In more details, the ADC first connects to each host configured by the system administrator. This is done via SSH or WinRM. The system administrator is advised to configure a dedicated ADC user for each host with the minimal access required by the ADC. The ADC then uses the SSH or WinRM connection to extract the host’s OS and software versions as well as the active services. The software extraction is OS-specific but often involves the use of a software package manager such as the dpkg or the RPM package managers.

Once the raw software version indicators are extracted, these indicators are processed and compared with the Common Vulnerabilities and Exposures (CVE) of the National Vulnerability Database (NVD). The ADC also labels imperfect matches meaning that its verbosity can be adjusted. Increasing the verbosity of the vulnerability matching, of course, comes with an increased risk of false positives.

The detected vulnerabilities are then enriched with information from the threat intelligence database information. Using the Exploit Code Maturity (E) obtained via the threat intelligence database and the Common Vulnerability Scoring System (CVSS) metrics obtained from the NVD, the ADC component assigns each vulnerability an updated CVSS score. Once the vulnerability has been assigned a score, DVAL provides the security administrators with vulnerability alerts empowering them to take actions to either acquire more information on the identified vulnerabilities, or to isolate the vulnerable system(s) until a security mechanism is applied.

DVAL’s ADC component will be validated in the context of the CYRENE pilots. With the pilot trails starting soon, please stay tuned for updates and lessons learned!