1、 I n t e r n a t i o n a l T e l e c o m m u n i c a t i o n U n i o n ITU-T X.1525 TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (04/2015) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY Cybersecurity information exchange Vulnerability/state exchange Common weakness scoring syste
2、m Recommendation ITU-T X.1525 ITU-T X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299 INTERWORKING BETWEEN NETWORKS X.300X.399 MESSAGE HANDLING SYSTEMS X.400X.499 DIRECTORY X.500X.599 OSI NETWORKING A
3、ND SYSTEM ASPECTS X.600X.699 OSI MANAGEMENT X.700X.799 SECURITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General security aspects X.1000X.1029 Network security X.1030X.1049 Security management X.1050X.1069 Telebiometrics X.1080X.1
4、099 SECURE APPLICATIONS AND SERVICES Multicast security X.1100X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols X.1150X.1159 Peer-to-peer security X.1160X.1169 Networked ID security X.1170X.1179 IPTV security X.1180X.1199 CYBERSPACE S
5、ECURITY Cybersecurity X.1200X.1229 Countering spam X.1230X.1249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES Emergency communications X.1300X.1309 Ubiquitous sensor network security X.1310X.1339 PKI related Recommendations X.1340X.1349 CYBERSECURITY INFORMATION EXCHANGE Overview
6、 of cybersecurity X.1500X.1519 Vulnerability/state exchange X.1520X.1539 Event/incident/heuristics exchange X.1540X.1549 Exchange of policies X.1550X.1559 Heuristics and information request X.1560X.1569 Identification and discovery X.1570X.1579 Assured exchange X.1580X.1589 CLOUD COMPUTING SECURITY
7、Overview of cloud computing security X.1600X.1601 Cloud computing security design X.1602X.1639 Cloud computing security best practices and guidelines X.1640X.1659 Cloud computing security implementation X.1660X.1679 Other cloud computing security X.1680X.1699 For further details, please refer to the
8、 list of ITU-T Recommendations. Rec. ITU-T X.1525 (04/2015) i Recommendation ITU-T X.1525 Common weakness scoring system Summary Recommendation ITU-T X.1525 on the common weakness scoring system (CWSS) provides an open framework for communicating the characteristics and impact of information and com
9、munication technologies (ICT) weaknesses during development of software capabilities. The goal of this Recommendation is to enable ICT software developers, managers, testers, security vendors and service suppliers, buyers, application vendors and researchers to speak from a common language of scorin
10、g ICT weaknesses that could manifest as vulnerabilities when the software is used. History Edition Recommendation Approval Study Group Unique ID* 1.0 ITU-T X.1525 2015-04-17 17 11.1002/1000/12357 _ * To access the Recommendation, type the URL http:/handle.itu.int/ in the address field of your web br
11、owser, followed by the Recommendations unique ID. For example, http:/handle.itu.int/11.1002/1000/11830-en. ii Rec. ITU-T X.1525 (04/2015) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of telecommunications, information and communicatio
12、n technologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions and issuing Recommendations on them with a view to standardizing telecommunications on a worldwide basis. The World
13、 Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution 1. In s
14、ome areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this Recommendation, the expression “Administration“ is used for conciseness to indicate both a telecommunication administration and a recogni
15、zed operating agency. Compliance with this Recommendation is voluntary. However, the Recommendation may contain certain mandatory provisions (to ensure, e.g., interoperability or applicability) and compliance with the Recommendation is achieved when all of these mandatory provisions are met. The wor
16、ds “shall“ or some other obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that compliance with the Recommendation is required of any party. INTELLECTUAL PROPERTY RIGHTSITU draws attention to the possibility that
17、the practice or implementation of this Recommendation may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of the Recommendatio
18、n development process. As of the date of approval of this Recommendation, ITU had not received notice of intellectual property, protected by patents, which may be required to implement this Recommendation. However, implementers are cautioned that this may not represent the latest information and are
19、 therefore strongly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2015 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior written permission of ITU. Rec. ITU-T X.1525 (04/2015) iii Table of Contents Page 1 Sc
20、ope . 1 2 References . 1 3 Definitions 1 3.1 Terms defined elsewhere 1 3.2 Terms defined in this Recommendation . 2 4 Abbreviations and acronyms 2 5 Conventions 3 6 Use of CWSS 3 6.1 CWSS description 3 6.2 Workings of CWSS 4 6.3 CWSS scoring 5 6.4 CWSS users 6 7 Metric groups 7 7.1 Metric group fact
21、ors . 7 7.2 Values for uncertainty and flexibility . 8 7.3 Base finding metric group 9 7.4 Attack Surface metric group . 15 7.5 Environmental Metric group 19 7.6 CWSS score formula 24 7.7 CWSS vectors, scoring examples and score portability . 26 Bibliography. 30 iv Rec. ITU-T X.1525 (04/2015) Introd
22、uction Software developers often face hundreds or thousands of individual bug reports for weaknesses that are discovered in their code. In certain circumstances, a software weakness can even lead to an exploitable vulnerability. Due to this high volume of reported weaknesses, stakeholders are often
23、forced to prioritize which issues they should investigate and fix first. In short, people need to be able to reason and communicate about the relative importance of different weaknesses. While various scoring methods are used today, they are either ad hoc or inappropriate for application to the stil
24、l-imprecise evaluation of software security. The common weakness scoring system (CWSS) provides a mechanism for prioritizing software weaknesses in a consistent, flexible, open manner while accommodating context for the various business domains and intended uses of the software. It is a collaborativ
25、e, community-based effort that is addressing the needs of its stakeholders across government, academia and industry. ICT software developers, managers, testers, security vendors and service suppliers, buyers, application vendors and researchers must identify and assess weaknesses in software that co
26、uld manifest as vulnerabilities when the software is used. They then need to be able to prioritize these weaknesses and determine which to remediate based on which of them pose the greatest risk. When there are so many to fix, with each being scored using different scales, the various ICT community
27、members, managers, testers, buyers and developers are left to their own methodologies to find some way of comparing disparate weaknesses and translating them into actionable information. Because CWSS standardizes the approach for characterizing weaknesses, users of CWSS can invoke attack surface and
28、 environmental metrics to apply contextual information that more accurately reflects the risk to the software capability given the unique business context it will function within and the unique business capability it is meant to provide. This allows them to make more informed decisions when trying t
29、o mitigate risks posed by weaknesses. CWSS leverages existing work from within the cyber security community such as the large number of diverse real-world publicly known vulnerabilities specified through b-ITU-T X.1520 common vulnerabilities and exposures (CVE) and the scoring system used for discus
30、sing the severity of those publicly known vulnerabilities through b-ITU-T X.1521 common vulnerability scoring system (CVSS) as well as the common weakness enumeration (CWE) list of weaknesses in the softwares architecture, design, code or deployment. In constructing CWSS, the ability to allow reason
31、able default values for areas that may not be known, while providing for the tailoring based on business and technical context. CWSS is one of a class of ITU-T Recommendations that comes from a large, existing, global development and user community that has written and evolved an open specification
32、that is made available to the ITU-T for adoption with agreement that any changes or updates to the specification will be done in a manner that ensures full technical equivalency and compatibility will be maintained, that discussions about changes and enhancements will be done through the original us
33、er community processes, and includes explicit reference to the corresponding specific version maintained by the user community. Thus, at the time of initial adoption of Recommendation ITU-T X.1525, a due diligence verification and statement of equivalency will occur; and as changes are effected amon
34、g the user community, timely reflection of those changes will be reflected in subsequent versions of the Recommendation through continued collaboration. Recommendation ITU-T X.1525 - Common weakness scoring system (CWSS) has been developed on a collaborative basis with The MITRE Corporation bearing
35、in mind the importance of maintaining, to the extent possible, technical compatibility between Recommendation ITU-T X.1525 Common weakness scoring system (CWSS) and the “Common Weakness Scoring System (CWSS)“, version 1.0.1, dated 5 September 2014 https:/cwe.mitre.org/cwss/cwss_v1.0.1.html. Rec. ITU
36、-T X.1525 (04/2015) 1 Recommendation ITU-T X.1525 Common weakness scoring system 1 Scope This Recommendation provides a standardized approach for communicating the characteristics and impacts of weaknesses during development of ICT software capabilities using attack surface and environmental metrics
37、 to apply contextual information. CWSS more accurately reflects the risk to the user of the software capability, given the unique business context it will function within for the user, and the unique business capability the software is providing to the user. 2 References The following ITU-T Recommen
38、dations and other references contain provisions which, through reference in this text, constitute provisions of this Recommendation. At the time of publication, the editions indicated were valid. All Recommendations and other references are subject to revision; users of this Recommendation are there
39、fore encouraged to investigate the possibility of applying the most recent edition of the Recommendations and other references listed below. A list of the currently valid ITU-T Recommendations is regularly published. The reference to a document within this Recommendation does not give it, as a stand
40、-alone document, the status of a Recommendation. None. 3 Definitions 3.1 Terms defined elsewhere This Recommendation uses the following terms defined elsewhere: 3.1.1 access b-ITU-T X.1521: A subjects ability to view, modify, or communicate with an object. Access enables the flow of information betw
41、een the subject and the object. 3.1.2 availability b-ITU-T X.1521: The reliability and timely access to data and resources by authorized individuals. 3.1.3 attack instance b-ITU-T X.1544: A specific detailed attack against an application or system targeting vulnerabilities or weaknesses in that syst
42、em. 3.1.4 confidentiality b-ITU-T X.1521: A security principle that works to ensure that information is not disclosed to unauthorized subjects. 3.1.5 integrity b-ITU-T X.1521: A security principle that makes sure that information and systems are not modified maliciously or accidentally. 3.1.6 risk b
43、-ITU-T X.1521: The relative impact that an exploited vulnerability would have to a users environment. 3.1.7 threat b-ITU-T X.1521: The likelihood or frequency of a harmful event occurring. 3.1.8 vulnerability b-ITU-T X.1500: Any weakness that could be exploited to violate a system or the information
44、 it contains. 3.1.9 weakness b-ITU-T X.1524: A shortcoming or imperfection in the software code, design, architecture, or deployment that, could, at some point become a vulnerability, or could contribute to the introduction of other vulnerabilities. 2 Rec. ITU-T X.1525 (04/2015) 3.2 Terms defined in
45、 this Recommendation This Recommendation defines the following term: 3.2.1 vignette: A vignette provides a shareable, formalized way to define a particular environment, the role that software plays within that environment and an organizations priorities with respect to software security. 4 Abbreviat
46、ions and acronyms This Recommendation uses the following abbreviations and acronyms: AI Authentication Instances AL Acquired privilege Layer AP Acquired Privilege AS Authentication Strength ASLR Address Space Layout Randomization AV Access Vector BI Business Impact BVC Business Value Context CD Comp
47、act Disc CIO Chief Information Officer CSO Chief Security Officer CSRF Cross-Site-Request-Forgery CVSS Common Vulnerability Scoring System CWE Common Weakness Enumeration CWRAF Common Weakness Risk Analysis Framework CWSS Common Weakness Scoring System DI Likelihood of Discovery DNS Domain Name Syst
48、em DS Deployment Scope EC External Control effectiveness EX Likelihood of Exploit FC Finding Confidence FTP File Transfer Protocol HTML Hyper Text Markup Language IC Internal Control Effectiveness ICT Information Communication Technology IN level of Interaction IP Internet Protocol NIST National Ins
49、titute of Standards and Technology OS Operating System Rec. ITU-T X.1525 (04/2015) 3 OWASP Open Web Application Security Project P Prevalence PCI DSS Payment Card Industry Data Security Standard RL Required Privilege Layer RP Required Privilege SAMATE Software Assurance Metrics And Tool Evaluation SANS SysAdmin, Audit, Networking and Security SQL Structured Query Language SSL Secure Sockets Layer TI Technical Impact TLS Transport Layer Security USB Universal Serial Bus XSS Cro
