Stakeholder-Specific Vulnerability Categorization

SSVC stands for Stakeholder-Specific Vulnerability Categorization which is a methodology to prioritize vulnerability handling based on the individual needs of stakeholders.

SSVC Support

VulDB provides SSVC support for vulnerability entries. All entries contain a SSVC definition and decision recommendation based on the assessment of the VulDB moderation team.

Attribute Definition

The following SSVC attributes are defined:

Decision Definition

We define an extended set of decision that can be calculated from our attribute definitions:

Decision Processing

The following code is used to create a decision:

function ssvc_vuldb_decision($r){
	$report_credibility	= $r['vulnerability_ssvc_vuldb_rc'];
	$exploitation		= $r['vulnerability_ssvc_vuldb_e'];
	$automatable		= $r['vulnerability_ssvc_vuldb_a'];
	$technical_impact	= $r['vulnerability_ssvc_vuldb_ti'];
	$mission_impact		= $r['vulnerability_ssvc_vuldb_mi'];
	$value_density		= $r['vulnerability_ssvc_vuldb_vd'];
	$system_exposure	= $r['vulnerability_ssvc_vuldb_exp'];
	$supplier_cardinality	= $r['vulnerability_ssvc_vuldb_sc'];
	
	$high_impact	= ($technical_impact == 'T' || $mission_impact == 'MF' || $value_density == 'C');
	$high_exposure	= ($system_exposure == 'O' || $supplier_cardinality == 'M');
	
	if($report_credibility == 'NC'){
		//potential false-positive
		if($exploitation == 'A' || $automatable == 'Y' || $high_impact || $high_exposure){
			//automatable, high impact or exposure
			$ret = 'Track';
		}else{
			//low impact or exposure
			$ret = 'Ignore';
		}
	}else{
		//not a false-positive
		if($exploitation == 'P'){
			//POC
			if($automatable == 'Y' || $high_impact || $high_exposure){
				//automatable, high impact or exposure
				$ret = 'Attend';
			}else{
				//not automatable
				$ret = 'Monitor';
			}
		}elseif($exploitation == 'A'){
			//attacked
			if($automatable == 'Y'){
				//automated
				if($high_impact || $high_exposure){
					//high impact or exposure
					$ret = 'Act Now';
				}else{
					//low impact or exposure
					$ret = 'Act';
				}
			}else{
				//not automated
				if($high_impact || $high_exposure){
					//high impact or exposure
					$ret = 'Act';
				}else{
					//low impact or exposure
					$ret = 'Attend';
				}			
			}
		}else{
			//no exploitation
			if($high_impact || $high_exposure){
				//high impact or exposure
				$ret = 'Monitor';
			}else{
				//low impact or exposure
				$ret = 'Track';
			}			
		}
	}
	return $ret;
}

Decision Result Table

This is the complete decision result table which lists all possible outcomes of our SSVC generation.