Vulnerability Assessment and Risk Management · Topic 2 of 4
Threat Intelligence, CVEs and Security Communication
Learn how vulnerability databases, CVE and CVSS, threat intelligence sources and clear documentation help you find and communicate network vulnerabilities.
- 5 min
- A CVE is a unique identifier for a publicly known vulnerability.
- CVSS scores run from 0 to 10, and 9.0 to 10.0 is critical.
- Vulnerability databases only list known flaws, so they cannot warn of unknown ones.
What it is
Threat intelligence is information about threats and weaknesses that helps you decide what to protect first.
It answers questions such as which flaws are being attacked now, who is attacking, and how. Good intelligence turns a long list of possible problems into a short list of urgent ones.
This page covers vulnerability databases and CVEs, the sources of intelligence, and how to document and share information well.
How it works
Intelligence is only useful when it is relevant, timely and shared with the right people.
CVE and vulnerability databases
A CVE (Common Vulnerabilities and Exposures) entry is a unique identifier for a publicly known vulnerability. It looks like CVE-2024-12345, with the year and a number. The shared name lets everyone, including vendors, scanners and news reports, talk about the same flaw.
A vulnerability database collects details about known flaws. The National Vulnerability Database (NVD) is a well known example that adds severity scores and affected products to CVE entries.
Many entries carry a CVSS (Common Vulnerability Scoring System) score from 0 to 10, where a higher number is more severe. The bands below are the ones used by CVSS version 3 and later.
| CVSS score | Rating |
|---|---|
| 0.1 to 3.9 | Low |
| 4.0 to 6.9 | Medium |
| 7.0 to 8.9 | High |
| 9.0 to 10.0 | Critical |
The uses of these databases are to look up a flaw by its CVE number, check which products and versions are affected, find out if a fix exists, and rank flaws.
Their limits are important too:
- a flaw is only listed after it is discovered and published, so new flaws are missing
- a high score does not always mean high risk for your own network, because your exposure and the value of your systems matter
- entries can lag behind real attacks
- the volume is huge, so you need to filter for the software you actually use
Assessment tools and reports
Industry standard tools, such as vulnerability scanners, compare your systems with the known flaw lists and create reports. A good report lists the affected systems, the severity, the evidence, and a recommended fix. From this, teams can make recommendations, set policies, such as a rule that critical flaws are fixed within a set time, and track progress.
Sources of intelligence
| Source | Notes |
|---|---|
| Vendor advisories | Direct notices from product makers about flaws and fixes |
| Cybersecurity reports | Published studies of attack trends and incidents |
| Cybersecurity news | Fast, but needs checking for accuracy |
| Subscription services | Paid feeds with curated and often more timely data |
| Collective intelligence | Sharing between organisations, such as industry groups that exchange details of attacks |
Collective intelligence works because attackers often reuse methods. If one organisation sees an attack and shares it, others can block it before they are hit.
Intelligence can be gathered in two ways. Ad hoc intelligence is a person looking something up when a question arises, such as reading about a new flaw. Automated intelligence is a feed that flows into security tools, which can then update blocking rules or alerts without waiting for a person.
Documentation and communication
Clear information matters before, during and after an incident.
- Before: keep asset lists, network diagrams, contact lists and procedures up to date, so that responders know what they are protecting and whom to call.
- During: give regular, short updates to the right people, including managers, technical teams and, where needed, customers or regulators. Record what is found and what is done.
- After: write a review of what happened and update the documents, so the same gap is not left open.
Documents must be handled safely. Secure, share and update them by:
- limiting access to those who need it
- marking the sensitivity of each document
- using one agreed place for the current version, with version control
- sharing through approved, protected channels
- reviewing documents on a regular schedule
An out of date diagram or contact list can slow a response at the worst moment.
What to remember for the exam
Seven facts cover most questions on this topic.
- A CVE is a unique identifier for a publicly known vulnerability.
- CVSS scores run from 0 to 10, and 9.0 to 10.0 is critical.
- Vulnerability databases only list known flaws, so they cannot warn of unknown ones.
- A high score is not the same as high risk for your organisation.
- Collective intelligence means organisations share information on threats.
- Automated intelligence feeds directly into security tools.
- Documentation must be kept current, protected and shared with the right people.
A CVE tells you which flaw it is, and CVSS tells you how severe it is.
Common mistakes
These four errors are common.
Believing the score is the whole story. Context decides risk, so consider your own systems.
Expecting a database to know every flaw. Unknown flaws and brand new ones are missing.
Letting documents go out of date. Old diagrams and contact lists cause delays in an incident.
Sharing sensitive documents too widely. Reports about weaknesses help attackers if they leak.
Check the accuracy of news stories and unverified posts before acting. A false alarm can waste a lot of time.
Check yourself
Work through these three questions.
What is a CVE?
It is a unique identifier for a publicly known vulnerability, so everyone can refer to the same flaw by one name.
Why is a high CVSS score not always a high risk for your network?
Risk also depends on your exposure and the value of your systems, so the score is only one input.
Why should incident documents be kept current and protected?
Out of date information slows the response, and leaked reports about weaknesses can help attackers.
Topic 2 of 4 in Vulnerability Assessment and Risk Management
Test yourself on Vulnerability Assessment and Risk Management
The full Cisco CCST 100-160 Cybersecurity question bank has 864 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.