa emhlabeni jikelele standard ukuhlola ubuthakathaka besofthiwe. FIRST (I-Forum of Incident Response and Security Teams) ithuthukise i-CVSS ukudala indlela ehlelekile yokulinganisa ubungozi. Njengoba i-FIRST ichaza embhalweni wabo osemthethweni wemininingwane, uhlelo lunikeza izinhlangano standardukuqonda okuthuthukisiwe, okubasiza ukuthi babeke phambili ubuthakathaka ngempumelelo futhi baphendule ngokushesha.
Kusukela ngo-2026, izinhlelo eziningi zokuphepha ezivuthiwe zisuka ku-CVSS v3.1 ziye ku-CVSS v4.0, ukubuyekezwa okushintsha indlela abavikeli abacabanga ngayo ngobunzima kanye nokubaluleka kobungozi. Ushintsho aluyona intuthuko elula, nokho: I-NVD manje ishicilela amaphuzu e-CVSS 4.0 kanye ne-CVSS 3.1 yama-CVE asanda kushicilelwa, kodwa ukuphinda kufakwe amaphuzu kabusha kwedathabheyisi yomlando ephelele akuhleliwe, okusho ukuthi ama-CVE amadala azogcina amaphuzu awo e-CVSS 3.1 njengereferensi eyinhloko unomphela. Uma wakha noma ubuyekeza uhlelo lokuphathwa kobungozi ngo-2026, lindela ukusebenza nazo zombili izinguqulo eceleni esikhathini esizayo esibonakalayo.
Ngaphezu kwalokho, i-CVSS inikeza ukuhlolwa okuphelele kobuthakathaka besofthiwe kusetshenziswa indlela yokulinganisa ehlelekile. Inikeza amaphuzu asukela ku-0 kuya ku-10, lapho amaphuzu aphezulu abonisa ubuthakathaka obubaluleke kakhulu.
Yiluphi ulwazi olunikezwa yi-CVSS lokuphathwa kwezingozi?
The I-Common Vulnerability Scoring System (CVSS) inikeza uhlaka oluhlelekile lokuhlola ubucayi kanye nomthelela wobuthakathaka. Ngokuhlukanisa uhlobo kanye nemiphumela yamaphutha okuphepha, i-CVSS isiza izinhlangano ukuthi zibeke phambili imizamo yokulungisa. Uhlelo lunikeza izilinganiso ezibalulekile kuzo zonke izici ezintathu eziyinhloko:
Amamethrikhi AyisisekeloLokhu kulinganisa izici zangaphakathi zobuthakathaka ezingashintshi ngokuhamba kwesikhathi noma kuzo zonke izindawo. Imininingwane ebalulekile ifaka:
- I-Attack Vector (AV): Indlela ubuthakathaka obungasetshenziswa ngayo (isb., kude noma endaweni).
- Ubunzima Bokuhlasela (i-AC): Ubunzima bokusebenzisa kabi ubuthakathaka.
- Amalungelo Adingekayo (PR): Izinga lokufinyelela elidingekayo ukuze kusetshenziswe ubuthakathaka.
- Impact: Ihlola imiphumela yobumfihlo, ubuqotho, kanye nokutholakala.
Amamethrikhi EsikhashanaLezi zilinganiso zihlola ubuthakathaka njengoba izimo zishintsha, njengokuthi:
- Ukuvuthwa Kwekhodi Yokusebenzisa Kahle: Ukuthi ikhodi yokuxhaphaza iyatholakala yini emphakathini.
- Izinga LokulungisaUkutholakala kwezixazululo noma izindlela zokuxazulula izinkinga.
- Bika Ukuqiniseka: Ukuthembeka kolwazi olubikiwe.
I-Environmental MetricsLokhu kuhlanganisa amaphuzu ngokwesimo esithile senhlangano, okubonisa umthelela webhizinisi oyingqayizivele wobuthakathaka. Izici ezibalulekile zifaka:
- Amamethrikhi Omthelela Aguquliwe: Kulungiswe ngokusekelwe ekubalulekeni kwezinhlelo ezithile.
- Izidingo Zokuphepha: Ukubaluleka kobumfihlo, ubuqotho, kanye nokutholakala endaweni ethile.
Lolu lwazi lunikeza amaqembu ezokuphepha kwe-inthanethi ulwazi olusebenzayo ukuze aqonde ubuthakathaka ngokuningiliziwe, okwenza ukubekwa phambili kube ngcono kakhulucise. Ngokusebenzisa amathuluzi anjenge-CVSS calculator, amaqembu angahumusha lawa ma-metric abe amaphuzu afanele ahambisana nemikhawulo yengozi yenhlangano.
Ukusebenzisa i-CVSS Calculator ukuze ubeke phambili izinsongo
Isibali se-CVSS sisiza ukuguqula amaphuzu e-CVSS abe ukuqonda okusebenzisekayo. Amaqembu ezokuphepha anezela imininingwane ethile yobuthakathaka ukuze abale amaphuzu obungozi afanelana nezimo zawo. Le nqubo iqinisekisa ukuthi babeka phambili ngokusekelwe ezimweni zangempela esikhundleni sezimo ezicatshangelwayo.
Isibonelo, isibali se-CVSS sivumela amaqembu ukuthi ahlole Yiluphi ulwazi olunikezwa yi-CVSS, njengokuxhashazwa, umthelela ongaba khona, kanye nendlela izici ezahlukene zokunciphisa ezithinta ngayo amazinga obungozi. Amathuluzi afana ne-National Vulnerability Database's Isibali se-CVSS v4 ukwenza le nqubo ibe lula, kusiza ochwepheshe bezokuphepha ukuthi bahlaziye ubuthakathaka ngempumelelo enkulu.
Le ndlela eklanyelwe ivumela izinhlangano ukuthi zigxile ebuthakathakeni obubeka izingozi ezinkulu ezinhlelweni ezibalulekile. Njengoba kuchaziwe ngaphambili, amaqembu asebenzisa amathuluzi anjenge-CVSS calculator ukuhlola i-CVSS, uhlaka lwamaphuzu obungozi, ngokuningiliziwe. Ngaphezu kwalokho, ixhumanisa ukuhlolwa kobuchwepheshe nohlelo lweqhingacisama-ion, okuvumela onjiniyela be-DevSecOps kanye CISOs ukuqondisa izinsiza lapho bezidinga khona kakhulu.
Ngaphezu kwalokho, ukuhlanganisa i-CVSS calculator namanye amathuluzi kuthuthukisa ukuxhumana kweqembu. Le ndlela iqinisekisa ukuthi amaqembu acacisa izinqubo futhi aphatha ubuthakathaka ngempumelelo. Ngokusebenzisa ulwazi lwe-CVSS ngempumelelo, izinhlangano ziqinisa futhi zilondoloze isimo sokuphepha esithembeke kakhudlwana.
Ufuna ukufunda okwengeziwe mayelana nokuhlala uphambi kwezinsongo ngesikhathi sangempela?
Landa iphepha lethu elimhlophe, elithi 'Isexwayiso Sasekuqaleni: Ukutholwa Kwengozi Yesikhathi Sangempela Nokubekwa Eqhulwini,' bese uthola ukuthi ungayivikela kanjani i-software supply chain yakho.
Izinzuzo Eziyinhloko ze-CVSS isilinganiso sengozi
I-CVSS, uhlaka lwamaphuzu obungozi, alugcini nje ngokunikeza izinombolo kubuthakathaka. Inikeza ukuqonda okunenjongo okusiza amaqembu e-DevSecOps kanye CISOs yenza kangcono decisngokuhlola ukuthi yiluphi ulwazi olunikezwa yi-CVSS bese ulusebenzisa ukuze uthole amasu okuphepha ahlakaniphile.
Ihlinzeka ngokuhlolwa kwengozi okuqhubekayo nge-CVSS i-Risk Score
Okokuqala, i-CVSS isebenzisa i- standardindlela yokufaka amagoli ethuthukisiwe, okwenza kube lula ngamaqembu ukuhlola ubuthakathaka njalo. Le ndlela efanayo inciphisa ukudideka futhi isiza wonke umuntu eqenjini ukuthi asebenze ngokuqonda okufanayo kwezingozi. Ngenxa yalokho, izinhlangano zingavumelanisa imizamo yazo futhi zigxile ezindabeni ezibaluleke kakhulu ngaphandle kokuchitha isikhathi.
Ivumela i-De engconocisUkwenza i-ion
Ngaphezu kwalokho, njengoba sishilo ngaphambili, i-CVSS inikeza ukuqonda okuningiliziwe ngokuhlukanisa ubuthakathaka kube yizilinganiso eziyisisekelo, zesikhathi, kanye nezendawo ezungezile. Lokhu kuqonda kudlula nje ukuhlonza ubukhulu besongo. Kuphinde kubonise ukuthi kungenzeka kangakanani ukuthi ubuthakathaka buzosetshenziswa kabi. Ngalolu lwazi, amaqembu angenza i-de de esheshayocisbagxile ezintweni zabo ekubhekaneni nezingozi ezicindezela kakhulu.
Ithuthukisa Ukuxhumana Kuwo Wonke Amaqembu
Ngaphezu kwalokho, uhlelo lokuthola amaphuzu lwe-CVSS lwenza kube lula ukuchaza ubuthakathaka. Amaqembu ezokuphepha angasebenzisa izindlela ezilula zokusiza ababambiqhaza abangebona ochwepheshe, njengabaphathi noma abaphathi, baqonde izingozi. Lokhu kuqondana okwabiwe kuholela ekubambisaneni okungcono, ngokusheshacisukwenziwa kwe-ion, kanye nezimpendulo ezisebenza kahle kakhulu ezinsongweni.
Isebenza Ngokukhululekile Ngamathuluzi Athuthukisiwe
Enye inzuzo ye-CVSS ukuthi ihlangana kahle kangakanani namanye amathuluzi okuphepha kwe-cyber. Isibonelo, amapulatifomu afana ne-Xygeni athuthukisa i-CVSS ngokungeza ukuhlaziywa kokusetshenziswa kwesikhathi sangempela kanye nomongo wesikhathi sokusebenza. Lokhu kuhlanganiswa kusiza ukuthuthukisa ukubekwa phambili, okwenza kube lula nakakhulu ngamaqembu ukugxila ebuthakathakeni obubaluleke kakhulu.
Ihambisana Nemboni Standards
Ekugcineni, i-CVSS ihambisana ne-global standardfuthi ithenjwa yizinhlangano emhlabeni wonke. Lokhu kwamukelwa kabanzi kwenza kube lula ngezinkampani ukuthobela imikhuba emihle embonini kanye nezimfuneko zomthetho. Ngenxa yokuthi i-CVSS isetshenziswa kabanzi, amaqembu okuphepha angayethemba njengethuluzi elithembekile lokuphatha nokubeka phambili ubuthakathaka.
Ukulinganiselwa kwe- I-CVSS isilinganiso sengozi
Nakuba i-CVSS iyithuluzi eliwusizo lokuhlola ubuthakathaka, inemingcele ebalulekile okudingeka amaqembu okuphepha ayixazulule ukuze athuthukise ukusetshenziswa kwayo.
Ukulinganisa Okungaguquki Kunemikhawulo
Okokuqala, i-CVSS ithembele ekutholeni amaphuzu aqinile, okusho ukuthi amaphuzu obuthakathaka awashintshi ngisho noma kuvela izinsongo ezintsha. Lokhu kungabangela amaqembu ukuthi agxile kakhulu ezindabeni ezinobungozi obuphansi noma anganaki izinsongo ezisebenzayo, okuholela ekuchithekeni kwesikhathi nomzamo.
Azikho Izibuyekezo Zezinsongo Ezishintshayo
Okwesibili, i-CVSS ayizivumelanisi nezinsongo ezishintsha ngokushesha. Isibonelo, ubuthakathaka bungaba yingozi kakhulu uma abaduni bededela ukuxhashazwa komphakathi noma uma uhlelo olubalulekile ludalulwa. Ngaphandle kwezibuyekezo zesikhathi sangempela, amaqembu angaphuthelwa izinsongo eziphuthumayo.
Idatha Yokusetshenziswa Kabi Engekho
Ngaphezu kwalokho, i-CVSS ilinganisa ukuthi ubuthakathaka bukhulu kangakanani kodwa ayibonisi ukuthi kungenzeka kangakanani ukuthi busetshenziswe. Amathuluzi afana ne-EPSS angasiza ngokubikezela amathuba okuxhashazwa. Isibonelo, amaphuzu aphezulu e-CVSS angase angadingi isinyathelo esisheshayo uma ukuxhashazwa kuphansi, kodwa amaphuzu aphakathi nendawo anokuxhashazwa okuphezulu angadinga ukunakwa ngokushesha.
Ukwenza Ngokwezifiso Imvelo Okulinganiselwe
Okokugcina, yize i-CVSS ivumela ukulungiswa okuthile ngokusekelwe ekusethweni kwenhlangano, lokhu kulungiswa kuvame ukweqiwa noma kusetshenziswe kabi. Lokhu kungaholela kumaphuzu angabonisi ngokugcwele izingozi, njengalawo asezinhlelweni ezibhekene nomphakathi ezivezwe kakhulu kunamathuluzi angaphakathi.
Ukwehla Kwentengo Okukhulu Kuyinkinga Ekhulayo
Lo mkhawulo awuyona into ecatshangelwayo. Ngo-2025, Ama-8.3% azo zonke i-CVE athole amaphuzu abalulekile kanti u-31.1% uthole amaphuzu aphezulu. Lapho cishe u-40% wazo zonke izinkinga ezishicilelwe ziphethe ilebula ethi “Okuphezulu” noma “Okubucayi”, lawo mabhendi ayayeka ukuhlukanisa ngokunenjongo ingozi yangempela engozini evamile, yingakho i-CVSS yodwa ingasakwazi ukuqhuba ukubekwa phambili ngokwayo.
Ngokufaka amathuluzi afana EPSS kanye nokuqapha ngesikhathi sangempela, amaqembu angabhekana nalezi zikhala futhi agxile kangcono ebuthakathakeni obubaluleke kakhulu.
Ukunqoba Imingcele Ngezindlela Ezihambisanayo
Ukuze kuxazululwe le mikhawulo, izinhlangano kufanele zihlanganise i-CVSS namanye amathuluzi nezilinganiso ezingeza umongo oguqukayo kanye nokuqonda kokuxhashazwa. Isibonelo:
- Ukuhlanganiswa kwe-EPSS: Thuthukisa i-CVSS nge-EPSS ukuze kubhekwe amathuba okuxhashazwa, kuqinisekiswe ukuthi kuqala ubungozi obuletha usongo lwangempela, olusheshayo.
- Ukuhlaziywa KokufinyelelekaSebenzisa amathuluzi ukuze unqume ukuthi ubuthakathaka bungafinyeleleka yini endaweni yakho ethile, unciphise ukugxila ezingozini ezingafinyeleleki.
- Umongo Wesikhathi SokusebenzaSebenzisa ukuqapha kwesikhathi sangempela ukuze uhlole ukuthi ubuthakathaka busetshenziswa kabi noma buthinta izinhlelo ezibukhoma.
- Ukuhlanganiswa kwe-KEV: Ubuthakathaka obuhambisana nokubhekisela okuphambene CISIkhathalogi ye-A's Known Exploited Vulnerabilitys. Ubuthakathaka obungu-884 bungezwe ku-KEV ngo-2025, kanti u-28.96% wabo base besetshenziswa kakade ngosuku abadalulwa ngalo esidlangalaleni noma ngaphambi kosuku abadalulwa ngalo esidlangalaleni. Ngokungafani namathuba okubikezela e-EPSS, i-KEV iqinisekisa ukuthi ukuxhashazwa sekubonwe, okwenza kube ngesinye sezibonakaliso eziqine kakhulu ezingezona ezemfundiso ezitholakalayo zokubekwa phambili.
Ngokubhekana nale mikhawulo nokuhlanganisa i-CVSS namathuluzi engeziwe, amaqembu okuphepha angenza ulwazi oluthe xaxa mayelanacisama-ion, ukuqinisekisa ukuthi imizamo yabo igxile ebuthakathakeni obubaluleke kakhulu.
I-CVSS kanye noMthetho Wokumelana Ne-Cyber we-EU (i-CRA)
Ukuthola amaphuzu kwe-CVSS cishe kuzobaluleka ngaphezu kokubeka phambili kwangaphakathi. Umthetho Wokumelana Ne-Cyber we-EU (Umthethonqubo (i-EU) 2024/2847) idinga abakhiqizi ukuthi bahlole ubuthakathaka, babulungise ngesikhathi, futhi babike ukuxhashazwa okusebenzayo uma sebekwazi. Izinsuku ezimbili zibalulekile lapha: isibopho sokubika sobuthakathaka obusetshenziswa ngokusebenzayo (Isigaba 14) sisebenza kusukela mhla ziyi-11 kuMandulo 2026, kuyilapho imisebenzi ebanzi yokuphatha ubuthakathaka, ukulungisa, kanye nokudalula (Isigaba 13 kanye ne-Annex I) isebenza kusukela mhla ziyi-11 kuZibandlela 2027.
Ukucaciswa okukodwa okubalulekile: i-CRA ayigunyazi i-CVSS, i-EPSS, i-KEV, noma yiluphi uhlelo oluthile lokufaka amamaki. Kudinga ukulungiswa ngesikhathi kodwa kushiya isilinganiso sokusebenza kumkhiqizi ngamunye. Lokho kusho ukuthi, i-CVSS noma i-EPSS amaphuzu kuphela awaqali iwashi lokubika lamahora angama-24, kodwa ukunqunywa okuyiqiniso kuphela kokuthi ubuthakathaka busetshenziswa ngenkuthalo ngokumelene nomgomo wangempela kuyakwenza. Empeleni, lokhu kusho ukuthi izinhlangano ezithengisa isofthiwe e-EU zidinga inqubo yokubeka amamaki ebhaliwe, ehambisanayo kanye nokutholwa okungahlukanisa ngokuthembekile "okubucayi ngokwethiyori" "nokuxhashazwa ngenkuthalo", kanye negebe elishiywa yi-CVSS kuphela.
Uma uthengisa isofthiwe noma ihadiwe enezinto zedijithali e-EU, manje sekuyisikhathi sokwakha (noma ukuhlola) amaphuzu akho e-CVSS + EPSS + KEV pipeline, ngaphambi kokuba kufike isikhathi sokugcina sikaSepthemba 2026.
Indlela i-Xygeni Ethuthukisa Ngayo Uhlaka Lwe-CVSS Lwe-Risk Score
Nakuba i-CVSS iwuhlaka lwesilinganiso sengozi, iyindawo enhle yokuqala ukuhlola ubuthakathaka, i-Xygeni iyenza ibe ngcono nakakhulu ngokungeza ukuqonda okuhlakaniphile, ukubeka phambili okungcono, kanye nokwenza ngokuzenzakalela. Lawa mathuluzi asiza amaqembu okuphepha ukuthi agxile ezinsongweni ezibaluleke kakhulu ngenkathi enciphisa izexwayiso ezingadingekile ezibangela ukukhathala. Amaqembu angasebenzisa futhi ulwazi olunikezwa yi-CVSS ukuze enze i-de esheshayo nenolwazi oluthe xaxa.cisions.
I-Xygeni ihlanganisa i-CVSS nedatha yangempela, njengokuthi ubuthakathaka bungasetshenziswa kanjani nokuthi kwenzekani ngesikhathi sangempela. Le ndlela yenza kube lula ngamaqembu ukuthi abeke phambili futhi aphendule ngokushesha ezinsongweni zangempela.
- Ukuhlaziywa KokufinyelelekaI-Xygeni ikhomba ukuthi ubuthakathaka bungasetshenziswa yini endaweni yakho. Lokhu kuqinisekisa ukuthi imizamo yokuphepha igxile ezinsongweni ezinomthelela wangempela.
- Ukuhlanganiswa kwe-EPSS ne-CVSSNgokuhlanganisa idatha yokuxhaphaza nokuqonda kwe-CVSS, i-Xygeni inika amandla i-de ehlakaniphilecisama-ion. Isibonelo, njengoba kuchaziwe ku- Ibhulogi Yokuhlukaniswa Kwamaphuzu e-CVE ka-Xygeni, lokhu kuhlanganiswa kuqinisekisa ukubekwa phambili okunembe kakhudlwana.
- Ukuhlaziywa Komthelela Webhizinisi: I-Xygeni ikhomba ubuthakathaka obuthinta izimpahla ezibalulekile ukuze ivumelanise izinto eziza kuqala kwezokuphepha nemigomo yebhizinisi. Ngakho-ke, amaqembu angagxila emizamweni yokulungisa lokho okubaluleke kakhulu enhlanganweni.
- Ulwazi Lokusebenza Kwesikhathi: I-Xygeni ingeza umongo wesikhathi sangempela, njengokuxhashazwa okusebenzayo, okwenza ukubekwa phambili kube lula futhi kube nokwenzeka ngaphambi kwesikhathicise.
- Ukulungisa Okuzenzakalelayo: I-Xygeni izenzekela ngokuzenzakalelayo ukukhubazeka kokulungisa ngokushesha nje lapho ikubona. Le nqubo yehlisa umsebenzi wezandla, isheshisa izimpendulo, futhi ivumela abathuthukisi ukuthi bagxile ekubhaleni ikhodi yabo ngaphandle kokuphazamiseka.
I-Xygeni ihlanganisa i-CVSS namathuluzi afana ne-EPSS futhi isebenzisa ukuzenzakalela ukuze kube lula ukuphathwa kobuthakathaka. Ngenxa yalokho, le ndlela ecacile negxile isiza onjiniyela be-DevSecOps kanye CISOs gxila emisebenzini ebalulekile, unciphise izingozi, futhi uqinise ukuphepha.
Ngaphezu kwalokho, i-Xygeni ithuthukisa ukuxhumana kweqembu ngokunikeza imisebenzi ecacile kanye nokuqonda okusebenzayo. Ngokubambisana, lezi zici zisiza izinhlangano ukuthi zakhe izinhlelo zokuphepha eziqinile futhi zihlale ziphambi kwezinsongo ezintsha.
Njengoba izibopho zokubika ze-EU Cyber Resilience Act zisondela ngoSepthemba 2026, ukuba nenqubo yokubeka phambili ebhalwe phansi, ezenzakalelayo ye-CVSS kanye ne-EPSS akusona nje umkhuba omuhle kakhulu, sekuba isidingo sokuthobela imithetho. Indlela ye-Xygeni yokuhlanganisa i-CVSS ne-EPSS kanye nomongo wokufinyeleleka isiza amaqembu ukwakha uhlobo olunjalo lwenqubo yokuzivikela, yokulungiselela ukuhlolwa ngaphambi kosuku lokugcina.
Lawula Ukuphathwa Kwakho Kokusengozini Namuhla
Ungavumeli ubuthakathaka bukwenze wehlise ijubane noma bubeke izinhlelo zakho engozini. Esikhundleni salokho, sebenzisa amathuluzi athuthukile e-Xygeni ukuze uguqule ngokuphelele indlela ophatha ngayo futhi obeka phambili izinsongo. Ngokuhlanganisa ngaphandle kokuphazamiseka amandla e-CVSS nokuqonda okunamandla njengokuxhashazwa kanye nokufinyeleleka, i-Xygeni ivumela ithimba lakho ukuthi ligxile kulokho okubaluleke kakhulu.
Ukulungele ukuthatha isinyathelo esilandelayo? Hlola izixazululo zokuphathwa kobuthakathaka ze-Xygeni bese ubona ukuthi singakusiza kanjani ukuthi uhlale uphambili ezinsongweni ezishintshayo. Cela idemo namuhla ukuze ngibone ikusasa lokuphepha kwe-inthanethi mathupha.
Imibuzo Evame Ukubuzwa
Uyini umehluko phakathi kwe-CVSS v3.1 kanye ne-CVSS v4.0?
I-CVSS v4.0 yethula amagama amasha ukuze ihlukanise amaphuzu e-Base (CVSS-B), i-Base+Threat (CVSS-BT), i-Base+Environmental (CVSS-BE), kanye ne-Base+Threat+Environmental (CVSS-BTE), ithatha indawo yeqembu le-Temporal metric elidala ngeqembu le-Threat elisebenziseka kalula, futhi ingeza i-Supplemental Metric Group ongayikhetha yomongo wangaphandle njengomthelela wokuphepha kanye nokukwazi ukuzenzakalela. Yenzelwe ukunciphisa ukungaqondakali okwenza ama-Temporal metric e-CVSS v3.1 angasetshenziswa kaningi ekusebenzeni.
Ingabe ngidinga ukuphinda ngithole amaphuzu emuva kobungozi bami obukhona ngaphansi kwe-CVSS v4.0?
Cha. Ukuphinda uthole amaphuzu kusizindalwazi esigcwele se-NVD ngaphansi kwe-CVSS v4.0 akuhleliwe, futhi ama-CVE omlando azogcina amaphuzu awo e-CVSS v3.1 njengereferensi eyinhloko. Amaqembu ezokuphepha kufanele aqale ukusebenzisa amaphuzu e-CVSS v4.0 kuma-CVE asanda kushicilelwa kusukela ekuqaleni, ngaphandle kokuphinda abhekane nokubekwa phambili kwangaphambilini.cisions.
Kungani ama-CVE amaningi kangaka ethola amaphuzu athi “Critical” noma “High”?
Ngo-2025, ama-8.3% ama-CVE athole amaphuzu abalulekile kanti ama-31.1% athole amaphuzu aphezulu, okusho ukuthi cishe ama-40% azo zonke izithiyo ezidaluliwe ziphethe ilebula lobunzima obuphezulu. Lokhu "kukhuphuka okukhulu" kungaphambi kokubacisYingakho i-CVSS iyodwa ingeyona ithuluzi elanele lokubeka izinto phambili, ayihlukanisi iphutha elinzima ngokwemfundiso kodwa elingafinyeleleki kulelo elisetshenziswa kabi ngenkuthalo.
Iyini i-KEV, futhi ihluke kanjani ku-EPSS?
I-KEV (Ubungozi Obuxhashazwayo Obuyaziwayo), obunakekelwa yi CISA, ibala ubuthakathaka obunobufakazi obuqinisekisiwe bokuxhashazwa okusebenzayo endle. I-EPSS, ngokuphambene nalokho, iyimodeli engaba khona elinganisela amathuba okuthi ubuthakathaka buzosetshenziswa ezinsukwini ezingama-30 ezizayo. Ubuthakathaka obungu-884 bangezwa ku-KEV ngo-2025, cishe u-29% usuvele usetshenziswa okusebenzayo ngaphambi kokudalulwa komphakathi. Ukusebenzisa i-KEV ne-EPSS ndawonye kunikeza kokubili isignali yokusongela eqinisekisiwe kanye nesibikezelo sesikhathi esizayo.
Ingabe i-CVSS yanele ngokwayo ukuze ibeke phambili ubungozi?
Cha. Ucwaningo oluqanjiwe lubonisa njalo ukuthi ubuthakathaka obuningi obuthola amaphuzu “aphezulu” noma “abucayi” yi-CVSS abubonakali busetshenziswa kabi. Indlela ye-CVSS kuphela ichitha isikhathi sobunjiniyela engcupheni yemfundiso kuyilapho ubuthakathaka obusetshenziswa kabi bungase bungaxazululwa. Ukuhlanganisa i-CVSS ne-EPSS, i-KEV, kanye nokuhlaziywa kokufinyeleleka kuyindlela yamanje enconywa embonini.
