4.2Threat intelligence

Once you find a vulnerability, the next thing you need to know is "how serious is it in the wider world, and how should it be handled." If people describe the same weakness by different names, conversation breaks down. Here CVE, which gives known weaknesses a common name, and CVSS, which scores their severity on a common scale, help. This section covers the uses and limits of a vulnerability database that stores these, plus information sources—vendor security reports, news, subscription services, and community crowdsourced intelligence—and how to gather and use them as material for judging "which threats deserve attention right now."

4.2.1CVE, CVSS, and vulnerability databases

• CVE (Common Vulnerabilities and Exposures) is a common identifier assigned to each publicly disclosed vulnerability (e.g., CVE-2021-44228). Because everyone worldwide references the same weakness by the same number, it becomes easy to cross-check vendor, news, and scanner information. A CVE is a "name (identifier)," not the severity itself.
• CVSS (Common Vulnerability Scoring System) is a common scoring method expressing severity as a number from 0.0 to 10.0. It roughly maps to low/medium/high/critical bands and is used to prioritize which to fix first. Remembering "CVE is the name, CVSS is the score" avoids confusing them.
• Vulnerability databases (such as the NVD) are ledgers compiling CVEs, CVSS scores, affected products/versions, and remedies. Their use is to quickly check "is this weakness known, how severe is it, and is there a patch." Their limit: not-yet-registered unknown (zero-day) flaws do not appear, and entries can be stale or incomplete. A database is a starting point, not a cure-all.

4.2.2Sources of threat intelligence

• Security reports/news are advisories and research reports from vendors and security agencies, plus industry news. They hint at new attack techniques and vulnerabilities under active exploitation. Reliability depends on the source, so prioritize primary sources (official vendor advisories).
• Subscription services (threat feeds) are paid or free services that continuously deliver the latest threat information. Crowdsourced intelligence is observation data contributed by many organizations and researchers, revealing a spread invisible to any single party. In contrast to ad hoc manual collection, feeds and automated integration ingest information continuously and automatically.

One morning the news reports that "a serious vulnerability has been found in a widely used library, and exploitation has already begun." Before rushing to act, being able to make a calm, threat-intelligence-based judgment is a strength. First, from the news or the vendor's security report, you grab the vulnerability's CVE identifier (a unique number like CVE-2021-44228). Using that number to query a vulnerability database tells you the affected products and versions and the CVSS score. If the CVSS is high (the critical band), you can judge that assets using the affected version should be addressed with top priority. Here it is essential not to swap the roles of CVE and CVSS: a CVE is merely the name pointing to "which vulnerability," while CVSS is the score showing "how serious." The name alone does not set priority, and the score alone does not identify the target. Next, be mindful that database information is only a starting point. A vulnerability database does not list not-yet-registered unknown vulnerabilities (zero-days), and information can be incomplete right after disclosure. That is exactly why you continuously supplement it with a subscription service's threat feed and community crowdsourced intelligence on the latest exploitation, adjusting priority up or down by factoring in "how much it is actually being attacked right now." At the introductory stage, the posture of cross-checking sources rather than relying on one and accurately distinguishing CVE (the name) from CVSS (the score) becomes the foundation for measured, right-sized response decisions.

4.2.3Section summary

• CVE is a common identifier (name) for a vulnerability; CVSS is a 0.0-10.0 severity score—do not swap their roles
• A vulnerability database is used to look up known weaknesses/severity/patches; its limit is that unknown (zero-day) flaws are absent and entries can be stale
• Cross-check reports, news, subscription services, and crowdsourced intelligence, adjusting priority by actual exploitation