From c5724f70a8e8e94bd7e426ff71fe22a85b3750fc Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 10 Oct 2025 20:25:46 +0000 Subject: [PATCH 01/16] Initial plan From cbebd9ec5e3a91842a7141b7fecb7399b5ad797e Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 10 Oct 2025 20:31:13 +0000 Subject: [PATCH 02/16] Initial plan From 26c56967691ba79615115958b2b7da73c401fb3e Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 10 Oct 2025 20:31:24 +0000 Subject: [PATCH 03/16] Refactor default exploitation values to includable file Co-authored-by: ahouseholder <2594236+ahouseholder@users.noreply.github.com> --- docs/_includes/default_exploitation_values.md | 4 ++++ docs/howto/bootstrap/collect.md | 5 +---- docs/howto/gathering_info/exploitation.md | 2 ++ docs/reference/decision_points/exploitation.md | 2 ++ 4 files changed, 9 insertions(+), 4 deletions(-) create mode 100644 docs/_includes/default_exploitation_values.md diff --git a/docs/_includes/default_exploitation_values.md b/docs/_includes/default_exploitation_values.md new file mode 100644 index 00000000..cdecbd66 --- /dev/null +++ b/docs/_includes/default_exploitation_values.md @@ -0,0 +1,4 @@ +!!! tip "Default Exploitation Values" + + [*Exploitation*](../reference/decision_points/exploitation.md) needs no special default; if adequate searches are made for exploit code and none is + found, the answer is [*none*](../reference/decision_points/exploitation.md). diff --git a/docs/howto/bootstrap/collect.md b/docs/howto/bootstrap/collect.md index cc28d073..f7cb6be2 100644 --- a/docs/howto/bootstrap/collect.md +++ b/docs/howto/bootstrap/collect.md @@ -94,10 +94,7 @@ deployer may want to use that information to favor the latter. In the case where no information is available or the organization has not yet matured its initial situational analysis, we can suggest something like defaults for some decision points. -!!! tip "Default Exploitation Values" - - [*Exploitation*](../../reference/decision_points/exploitation.md) needs no special default; if adequate searches are made for exploit code and none is - found, the answer is [*none*](../../reference/decision_points/exploitation.md). +{% include-markdown "../../_includes/default_exploitation_values.md" %} !!! tip "Default System Exposure Values" diff --git a/docs/howto/gathering_info/exploitation.md b/docs/howto/gathering_info/exploitation.md index 9b391a52..7196f0f5 100644 --- a/docs/howto/gathering_info/exploitation.md +++ b/docs/howto/gathering_info/exploitation.md @@ -7,6 +7,8 @@ from ssvc.doc_helpers import example_block print(example_block(LATEST)) ``` +{% include-markdown "../../_includes/default_exploitation_values.md" %} + ## Public PoC [Historical Analysis of Exploit Availability Timelines](https://dl.acm.org/doi/10.5555/3485754.3485760) presents a method for searching the GitHub repositories of open-source exploit databases. This method could be employed to gather information about whether *PoC* is true. diff --git a/docs/reference/decision_points/exploitation.md b/docs/reference/decision_points/exploitation.md index d2c0be4d..793a0232 100644 --- a/docs/reference/decision_points/exploitation.md +++ b/docs/reference/decision_points/exploitation.md @@ -11,6 +11,8 @@ print(example_block(LATEST)) See this [HowTo](../../howto/gathering_info/exploitation.md) for advice on gathering information about the Exploitation decision point. +{% include-markdown "../../_includes/default_exploitation_values.md" %} + The intent of this measure is the present state of exploitation of the vulnerability. The intent is not to predict future exploitation but only to acknowledge the current state of affairs. Predictive systems, such as EPSS, could be used to augment this decision or to notify stakeholders of likely changes [@jacobs2021epss]. ## CWE-IDs for *PoC* From eab18e4150b9fe93e24b5f118f58b44f91a1b52d Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 10 Oct 2025 20:31:41 +0000 Subject: [PATCH 04/16] Initial plan From 6ea27263b3f58306d7c3db2dcc44a66de96bb718 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 10 Oct 2025 20:32:10 +0000 Subject: [PATCH 05/16] Initial plan From c8141657cc1dade4de62b4b887300964df0550fc Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 10 Oct 2025 20:39:23 +0000 Subject: [PATCH 06/16] Refactor Default System Exposure Values into an includable Co-authored-by: ahouseholder <2594236+ahouseholder@users.noreply.github.com> --- docs/_includes/default_system_exposure_values.md | 5 +++++ docs/howto/bootstrap/collect.md | 6 +----- docs/howto/gathering_info/system_exposure.md | 2 ++ docs/reference/decision_points/system_exposure.md | 2 ++ 4 files changed, 10 insertions(+), 5 deletions(-) create mode 100644 docs/_includes/default_system_exposure_values.md diff --git a/docs/_includes/default_system_exposure_values.md b/docs/_includes/default_system_exposure_values.md new file mode 100644 index 00000000..248419c7 --- /dev/null +++ b/docs/_includes/default_system_exposure_values.md @@ -0,0 +1,5 @@ +!!! tip "Default System Exposure Values" + + If the deployer does not know their exposure, that + means they do not know where the devices are or how they are controlled, so they should assume + [*System Exposure*](../reference/decision_points/system_exposure.md) is [*open*](../reference/decision_points/system_exposure.md). diff --git a/docs/howto/bootstrap/collect.md b/docs/howto/bootstrap/collect.md index cc28d073..ed84ddbc 100644 --- a/docs/howto/bootstrap/collect.md +++ b/docs/howto/bootstrap/collect.md @@ -99,11 +99,7 @@ we can suggest something like defaults for some decision points. [*Exploitation*](../../reference/decision_points/exploitation.md) needs no special default; if adequate searches are made for exploit code and none is found, the answer is [*none*](../../reference/decision_points/exploitation.md). -!!! tip "Default System Exposure Values" - - If the deployer does not know their exposure, that - means they do not know where the devices are or how they are controlled, so they should assume - [*System Exposure*](../../reference/decision_points/system_exposure.md) is [*open*](../../reference/decision_points/system_exposure.md). +{% include-markdown "../../_includes/default_system_exposure_values.md" %} !!! tip "Default Automatable Values" diff --git a/docs/howto/gathering_info/system_exposure.md b/docs/howto/gathering_info/system_exposure.md index baf7a76c..ebc8f935 100644 --- a/docs/howto/gathering_info/system_exposure.md +++ b/docs/howto/gathering_info/system_exposure.md @@ -7,6 +7,8 @@ from ssvc.doc_helpers import example_block print(example_block(LATEST)) ``` +{% include-markdown "../../_includes/default_system_exposure_values.md" %} + *System Exposure* is primarily used by [Deployers](../../deployer_tree), so the question is about whether some specific system is in fact exposed, not a hypothetical or aggregate question about systems of that type. Therefore, it generally has a concrete answer, even though it may vary from vulnerable component to vulnerable component, based on their respective configurations. diff --git a/docs/reference/decision_points/system_exposure.md b/docs/reference/decision_points/system_exposure.md index 32742d87..7fcd75d2 100644 --- a/docs/reference/decision_points/system_exposure.md +++ b/docs/reference/decision_points/system_exposure.md @@ -11,6 +11,8 @@ print(example_block(LATEST)) See this [HowTo](../../howto/gathering_info/system_exposure.md) for advice on gathering information about the System Exposure decision point. +{% include-markdown "../../_includes/default_system_exposure_values.md" %} + Measuring the attack surface precisely is difficult, and we do not propose to perfectly delineate between small and controlled access. Exposure should be judged against the system in its deployed context, which may differ from how it is commonly expected to be deployed. For example, the exposure of a device on a vehicle's CAN bus will vary depending on the presence of a cellular telemetry device on the same bus. From 0234feffe1a30493b833063115140953004c782f Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 10 Oct 2025 20:39:46 +0000 Subject: [PATCH 07/16] Refactor default mission impact values into reusable include file Co-authored-by: ahouseholder <2594236+ahouseholder@users.noreply.github.com> --- docs/_includes/default_mission_impact_values.md | 5 +++++ docs/howto/bootstrap/collect.md | 6 +----- docs/howto/gathering_info/mission_impact.md | 2 ++ docs/reference/decision_points/mission_impact.md | 2 ++ 4 files changed, 10 insertions(+), 5 deletions(-) create mode 100644 docs/_includes/default_mission_impact_values.md diff --git a/docs/_includes/default_mission_impact_values.md b/docs/_includes/default_mission_impact_values.md new file mode 100644 index 00000000..75fbba1b --- /dev/null +++ b/docs/_includes/default_mission_impact_values.md @@ -0,0 +1,5 @@ +!!! tip "Default Mission Impact Values" + + Similarly, with [*Mission Impact*](/reference/decision_points/mission_impact.md), the deployer should assume that the software is in use at the + organization for a reason, and that it supports essential functions unless they have evidence otherwise. + With a total lack of information, assume [*support crippled*](/reference/decision_points/mission_impact.md) as a default. diff --git a/docs/howto/bootstrap/collect.md b/docs/howto/bootstrap/collect.md index cc28d073..bdd8a10e 100644 --- a/docs/howto/bootstrap/collect.md +++ b/docs/howto/bootstrap/collect.md @@ -118,11 +118,7 @@ we can suggest something like defaults for some decision points. This position is conservative, but software is thoroughly embedded in daily life now, so we suggest that the decision maker provide evidence that no one’s well-being will suffer. -!!! tip "Default Mission Impact Values" - - Similarly, with [*Mission Impact*](../../reference/decision_points/mission_impact.md), the deployer should assume that the software is in use at the - organization for a reason, and that it supports essential functions unless they have evidence otherwise. - With a total lack of information, assume [*support crippled*](../../reference/decision_points/mission_impact.md) as a default. +{% include-markdown "../../_includes/default_mission_impact_values.md" %} !!! example "Using Defaults" diff --git a/docs/howto/gathering_info/mission_impact.md b/docs/howto/gathering_info/mission_impact.md index 13936a51..1a70b5dd 100644 --- a/docs/howto/gathering_info/mission_impact.md +++ b/docs/howto/gathering_info/mission_impact.md @@ -12,3 +12,5 @@ At a minimum, understanding mission impact should include gathering information There are various sources of guidance on how to gather this information; see for example the FEMA guidance in [Continuity Directive 2](https://www.fema.gov/sites/default/files/2020-07/Federal_Continuity_Directive-2_June132017.pdf) or [OCTAVE FORTE](https://insights.sei.cmu.edu/insider-threat/2018/06/octave-forte-and-fair-connect-cyber-risk-practitioners-with-the-boardroom.html). This is part of risk management more broadly. It should require the vulnerability management team to interact with more senior management to understand mission priorities and other aspects of risk mitigation. + +{% include-markdown "../../_includes/default_mission_impact_values.md" %} diff --git a/docs/reference/decision_points/mission_impact.md b/docs/reference/decision_points/mission_impact.md index 85b234e4..a480c300 100644 --- a/docs/reference/decision_points/mission_impact.md +++ b/docs/reference/decision_points/mission_impact.md @@ -11,6 +11,8 @@ print(example_block(LATEST)) See this [HowTo](../../howto/gathering_info/mission_impact.md) for advice on gathering information about the Mission Impact decision point. +{% include-markdown "../../_includes/default_mission_impact_values.md" %} + !!! tip "See also" Mission Impact combines with [Safety Impact](./safety_impact.md) to inform From f9314339f6ea694090617231cf33b6d91e86ef42 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 10 Oct 2025 20:43:58 +0000 Subject: [PATCH 08/16] Refactor default safety values tip into includable file Co-authored-by: ahouseholder <2594236+ahouseholder@users.noreply.github.com> --- docs/_includes/default_safety_values.md | 6 ++++++ docs/howto/bootstrap/collect.md | 7 +------ docs/reference/decision_points/safety_impact.md | 4 ++++ 3 files changed, 11 insertions(+), 6 deletions(-) create mode 100644 docs/_includes/default_safety_values.md diff --git a/docs/_includes/default_safety_values.md b/docs/_includes/default_safety_values.md new file mode 100644 index 00000000..1e1404ca --- /dev/null +++ b/docs/_includes/default_safety_values.md @@ -0,0 +1,6 @@ +!!! tip "Default Safety Values" + + If the decision maker knows nothing about the environment in which the device is used, we suggest assuming a + [*marginal*](../reference/decision_points/safety_impact.md) [*Safety Impact*](../reference/decision_points/safety_impact.md). + This position is conservative, but software is thoroughly embedded in daily life now, so we suggest that the decision + maker provide evidence that no one's well-being will suffer. diff --git a/docs/howto/bootstrap/collect.md b/docs/howto/bootstrap/collect.md index cc28d073..9691ce95 100644 --- a/docs/howto/bootstrap/collect.md +++ b/docs/howto/bootstrap/collect.md @@ -111,12 +111,7 @@ we can suggest something like defaults for some decision points. [*Value Density*](../../reference/decision_points/value_density.md) should always be answerable; if the product is uncommon, it is probably [*diffuse*](../../reference/decision_points/value_density.md). -!!! tip "Default Safety Values" - - If the decision maker knows nothing about the environment in which the device is used, we suggest assuming a - [*marginal*](../../reference/decision_points/safety_impact.md) [*Safety Impact*](../../reference/decision_points/safety_impact.md). - This position is conservative, but software is thoroughly embedded in daily life now, so we suggest that the decision - maker provide evidence that no one’s well-being will suffer. +{% include-markdown "../../_includes/default_safety_values.md" %} !!! tip "Default Mission Impact Values" diff --git a/docs/reference/decision_points/safety_impact.md b/docs/reference/decision_points/safety_impact.md index 128275ba..047abd05 100644 --- a/docs/reference/decision_points/safety_impact.md +++ b/docs/reference/decision_points/safety_impact.md @@ -14,6 +14,8 @@ print(example_block(LATEST)) - Safety Impact combines with [Mission Impact](./mission_impact.md) to inform [Human Impact](./human_impact.md). +{% include-markdown "../../_includes/default_safety_values.md" %} + We take an expansive view of safety, in which a safety violation is a violation of what the United States [Centers for Disease Control (CDC)](https://www.cdc.gov/hrqol/wellbeing.htm) calls **well-being**. Physical well-being violations are common safety violations, but we also consider economic, social, emotional, and psychological well-being to be important. Weighing fine differences among these categories is probably not possible, so we will not try. Each decision option lists examples of the effects that qualify for that value/answer in the various types of violations of well-being. These examples should not be considered comprehensive or exhaustive, but rather as suggestive.