2024å¹´7æ12æ¥ã«éå¬ãããã製é æ¥ã«ãããèå¼±æ§ç®¡çã®èª²é¡ã¨å¯¾å¿æ¹æ³@大éªãã»ããã¼ã®ãSSVC Supplier Treeã®æ¦è¦ã¨èªååãã»ãã·ã§ã³ã®ã¹ã©ã¤ãã§ãã ç±³å½CISAãæ¨å¥¨ããèå¼±æ§ç®¡çã®åªå é ä½ä»ãææ³ã§ããSSVCï¼Stakeholder-Specific Vulnerability Categorizationï¼ã®æ¦è¦ã説æããPSIRTç¨ã®æ±ºå®æ¨ã§ããSupplier Treeãç´¹ä»ãã¾ããSSVCã¯èå¼±æ§ããªã¹ã¯ãã¼ã¹ã§åªå 度ä»ããããã¬ã¼ã ã¯ã¼ã¯ã§ããããã®ã¾ã¾çµç¹ã«é©ç¨ããã¨äººçå·¥æ°ã¨å°éç¥èãå¿ è¦ã§ããè¬æ¼è ã¯SSVCã®å°å ¥ã«ã¯èªååãèè¦ã§ããã¨èããèªååã®æ¹æ³ã模索ãã¦ãã¾ããæ¬ã»ãã·ã§ã³ã§ã¯ãSSVC Supplier Treeãç¨ãã¦è£½é æ¥ã®PSIRTã®èå¼±æ§ããªã¢ã¼ã¸ãèªååããæ¹æ³ãæ¢æ±ãã¾ããå ·ä½çã«ã¯ãSupplier Treeã®åDe
æ¬æã®å 容ã¯ã2022å¹´4æ20æ¥ã«Miguel Hernándezãæ稿ããããã°Are vulnerability scores misleading you? Understanding CVSS severity and using them effectively(https://sysdig.com/blog/vulnerability-score-cvss-meaning/ï¼ãå ã«æ¥æ¬èªã«ç¿»è¨³ã»åæ§æããå 容ã¨ãªã£ã¦ããã¾ãã èå¼±æ§ã¯ã©ãã«ã§ãããã¾ããã»ãã¥ãªãã£å°é家ã«ã¨ã£ã¦ããããã®èå¼±æ§ã大è¦æ¨¡ã«èª¿æ»ããç·©åããæ¯æ£ãããã¨ã¯å¤§å¤ãªä½æ¥ã§ããã©ã®çµç¹ãããã¹ã¦ã®èå¼±æ§ãè¦ã¤ãã¦ä¿®æ£ããè½åãæã£ã¦ããããã§ã¯ãªããã¨ãå¿ã«çãã¦ããã¦ãã ãããéè¦ãªã®ã¯ãèå¼±æ§ã¨ã¯ä½ããç解ããCVSSã¹ã³ã¢ã®æå³ã解éããå¶ç´ãããæéå¶éãç´æå ã§ãªã½ã¼ã¹ã®åªå é ä½ä»ãã¨æå¹å©
ã½ããã¦ã§ã¢éçºè ã§ãªãã¨ããã»ãã¥ãªãã£ã»ãã¤ã»ãã¶ã¤ã³ã¨ããè¨èã¯èãããã¨ãããã¨æãã¾ããããããã»ãã¥ãªãã£ã»ãã¤ã»ãã¶ã¤ã³ãååã«å®æ½ã§ãã¦ããã¨è¨ããçµç¹ã¯å¤ããªãã®ã§ã¯ãªãã§ããããã ããã»ãã¥ãªãã£ã»ãã¤ã»ãã¶ã¤ã³ãå®æ½ãããã¨ãã¦ããä½ãããã°ããã®ã ããï¼ããã©ãããã°è¯ãã®ã ããï¼ãã¨ãªããªãæãåããªãããããªç¶æ³ã®ä¸å©ã¨ãªããããæã ãã»ãã¥ãªãã£ã»ãã¤ã»ãã¶ã¤ã³ãå¦ã³ãå®è·µããå 容ãææ¸åãå ¬éããéã³ã¨ãã¾ããã ã»ãã¥ãªãã£åå¿è ã§ãèªã¿ãããããã«ã以ä¸ã®ç¹å¾´ã念é ã«ããã¦æ¬æ¸ãå·çãã¾ããã 軽快ãªæç« å³è¡¨ãå¤ç¨ããã°ã©ãã£ã«ã«ãªè¦ãç® ãã£ã©ã¯ã¿ã¼ã®ã»ãªãã«å ±æããªããç解ãã§ãã 1ç« ãã»ãã¥ãªãã£ã»ãã¤ã»ãã¶ã¤ã³ ï¼ã»ãã¥ãªãã£ã»ãã¤ã»ãã¶ã¤ã³ã®æ¦è¦ãå¿ è¦æ§ã®èª¬æ 2ç« ãè å¨åæ ï¼çµç¹ãã·ã¹ãã ã«å¯¾ããè å¨åæã®å®æ½æ¹æ³ 3ç« ãã»ãã¥ãªãã£
DecisionRulesç·¨ããã®ç¶ç·¨ã§ãã æ¦è¦ ã¿ã¤ãã«ã®éãã§ããTwineã«ã¤ã³ãã¼ãã§ããhtmlãã¡ã¤ã«ãç½®ãã¦ããã¾ãããã®ã¾ã¾éãã¦å®è¡ãã§ãã¾ãã https://github.com/w4yh/SSVC-decision-tree ãã¡ã¤ã«ï¼ Harloweã¨SugarCubeã®2種é¡ã®ã¹ã¿ã¤ã«ã§ä½ã£ã¦ã¿ã¾ããã SSVC_Supplier_Decision_Table_Harlowe_0.0.2.html SSVC_Supplier_Decision_Table_SugarCube_0.0.2.html æ¦è¦ å®æå çµç·¯ Twine è¨è¨ ã¤ã³ãã¼ãã¨å®è¡ æ¯ãè¿ã å®æå æåã«ãã¢ä»£ããã«SugarCubeçã®ã¹ã¯ãªã¼ã³ã·ã§ãããè¼ãã¦ããã¾ãã ããã§ã¯ Exploitation=Active, Automatable=yes, Value Density=c
æ¦è¦ ã¿ã¤ãã«ã®éãã§ããã¤ã³ãã¼ãç¨ã®Excelãã¡ã¤ã«ãç½®ãã¦ããã¾ãã https://github.com/w4yh/SSVC-decision-tree ãã¡ã¤ã«ï¼ SSVC_Handling_SupplierTable_0.0.2.xlsx æ¦è¦ çµç·¯ DecisionRulesæ¦è¦ Excelããã®ã¤ã³ãã¼ãã§ãã¼ãã«ãä½æãã å®è¡ æ¯ãè¿ã ã¨ã¯ã¹ã«ã¼ã·ã§ã³ DecisionRulesè¯ãã£ãã§ã ãã¼ãã«ãåæ¥ decisionã®ã«ã¿ã«ãè¡¨è¨ çµç·¯ Twitterã§SSVCã®ãã¨ãç¥ãã¾ããã ðCVSSã«ã¨ã£ã¦ä»£ãããããããªã èå¼±æ§ã®ç®¡çæ¹æ³ SSVC ã®ãã°ãããã¾ã¨ããCISAãSSVCæ¨ãã ãhttps://t.co/VdVt6SrOKIâ Yurika (@EurekaBerry) 2022å¹´8æ10æ¥ å ã¨ãªãããã°è¨äºããã®å¼ç¨è¨äºãªã©ãèªãã§ããã
ã¯ããã« ããæè¿èå¼±æ§ç®¡çã«ã¤ãã¦ãã£ã¨èãã¦ããã®ã§ãããSSVCãç¥ã£ã¦ããã¨ãããã®ãããªãã·ã³ãã«ã«èããããããã«ãªãã¾ããã試ã¿èªä½ã¯ã¾ã éä¸ãªã®ã§ããã以ä¸ã®ãããªãã¨ãç®çã¨ãã¦ãSSVCã®æ¦è¦ããç¾æç¹ã§ã®çµéãç§ã®èããæåã«èµ·ããã¦ã¿ã¾ãã ã¢ã¤ãã¢ãæ´çããã èå¼±æ§ç®¡çã»éç¨ã«æ©ãã§ãã人ã¨å·ãèãåããã ããããã°æèè ã®ç®ã«æ¢ã¾ã£ã¦ãæè¦ãè³ãããï¼è¾è¾£ãªã®ã¯ã¤ã¤ï¼ SSVCã¨ã¯ï¼ Stakeholder-Specific Vulnerability Categolizationã®ç¥ãCERT/CCãèæ¡ããèå¼±æ§ç®¡çææ³ã§ããCVSSããèå¼±æ§ã®è©ä¾¡ææ³ãã§ãããã¨ã«å¯¾ãã¦ãSSVCã¯ãèå¼±æ§å¯¾å¿æ¹éã®å¤æææ³ãã§ããã¨è¨ãã¾ãã ãã¶ãä»ä¸çªåããããã解説ãã¼ã¸ãPWCã ããã ãï¼ www.pwc.com å®éã®è³æã¯ãCERT/CCã®GitHubãª
â Known Exploited Vulnerabilities Catalogã¨ã¯ ãKnown Exploited Vulnerabilities Catalogãï¼ä»¥ä¸ãKEVCï¼ã¯ãç±³å½åå®å ¨ä¿éçã®CISAï¼Cybersecurity & Infrastructure Security Agencyï¼ã2021å¹´11æ3æ¥ããå ¬éãã¦ããæ å ±ã§ååã®éãæªç¨ããããã¨ãç¥ããã¦ããèå¼±æ§ã®ã«ã¿ãã°ã§ãããã®ã«ã¿ãã°ã«æ²è¼ããã¦ããèå¼±æ§ã¯2022å¹´2æ4æ¥æç¹ã§352件ã§ããããã¯æ¢ã«æªç¨ã確èªããã¦ããããã¤ãã¢ã¡ãªã«ã®é£é¦æ¿åºã«å¤§ããªå½±é¿ãåã¼ãããã対å¿ãæ¥ãããã¨å¤æã§ãããã®ã§ãã ãã®ã«ã¿ãã°ã«æ²è¼ããã¦ããé ç®ã¯ä»¥ä¸ã®éãã§ãã CVEçªå· ï¼CVEï¼ ãã³ãã¼/ããã¸ã§ã¯ãå ï¼Vendor/Productï¼ è£½åèå¼±æ§å ï¼Vulnerability Nameï¼
ãªãªã¼ã¹ãé害æ å ±ãªã©ã®ãµã¼ãã¹ã®ãç¥ãã
ææ°ã®äººæ°ã¨ã³ããªã¼ã®é ä¿¡
å¦çãå®è¡ä¸ã§ã
j次ã®ããã¯ãã¼ã¯
kåã®ããã¯ãã¼ã¯
lãã¨ã§èªã
eã³ã¡ã³ãä¸è¦§ãéã
oãã¼ã¸ãéã
{{#tags}}- {{label}}
{{/tags}}