3.4Security technology evaluation

Rather than judging vulnerabilities or security functionality by a vague sense of "risky" or "safe," quantifying and grading them on a common scale enables comparison and prioritization across organizations. This section covers CVSS, which evaluates vulnerability severity, its related identifiers and classification schemes, and the Common Criteria, which evaluates the assurance level of security functionality itself. As a specialist, you are tested on your ability to interpret an evaluation result (a score or grade) and translate it into a practical response priority.

3.4.1CVSS (Base, Temporal, Environmental metrics)

• CVSS (Common Vulnerability Scoring System) is a common standard that expresses vulnerability severity as a score from 0.0 to 10.0. The Base Metrics are computed from factors intrinsic to the vulnerability itself that rarely change over time—attack vector, attack complexity, required privilege level, and impact on confidentiality/integrity/availability.
• The Temporal Metrics adjust the base score by factoring in elements that change over time—the availability of exploit code, whether a fix (patch) exists, and the confidence in the vulnerability report. As exploit code becomes public and exploitation spreads, the temporal score rises.
• The Environmental Metrics reflect circumstances specific to the organization's own environment—how important the asset with the vulnerability is, whether other controls already mitigate it, and so on—to determine the final priority. Even for the same vulnerability, factoring in the environmental score can make the urgency of response differ from one organization to another.

3.4.2CVE, CWE, and JVN

• CVE (Common Vulnerabilities and Exposures) assigns a unique identifier number to each individual vulnerability (e.g., CVE-2024-xxxxx). It functions as a shared vocabulary that makes clear, across different organizations, tools, and reports, that "this refers to the same vulnerability."
• CWE (Common Weakness Enumeration) is a shared dictionary that classifies not individual vulnerabilities but the "types" of vulnerability (categories of weakness), such as SQL injection or buffer overflow. Where a CVE points to "a specific hole in this version of this product," a CWE indicates "what general category of weakness that hole falls under."
• JVN (Japan Vulnerability Notes) is a portal jointly operated by JPCERT/CC and IPA that aggregates and publishes vulnerability countermeasure information for products used in Japan. It lets users check countermeasure information in Japanese alongside the CVE number and severity (CVSS).

Suppose a security officer receives a vulnerability advisory with a CVSS Base score of 9.8 ("Critical") for a web application framework the company uses. Looking at the base score alone might tempt one to conclude "respond immediately as the top priority," but as a specialist, an interpretation that also factors in the Temporal and Environmental metrics is needed here. Checking the Temporal metrics first, suppose no proof-of-concept exploit code has been published yet, and the vendor has not yet released an official patch—since exploit code is not yet circulating, the temporal score drops slightly below the base score, though the lack of a patch is not itself a reason to lower urgency. Next, consider the Environmental metrics. Suppose the affected functionality (a file-upload feature) is, in this company's system, used only on an internal admin screen that is not accessible from outside, and a WAF is already configured to detect and block that class of attack pattern. In this case, even though the base score reads "Critical," factoring in the environmental score reveals that the actual path for exploiting this vulnerability is limited, allowing the response to settle on a realistic priority—"re-verify the WAF rules and apply the patch at the next scheduled maintenance window"—rather than "emergency shutdown of every system company-wide today." Conversely, if the same vulnerability existed in an internet-facing payment form, the environmental score would instead push severity upward, requiring an immediate response. The practical judgment is thus to decide the final response priority in light of one's own environment, not the base score alone.

3.4.3Common Criteria, penetration testing, and tamper resistance

• ISO/IEC 15408 (Common Criteria) is an international standard for third-party evaluation and certification of the security functionality of IT products and systems. The rigor and depth of the evaluation is expressed in stages as the EAL (Evaluation Assurance Level, EAL1 through EAL7); a higher number means a more rigorous evaluation process (note that it does not certify how strong the functionality itself is).
• JISEC (IT Security Evaluation and Certification Scheme) is Japan's domestic scheme for evaluation and certification based on ISO/IEC 15408. Government procurement, for example, sometimes requires products that satisfy a certain EAL.
• Penetration testing simulates the techniques of an actual attacker to attempt intrusion into a system, verifying whether exploitable vulnerabilities actually exist. Where vulnerability assessment focuses on comprehensively enumerating known vulnerabilities, penetration testing emphasizes proving an attack scenario—whether a specific goal (such as exfiltrating sensitive information) can be achieved.
• Tamper resistance describes the strength with which hardware such as an IC card or a security module protects internal secrets (key material, etc.) against physical analysis and modification. The higher the tamper resistance, the more resilient the device is to attacks that pry it open to read out internal keys.

3.4.4Section summary

• CVSS determines the final response priority through three stages: Base (unchanging) -> Temporal (changes over time) -> Environmental (own circumstances)
• CVE = an identifier for an individual vulnerability, CWE = a classification of vulnerability types, JVN = Japan's vulnerability countermeasure information portal
• EAL measures the rigor of the evaluation process (not the strength of functionality). Penetration testing proves an attack scenario, and tamper resistance is resistance to physical analysis