Products
- Products
  
  Platform
  ShadowPlex Advanced Threat Defense
  Deception for early detection of cyber threats with precision and speed
  
  ShadowPlex Identity Protection
  Visibility, management and protection of identity stores and attack paths
  Acalvio Active Defense Platform
  Comprehensive and Award-winning Distributed Deception Platform
  
  What is Active Defense?
  Active defense detects and diverts attacks.
  
  Why do I need Acalvio Active Defense?
  Active Defense deceives and disrupts attackers.
Solutions
- Technology Solutions
  
  Industry Solutions
  Early Threat Detection
  Detect cyber threats early in the attack lifecycle to prevent adversary breakout
  
  Identity Threat Detection & Response
  Detect identity threats with precision and protect the identity architecture
  
  OT Security
  Protect OT environments from cyber threats with an easy-to-deploy and non-intrusive solution
  
  Red Teaming
  Strengthen defenses to detect red team activities
  
  Threat Hunting
  Active threat hunting to confirm latent threats and gain visibility to attacker TTPs
  
  Ransomware
  AI-driven deception to protect against known and zero-day ransomware variants
  
  Honeytokens for CrowdStrike
  Enterprise-scale honeytokens to protect against current and evolving identity threats
  
  Active Directory Protection
  Visibility to AD attack surface and detection of AD attacks
  
  Zero Trust
  Advance Zero Trust maturity through improved cyber visibility
  
  Insider Threats
  Unmask hidden dangers. Cyber deception for high-fidelity insider threat detection
  Public Sector
  Targeted solution for protecting Federal agencies in conformation with NIST and CISA recommendations
  
  Financial Services
  Transform Financial Cybersecurity with Innovative Cyber Deception and Active Defense
  
  Healthcare
  Active defense solutions thwart healthcare attacks before they can inflict real damage.
Resources
Partners
Company

CVE (Common Vulnerabilities and Exposures)

Q: How is a CVE identified?

Anyone can report a Common Vulnerability or Exposure. Users of the software, vendors, organizations. Once the vulnerability is identified, the finder reports it through the CVE Program, to a CVE Program Partner. If the vulnerability meets the minimum requirements for a CVE Record, it is confirmed and the record is published to the CVE List.

Q: Who assigns CVE IDs?

CVE identifiers are assigned by organizations that are designated as CVE numbering Authorities (CNAs). These include major IT companies and cybersecurity companies, as well as research organizations.

Q: How does CVE work with other security standards?

Since the CVE system encourages a standard format to report and describe vulnerabilities, it enforces standards. Using CVE identifiers, different security tools and platforms can communicate more effectively, facilitating interoperability.

Q: What is the difference between CVE and CVSS?

The term CVE refers to the record and description of reported and identified vulnerability itself. The CVSS is used to assign a numerical score to each vulnerability based on metrics that assess various aspects of the vulnerability’s impact and exploitability.

Q: How often is the CVE list updated?

Since anyone can report a potential vulnerability, CNAs are constantly verifying and updating CVE records. The list is updated regularly to include new vulnerabilities and their relevant information.

What is a CVE?

CVE stands for “Common Vulnerabilities and Exposures.” It is a list of publicly disclosed cybersecurity vulnerabilities that is free to search, use, and incorporate into products and services. CVE helps vendors and researchers identify, define, and catalog vulnerabilities in a standardized way.

Each CVE entry is assigned a unique identifier, known as a CVE ID, which consists of the year the vulnerability was assigned, followed by a sequential number (e.g., CVE-2023-12345). This identifier helps in referencing and discussing specific vulnerabilities across different platforms and sources.

Difference Between Vulnerability and Exposure

A vulnerability is a weakness or flaw in a system, software application, or hardware component that can be exploited by attackers to compromise the confidentiality, integrity, or availability of the system or its data.

Exposure refers to the condition in which a system or software application is at risk due to the presence of a known vulnerability. An exposed system is susceptible to attacks that could take advantage of the identified vulnerability to compromise its security. Exposure implies that the vulnerability is present and can be exploited by attackers.

Benefits of CVEs

The Common Vulnerabilities and Exposures system plays a crucial role in enhancing cybersecurity by standardizing vulnerability information, promoting collaboration, and enabling a standard vulnerability tracking and management process.

CVE stands for a standardized naming convention for security vulnerabilities, making it easier for security professionals, vendors, and researchers to discuss and share information about vulnerabilities. The centralized Database helps organizations track and manage security issues more effectively. Using common vulnerabilities and exposures system identifiers, different security tools and platforms can communicate more effectively, facilitating interoperability. Open tracking also encourages timely patching.

What information does a CVE contain?

CVE entries typically include details about the vulnerability, such as its severity, affected products and versions, technical descriptions, potential impact, and steps for mitigation or remediation. These entries serve as a valuable resource for security professionals to stay informed about the latest vulnerabilities and take appropriate actions to secure their systems and networks.

What is a Common Vulnerability Scoring System (CVSS)?

Common Vulnerability Scoring System (CVSS) is a standardized framework for assessing and communicating the severity of vulnerabilities in software and systems. CVSS provides a structured way to evaluate the potential impact and exploitability of a vulnerability, allowing organizations to prioritize their efforts in addressing security issues.

The CVSS framework assigns a numerical score to each vulnerability based on metrics that assess various aspects of the vulnerability’s impact and exploitability.

CVSS consists of four metric groups: Base, Threat, Environmental, and Supplemental. The CVSS Base Score is calculated based on several metrics related to the vulnerability’s exploitability and impact. These metrics include Attack Vector, Attack Complexity, Privileges Required, among others. Base metric values are combined with default values that assume the highest severity for Threat and Environmental metrics to produce a score ranging from 0 to 10.

A higher score indicates a more severe vulnerability. Examples of the CVSS can be viewed here.

How does the CVE system function?

A vulnerability on the CVE List is associated with a CVE Record. When a vulnerability is discovered, the finder reports it through the CVE Program, to a CVE Program Partner. A CVE ID is reserved by the CVE Program Partner. If the vulnerability meets the minimum requirements for a CVE Record, it is confirmed and the record is published to the CVE List. CVE Records are published by CVE Program partners.

CVE Identifiers

A CVE identifier is a unique, standardized identifier assigned to a specific security vulnerability. Each CVE identifier consists of the prefix “CVE-” followed by a unique identifying number and possibly a year (e.g., CVE-2022-1234). This identifier allows security researchers, vendors, and organizations to reference and track vulnerabilities consistently across different systems and platforms.

Where can I find the latest version of the CVE list?

The updated list of common vulnerabilities and exposures is available on the CVE website

Limitations of the CVE system

The CVE system has some limitations:

Coverage: The CVE system may not cover all vulnerabilities, especially those that are not publicly disclosed or those affecting less widely used software.

Delays: Assigning CVE identifiers does not happen immediately, particularly for less well-known vulnerabilities or those with lower severity levels.This can leave systems and users exposed to potential threats for longer periods.

Quality: The quality of CVE data can vary, as entries are often created by different individuals and organizations. In some cases, CVE entries may lack detailed information or contain inaccuracies.

Dependency: The CVE system relies on vulnerabilities being publicly disclosed to assign identifiers. This means that vulnerabilities discovered but not disclosed publicly may not receive CVE identifiers.

CVEs vs. CWEs: What’s the difference?

A CVE (Common Vulnerabilities and Exposures) refers to specific, identified vulnerabilities. A CWE (Common Weakness Enumeration) Refers to general categories or patterns of weaknesses that could lead to vulnerabilities. CWEs are often used in security training and secure coding practices, while CVEs are used in patch management and vulnerability assessment.

A CVE is the actual vulnerability, while the CWE refers to the weakness that could lead to the vulnerability.

How does Acalvio ShadowPlex reduce CVE-related risks in digital environments?

Acalvio ShadowPlex uses Deception Technology. This involves deploying decoys and other deceptions that blend into the environment and lure attackers away from real assets. Since deception technology does not depend on attack signatures or other static indicators, it can detect a range of threats. Deception-based detection does not depend on whether the exploit has been seen before, so it does not matter if the assets on the network have any CVEs associated with them. ShadowPlex is capable of detecting even zero-day exploits, attacks that exploit vulnerabilities that do not have a CVE associated with them yet.

Frequently Asked Questions

1. How is a CVE identified?

Anyone can report a Common Vulnerability or Exposure: software users, vendors, and organizations. Once the vulnerability is identified, the finder reports it through the CVE Program requirements to a CVE Program Partner. If the vulnerability meets the minimum for a CVE Record, it is confirmed, and the record is published to the CVE List.

2. Who assigns CVE IDs?

CVE identifiers are assigned by organizations designated as CVE Numbering Authorities (CNAs). These include major IT and cybersecurity companies, as well as research organizations.

3. How does the CVE system benefit organizations?

By providing a standardized framework for identifying and tracking vulnerabilities, the CVE system facilitates communication and collaboration between cybersecurity organizations. It enables more efficient information sharing and the prioritization of security efforts. Publicly accessible information on vulnerabilities helps organizations identify and mitigate risks and encourages patching and fixes.

4. Where can I find information about specific CVEs?

The list of CVE Records is maintained on the CVE Website.

5. How does CVE work with other security standards?

Since the CVE system encourages a standard format for reporting and describing vulnerabilities, it enforces standards. Using CVE identifiers, different security tools and platforms can communicate more effectively, facilitating interoperability.

6. What is the difference between CVE and CVSS?

The term CVE refers to the record and description of the reported and identified vulnerability itself. The CVSS assigns a numerical score to each vulnerability based on metrics that assess various aspects of its impact and exploitability.

7. How often is the CVE list updated?

Since anyone can report a potential vulnerability, CNAs constantly verify and update CVE records. The list is updated regularly to include new vulnerabilities and relevant information.

8. Is the CVE list accessible to everyone?

Yes, the list of common vulnerabilities and exposures is maintained by the MITRE Corporation in partnership with the U.S. Department of Homeland Security (DHS) and is available for free on the CVE website.

9. Is the CVE database comprehensive of all known vulnerabilities and exposures?

No, the CVE database is not a comprehensive list of all known vulnerabilities and exposures. Not every vulnerability is assigned a CVE ID, some vulnerabilities may not be reported to the CVE program by vendors, in some cases vulnerabilities may take months to appear in the CVE database, and the CVE database may not reflect the latest threats immediately.

10. What is a CVE Entry?

A CVE entry is a standardized record in the CVE (Common Vulnerabilities and Exposures) database that identifies a specific, publicly disclosed security vulnerability in software or hardware. Each entry has a unique identifier that includes basic information such as a brief description of the vulnerability, the impacted products or versions, and potential impacts (e.g., unauthorized access or data exposure). The entry may also link to additional details, advisories, and patches from vendors.