Blog

Overworked IT security teams need to prioritize the flurry of security issues that are continuously passed to them for remediation. Vulnerability Management (VM) and Attack Surface Management (ASM) are examples of enterprise cybersecurity activities that rely on prioritization to be more effective. Numerous standards have been developed to support enterprise security teams in this endeavor to prioritize. These include Common Vulnerability Scoring System (CVSS Score), Exploit Prediction Scoring System (EPSS), and Stakeholder-Specific Vulnerability Categorization (SSVC), among other proprietary metric scoring systems such as Coalition Exploit Scoring System (ESS) and Zoom's VISS.

Now, software development teams have been afforded their own metric for software vulnerability prioritization that can be used pre-release or during the management of vulnerability disclosures for products already on the market. In this article we will delve into the CWE with Environmental CVSS Calculator: a new tool developed by the MITRE Enginuity Center For Threat Informed Defense for prioritizing the software weakness remediation efforts. The tool essentially uses historical mappings of CVE (Common Vulnerabilities and Exposures) to CVSS (Common Vulnerability Scoring System) scores to calculate the average risk for each CWE classification. Let's dig into the specifics.

What is "CWE?"

Common Weakness Enumeration (CWE) is a comprehensive catalog used for identifying and categorizing software weaknesses and vulnerabilities created and is maintained by The MITRE Corporation. Each weakness in the CWE list is given a unique identifier (e.g., CWE-79 for Cross-Site Scripting) and a description that helps security professionals understand its nature.

CWE is useful to software developers, security analysts, QA teams, and cybersecurity professionals. The list supports creation of secure applications and robust security practices. It also serves as a valuable tool for security tool developers, organizations, enterprises, and regulatory bodies to establish security standards, guide security policies, and ensure compliance with best practices in software security.

Introducing The CWE with Environmental CVSS Calculator

The top 25 CWE and top 10 known exploited CWE have previously been aggregated by MITRE to help software developers prioritize their remediation efforts. However, the newly released CWE with Environmental CVSS Calculator goes further to estimate the severity of each CWE category by analyzing related published CVEs and averaging their scores. It was developed by The MITRE Corporation in cooperation with their members: FIS Global, Fujitsu, and JPMorgan Chase. So, while CWE defines the technical details of a particular weakness, the new metric calculator provides a risk score for prioritization.

This new metric is meant to help software engineers by providing a data-driven method for scoring CWEs based on their severity in real-world vulnerabilities. Its method maps CWEs by their  historical context to identify the most risky types of software vulnerabilities. The calculator guides developers to prioritize their remediation workload by tackling the weaknesses most likely to pose significant threats.

The calculator also supports extended metrics of the CVSS standard; the Environmental and Temporal factors, allowing a more context specific analysis for specific environments. This further supports software development teams to prioritize remediation according to the operating environment and business context of the affected software and how readily available exploits are. This customization ensures that the calculated scores provide more relevant guidance for mitigating risks specific to the context in which the software will be deployed.

How Does the CWE Calculator Work?

The CWE Calculator computes a risk score which helps prioritize uncovered software weaknesses according to their severity and potential impact. Here is how the process works for calculating the risk of a specific CWE:

• Normalization Check: The calculator first checks if normalization is enabled. If enabled, it determines whether the requested CWE should be mapped to another, more appropriate CWE. If a mapping exists, the mapped CWE is selected for further analysis; otherwise, the original CWE remains selected.

• Filtering CVE Records: The calculator examines each CVE record in the cached data that is mapped to the requested CWE. It filters out any CVEs that are unscored, rejected, or have no CWE mapping to ensure only relevant and accurate data is used.

• Applying Environmental Metrics: If environmental metrics are supplied, they are applied to the base CVSS score. This adjustment tailors the score to reflect the specific environmental context, considering how the vulnerability might be exploited in different scenarios.

• Retrieving CVSS Scores: The calculator retrieves the CVSS score for each CVE associated with the selected CWE. These scores provide a measure of the severity of the vulnerabilities.

• Computing Score Distribution: The calculator computes the distribution of the CVSS scores for the selected CVEs. It calculates the minimum, mean, maximum, and standard deviation of the scores, providing a statistical overview of the risk levels associated with the CWE.

Conclusion

The CWE with Environmental CVSS Calculator is a powerful tool developed by the MITRE Corporation in collaboration with industry partners to help software developers prioritize the remediation of software weaknesses. By leveraging historical CVE data, this calculator provides an empirical, data-driven risk score for each CWE category, reflecting the severity of related real-world vulnerabilities. It goes beyond standard scoring by supporting environmental and temporal factors of the CVSS, allowing a more tailored analysis that considers specific operational contexts and business environments. 

Going forward, this will help guide software development teams in focusing their remediation efforts on the weaknesses most likely to pose significant threats, ultimately improving the overall security posture of their software products.