RB-ANALYSIS-039: Vulnerability Exposure Assessment

Document Control

1. Prerequisites

• Completion of Vulnerability Validation
• CVE, advisory, or finding identifier available
• Access to vulnerability management platform
• Access to asset inventory
• Access to CMDB (if available)
• Access to cloud inventory
• Access to network inventory
• Access to internet exposure management tooling
• Access to SIEM
• Incident or tracking ticket created

2. Step-by-Step Instructions

1. Review Vulnerability Details

   • Review:
     • CVE identifier
     • Vulnerability description
     • CVSS score
     • Vendor advisory
     • Affected software versions
   • Document key vulnerability characteristics.

2. Identify Exposure Requirements

   • Determine:
     • Required network access
     • Required authentication level
     • User interaction requirements
     • Privilege requirements
   • Document exploitation prerequisites.

3. Identify Internet-Facing Assets

   • Review:
     • External attack surface
     • Public IP addresses
     • Internet-facing applications
     • Public cloud services
   • Identify potentially exposed assets.

4. Identify Internal Assets

   • Review:
     • Internal applications
     • Internal services
     • Workstations
     • Servers
     • Cloud workloads
   • Identify potentially affected assets.

5. Review Existing Security Controls

   • Determine whether controls exist such as:
     • WAF protections
     • Network segmentation
     • IPS signatures
     • Access controls
     • Application allow-listing
   • Document existing mitigations.

6. Assess Accessibility

   • Determine whether affected assets are:
     • Internet accessible
     • Internally accessible
     • Restricted to privileged users
     • Accessible through third parties
   • Document exposure pathways.

7. Assess Business Criticality

   • Review:
     • Asset criticality
     • Business ownership
     • Data sensitivity
     • Operational importance
   • Document affected business functions.

8. Assess Potential Impact

   • Determine whether successful exploitation could result in:
     • Remote code execution
     • Privilege escalation
     • Data exposure
     • Service disruption
     • Lateral movement
   • Document potential impact.

9. Develop Exposure Assessment

   • Summarise:
     • Vulnerable assets
     • Exposure pathways
     • Existing mitigations
     • Business impact
     • Overall exposure rating
   • Document confidence level.

10. Escalate and Hand Off

    • Provide findings to the Incident Commander and Technical Lead.
    • Escalate to:
      • Vulnerable Asset Identification
      • Exploitation Verification
      • Vulnerability Exposure Reduction
    • Update the incident record with all findings.

3. Post-Action

• Ensure all exposed assets are documented.
• Ensure all exposure pathways are documented.
• Preserve supporting evidence and assessment data.
• Record existing security controls and mitigations.
• Attach the completed exposure assessment to the incident record.
• Support remediation and containment activities as required.

Contributor

Vishal Thakur GitHub: https://github.com/malienist

Contributed to the Arcana Incident Response Documentation Framework.