Amaqembu ezokuphepha kwe-inthanethi abhekana nezinkulungwane zezimo ezibucayi inyanga ngayinye, futhi ukubeka phambili ukuthi yiziphi okufanele zilungiswe kuqala kungaba nzima kakhulu; yilapho-ke Isikolo se-CVSS idlala indima ebalulekile. I-Common Vulnerability Scoring System (CVSS) standardichaza indlela izingozi ezilinganiswa ngayo, okwenza Ukuthola amaphuzu e-CVSS ngokuvumelana kumaphrojekthi. Ngaphezu kwalokho, ngokusebenzisa Isibali se-CVSS noma Isibali samaphuzu se-CVSS, amaqembu okuphepha angahumusha ngokushesha idatha eyinkimbinkimbi yobuthakathaka ibe yimiphumela ecacile, efana nale eqhuba ukulungiswa okuhlakaniphile nokusheshayo.
Iyini i-CVSS Score nokuthi Kungani Kubalulekile?
The Isikolo se-CVSS eyaziwa emhlabeni wonke standard akhiwa I-FIRST.org ukukala ubukhulu bobuthakathaka bokuphepha.
Amaphuzu asukela ku- 0 ukuze 10, lapho izinombolo eziphakeme zibonisa amaphutha abucayi kakhulu:
| Isikolo se-CVSS | Ubunzima |
|---|---|
| 0.0 | None |
| 0.1-3.9 | ongaphakeme |
| 4.0-6.9 | Medium |
| 7.0-8.9 | High |
| 9.0-10.0 | Okubalulekile |
Kumaqembu e-DevSecOps, lezi zinombolo zisiza ekubekeni phambili ukulungiswa. Ubuthakathaka obune-CVSS score engu-9.8, isibonelo, bungadinga ukunakwa okusheshayo, kanti umuntu onesilinganiso esingu-3.5 angalinda umjikelezo olandelayo wokulungisa.
Nakuba i-CVSS ilinganisela umonakalo ongase ubangelwe yiphutha, ayibonisi ukuthi abahlaseli bayalisebenzisa yini ezindaweni zangempela. Ukuqonda lowo mehluko kubalulekile ekubekeni phambili ingozi yangempela.
Indlela Ukulinganisa kwe-CVSS Okusebenza Ngayo
Empeleni, uhlaka lokulinganisa lwe-CVSS lusebenzisa amaqembu amathathu e-metric ukuhlola izici ezahlukene zobuthakathaka. Ngakho-ke, iqembu ngalinye lichaza indlela inkinga eziphatha ngayo, kusukela ekusebenziseni kwayo kuya emthonjeni wayo ongaba khona ezinhlelweni kanye nedatha. Ngaphezu kwalokho, isibali samaphuzu se-CVSS esithembekile senza le nqubo iphindaphindeke futhi icace. Ngenxa yalokho, ochwepheshe bezokuphepha bangakhuluma ngobucayi bengozi ngokucacile futhi ngenxa yalokho balondoloze ukubekwa phambili okuqhubekayo kuwo wonke amaqembu.
Amamethrikhi Ayisisekelo:
Lokhu kuchaza izimfanelo zangaphakathi zobuthakathaka ezihlala zinjalo phakathi nesikhathi nendawo.
Izibonelo zifaka:- I-Attack Vector (AV): Ingabe ukuhlaselwa kungenziwa kude noma endaweni kuphela?
- Ubunzima Bokuhlasela (i-AC): Kulula kangakanani ukuxhaphaza?
- Amalungelo Adingekayo (PR): Ingabe umhlaseli udinga ukufinyelela kwangaphambilini?
- Ukusebenzisana Komsebenzisi (i-UI): Ingabe kudinga umsebenzisi ukuthi achofoze noma avule okuthile?
- Umthelela (i-CIA): Indlela okuthinta ngayo ubumfihlo, ubuqotho, kanye nokutholakala.
Izilinganiso Zesikhashana:
Lokhu kulungisa amaphuzu ngokusekelwe ezimweni zangempela ezifana nalezi:- Ukuvuthwa Kwekhodi Yokusebenzisa Kahle: Ingabe ikhodi yokuxhaphaza umphakathi iyatholakala?
- Izinga Lokulungisa: Ingabe ukulungiswa noma i-patch ikhishwe okwamanje?
- Bika Ukuqiniseka: Uthembeke kangakanani umbiko wobuthakathaka?
I-Environmental Metrics:
Lokhu kulungisa amaphuzu ngokwesimiso esithile senhlangano yakho, isibonelo, kungakhathaliseki ukuthi uhlelo olusengozini luphatha idatha ebucayi noma lusekela izivikelo zenethiwekhi eziqinile.
Into ngayinye inegalelo emaphuzu okugcina nge- standardifomula ehlanganisiwe, okwenza i-CVSS ibe yinkomba ehambisanayo yokuqhathanisa ubuthakathaka kuyo yonke imikhiqizo kanye nezinhlelo zemvelo.
Ukusebenzisa i-CVSS Calculator (Isinyathelo ngesinyathelo)
Awudingi ukuqopha amafomula ngesandla, ungasebenzisa ama-calculator e-cvss score aku-inthanethi njenge- Isibali sokuqala se-CVSS v4.0 noma Isibali se-NVD CVSSLawa mathuluzi enza kube lula ukuthola amaphuzu e-CVSS futhi aqinisekise ukuthi isibali sakho se-CVSS sikhipha imiphumela efanayo, efanayo ezindaweni ezahlukene.
Nansi indlela elula yokuhamba:
- Khetha inguqulo ye-CVSS: Izeluleko eziningi namuhla zisebenzisa i-CVSS v3.1 noma i-v4.0.
- Gcwalisa izilinganiso eziyisisekelo: Khetha izinketho ze-Attack Vector, i-Complexity, i-Amalungelo, kanye ne-Impact.
- Engeza idatha yesikhashana: Faka ukuthi ngabe kukhona yini ama-exploits noma ama-patches atholakalayo.
- Lungisa izici zemvelo: Bonisa ukuzwela noma ukuvezwa kwengqalasizinda yakho.
- Bala: Ithuluzi libuyisela ngokushesha amaphuzu aphakathi kuka-0.0 no-10.0.
Isibonelo: Ukuqhathanisa Amaphuzu Amabili e-CVSS (9.8 vs 5.6)
Ukubona ukuthi kanjani Isibali samaphuzu se-CVSS isebenza empilweni yangempela, ake siqhathanise ubuthakathaka obubili sisebenzisa I-CVSS v3.1 amamethrikhi.
1. Ubungozi Obubucayi: Ukwenziwa Kwekhodi Ekude (i-CVSS 9.8)
| I-Metric | Value | incazelo |
|---|---|---|
| IVector yokuhlasela | Network | Kungasetshenziswa kude |
| Ubunzima Bokuhlasela | ongaphakeme | Akukho mibandela ekhethekile edingekayo |
| Amalungelo Ayadingeka | None | Umhlaseli akadingi i-akhawunti |
| Ukuxhumana Komsebenzisi | None | Ukuxhashazwa okuzenzakalelayo ngokugcwele |
| Umthelela Wokugcinwa Kwemfihlo | High | Idatha ebucayi iveziwe |
| Umthelela Wobuqotho | High | Idatha ingashintshwa |
| Umthelela Wokutholakala | High | Ukuphazamiseka kwesevisi kungenzeka |
Lesi sibonelo sibonisa indlela isibali se-CVSS esiguqula ngayo izibalo zokulinganisa zibe imiphumela yokulinganisa, okuqinisa inani lokuthola amaphuzu anembile e-CVSS ngesikhathi sokuhlolwa kokuphepha.
Isilinganiso se-CVSS esibaliwe: 5.6 (okulingene)
Ezimweni eziningi, amaqembu okuphepha aphatha amaphutha okwanda kwamalungelo endawo ngesikhathi sokubuyekezwa okuhleliwe ngoba athinta kakhulu izinhlelo ezabiwe futhi awadingi ukulungiswa okuphuthumayo.
Ukudla okudlela endlini:
Nakuba womabili amaphutha kuyi-CVEs evumelekile, Isikolo se-CVSS ukuhlukanisa ngokusobala ukuphuthuma kwabo.
Kodwa khumbula, 9.8 I-CVSS nge ukuxhashazwa okuphansi (i-EPSS 0.02) kungase kungabi yingozi kangako ekusebenzeni kune- 5.6 I-CVSS lokho kuba baxhashazwa ngenkuthalo (EPSS 0.85).
Yingakho kuhlanganiswa i-CVSS ne- I-EPSS kanye nokufinyeleleka kalula kuqinisekisa ukuthi ulungisa okubaluleke ngempela.
I-CVSS Score Calculator Ekusebenziseni
A Isibali se-CVSS kwenza amaphuzu obungozi aphindaphindwe futhi acace. Kusiza ukudlulisa ubucayi bezinkinga kubabambiqhaza abangebona ochwepheshe futhi kugcinwe ukubekwa phambili okuqhubekayo kuwo wonke amaqembu.
Noma kunjalo, amaphuzu angaguquki angadukisa uma ethathwa ngenani elibonakalayo. Isibonelo:
- Ubuthakathaka obune- Isilinganiso se-CVSS sika-9.8 kungenzeka ube akukho ukuxhashazwa okusebenzayo endle.
- Esinye esine- Isilinganiso se-CVSS sika-6.2 kungaba okuqondiswe ngenkuthalo ngabahlaseli.
Yingakho ukuthembela kuphela ku-calculator kungadala izindawo ezingabonakali. Isilinganiso siyisisekelo, hhayi isibonakaliso sengozi yesikhathi sangempela.
I-CVSS vs. EPSS Kungani Izikolo Eziqinile Zinganele
Ngenkathi I-CVSS izinyathelo ubukhali obungaba khona, I-EPSS (Uhlelo Lokubikezela Ukuxhashazwa) izinyathelo amathuba omhlaba wangempela.
I-EPSS isebenzisa ukufunda komshini kanye ne-threat telemetry ukubikezela amathuba okuthi ubuthakathaka buzosetshenziswa zingakapheli izinsuku ezingu-30.
Uma zihlanganisiwe, zinikeza isithombe esicacile kakhulu:
| Isikolo se-CVSS | Isikolo se-EPSS | Action |
|---|---|---|
| Phezulu (9.8) | Phansi (0.03) | Ukuxhashazwa okuphansi → I-Monitor |
| Phakathi (6.5) | Phezulu (0.85) | Ukusebenziseka okuphezulu → Lungisa ngokushesha |
| Okubalulekile (10.0) | Phezulu (0.9) | Thatha isinyathelo manje — kokubili esinzima nesixhashazwayo |
Yile ndlela kanye amapulatifomu esimanje athanda ngayo I-Xygeni ukuthuthukisa ukuphathwa kobuthakathaka, ngokuhlanganisa Ubukhali be-CVSS, Ukuxhashazwa kwe-EPSS, Futhi ukuhlaziywa kokufinyeleleka ukugxila ezingozini ezikhona kokubili okunzima nokuxhashazwa endaweni yakho.
Ngale Kwezinombolo: Ukubeka Ingozi Engcono Kakhulu
The Uhlelo lokufaka amagoli lwe-CVSS kusalokhu kuyitshe lesisekelo sokuphepha kwe-inthanethi; Nokho, kwakungakaze kuhloswe ukusebenza wedwa. Empeleni, Ukuvuthwa kwangempela kokuphepha kuvela ekuqondeni umongo ogcwele, ukwazi ukuthi yiziphi izithiyo ezingafinyeleleka, ezingaxhashazwa, futhi ezibaluleke kakhulu ebhizinisini.
I-Xygeni iqhubekela phambili ngalokhu ngokuzenzakalelayo inqubo:
- Ukungenisa idatha ye-CVSS kusuka kumathuluzi noma izeluleko zakho.
- Ukuyicebisa nge Ukuxhashazwa kwe-EPSS, ukufinyeleleka kwesikhathi sokusebenza, Futhi ukubaluleka kwempahla.
- Ukubonisa konke ku-united dashboard ukugqamisa lokho okudinga ukulungiswa ngempela.
Ngenxa yalokho, le ndlela eqhutshwa umongo iguqula ukuphathwa kobuthakathaka kusuka kumdlalo wezinombolo olula kube inqubo ehlakaniphile neguquguqukayo yokuhlakanipha kwezingozi.
Imicabango Final
Ekuphetheni, i-CVSS isiza amaqembu aqonde ukuthi ubuthakathaka bubucayi kangakanani, kuyilapho i-EPSS kanye nokufinyeleleka kukhombisa ukuthi yiziphi izinkinga ezibaluleke ngempela. Ndawonye, kusiza amaqembu okuphepha ukuthi enze ngokuzethemba futhi alungise izinkinga ezifanele kuqala. Ngenxa yalokho, ukuphathwa kobuthakathaka kuba ngokushesha, kube lula, futhi kuphumelele kakhudlwana.
