Characteristics of Threats and Vulnerabilities

Exam objective 2.1: Explain characteristics of threats and vulnerabilities.

This objective introduces the vocabulary that the rest of Domain 2.0 builds on. On the threat side, it covers threat feeds, likelihood, impact, intelligence sources, and the intelligence life cycle. On the vulnerability side, it covers how vulnerabilities are scored with the Common Vulnerability Scoring System (CVSS), how they are prioritized, the broad types of vulnerabilities, and how the Common Vulnerabilities and Exposures (CVE) program gives each publicly known flaw a unique identifier. This is an "explain" objective, so expect questions that ask you to interpret rather than simply recall. You should be able to read a CVSS vector string and say what it means, explain why a medium-severity vulnerability might be fixed before a critical one, pick the right intelligence source for a need, and place an activity in the correct phase of the intelligence life cycle. Chapter 16 (vulnerability management) and Chapter 23 (risk management) apply these ideas operationally, so the foundation laid here pays off later.

Threats, Vulnerabilities, and Risk

Three terms are used constantly in this domain, and the exam expects you to keep them distinct.

• A threat is any circumstance or actor with the potential to cause harm to an asset. Threats include attackers, malware, natural disasters, hardware failures, and well-meaning employees who make mistakes. A threat actor is the person or group behind a deliberate threat (Chapter 5), and a threat vector is the path the threat uses to reach its target (Chapter 6).
• A vulnerability is a weakness that a threat can exploit: an unpatched service, a misconfigured storage bucket, a weak password policy, an unlocked door, or a poorly trained workforce.
• Risk is the possibility that a threat will exploit a vulnerability and cause harm. It is commonly expressed as a function of likelihood and impact.

An exploit is the code or technique that takes advantage of a vulnerability. Risk exists only where threats and vulnerabilities intersect; its size depends on how likely that intersection is and how bad the outcome would be.

Figure 4.1: Risk exists where a threat meets a vulnerability, and its size depends on likelihood and impact

Memory aid

Threat is the who or what that can cause harm. Vulnerability is the weakness. Exploit is the tool or technique. Risk is the chance and cost of the harm happening. A burglar is a threat, an unlocked window is a vulnerability, climbing through the window is the exploit, and the expected loss of your television is the risk.

Characteristics of Threats

Likelihood

Likelihood (or probability) is how probable it is that a threat will act against a vulnerability within a given period. Likelihood is shaped by several factors:

• Threat actor capability and intent. A nation-state group with custom tooling targeting your industry raises likelihood; an unskilled attacker with no reason to target you lowers it.
• Exposure. A vulnerable service reachable from the internet is far more likely to be attacked than the same service on an isolated management network.
• Exploit availability. A vulnerability with a public proof-of-concept or a module in a common attack framework is much more likely to be exploited than one with no known exploit.
• Observed activity. If threat intelligence shows active exploitation in the wild, likelihood is high regardless of what any static score says.
• Existing controls. Compensating controls, segmentation, and monitoring reduce likelihood.
• Historical data. How often similar events have occurred to you or to peers—in quantitative analysis, the annualized rate of occurrence (ARO) (Chapter 23).

Impact

Impact is the magnitude of harm if the threat succeeds. Impact can be financial (lost revenue, recovery costs, fines, ransom), operational (downtime, lost productivity), reputational (lost customer trust), legal and regulatory (notification duties, sanctions, lawsuits), safety-related (injury or loss of life, especially with operational technology and medical devices), or measured against the data itself using the CIA triad from Chapter 1.

In quantitative analysis, impact becomes the single loss expectancy (SLE), and combining SLE with ARO yields the annualized loss expectancy (ALE). Those formulas belong to objective 5.2 and are covered in Chapter 23.

Combining Likelihood and Impact

The classic qualitative tool is a risk matrix (heat map), which plots likelihood on one axis and impact on the other. Each cell carries a rating that drives priority.

• Likelihood / Impact Low impact Medium impact High impact
• High likelihood Medium High Critical
• Medium likelihood Low Medium High
• Low likelihood Low Low Medium

Exam tip

When a question asks which risk to address first, combine both factors. A highly likely event with trivial impact (spam reaching inboxes) may rank below a less likely event with severe impact (ransomware on the payment system). Questions often present one option that is high on only one dimension as a distractor.

Threat Intelligence

Threat intelligence is evidence-based knowledge about existing or emerging threats—who is attacking, how, with what tools, and against which targets—that has been analyzed so that defenders can make better decisions. Raw data (an IP address) becomes intelligence when it is analyzed and placed in context ("this IP address is command-and-control infrastructure for a ransomware affiliate targeting regional hospitals").

Intelligence is often described at three levels:

Level Audience Content Example

Strategic Executives, board Trends, actor motivations, business risk

• "Ransomware against manufacturers rose sharply
• this year"
• Operation
• al

Security managers, IR leads

Campaigns, actor TTPs, timing

"Group X is phishing finance staff with fake invoice themes"

Tactical SOC analysts, tools Indicators of compromise File hashes, IP addresses, domains, URLs Another useful distinction is between indicators of compromise (IoCs), which are specific artifacts such as hashes and IP addresses, and tactics, techniques, and procedures (TTPs), which describe adversary behavior. IoCs are easy for attackers to change; TTPs are not. The Pyramid of Pain ranks hash values at the bottom (trivial to change), then IP addresses, domains, network and host artifacts, tools, and TTPs at the top (painful to change). Behavior-based detections mapped to MITRE ATT&CK therefore last longer than indicator-based ones.

Figure 4.2: The Pyramid of Pain ranks indicators from trivial for an attacker to change at the bottom to painful at the top Intelligence Sources

The objectives list intelligence sources as a characteristic of threats. Sources vary in cost, timeliness, reliability, and relevance.

Open-Source Intelligence (OSINT)

OSINT is intelligence gathered from publicly available sources: news reports, vendor blogs, security researcher posts, social media, public code repositories, government advisories, paste sites, DNS and WHOIS records, and certificate transparency logs. OSINT is free and abundant but requires effort to filter noise and verify accuracy. Attackers use it too, for reconnaissance.

Proprietary and Closed-Source Intelligence

Proprietary (commercial or closed-source) intelligence comes from vendors that collect telemetry from their customer base, run research teams, and sell curated feeds and reports. Commercial intelligence is usually better vetted, enriched with context, and more timely, but it costs money and its methods may be opaque.

Government Sources

National agencies publish advisories, indicators, and alerts. In the United States, the Cybersecurity and Infrastructure Security Agency (CISA) publishes advisories and maintains the Known Exploited Vulnerabilities (KEV) catalog. CISA's Automated Indicator Sharing (AIS) program distributes machine-readable indicators between government and private participants. Other countries have equivalent national CERTs or cyber centers.

Information Sharing and Analysis Centers (ISACs)

ISACs are sector-based organizations—for example, the Financial Services ISAC (FS-ISAC), the Health ISAC, and the Multi-State ISAC (MS-ISAC) for state and local government—through which members share threat information relevant to their industry. Because members face similar adversaries, ISAC intelligence is highly relevant. Information Sharing and Analysis Organizations (ISAOs) serve a similar purpose for groups not organized by sector.

Internal Sources

An organization's own logs, SIEM alerts, EDR telemetry, incident reports, and honeypots are intelligence sources too, uniquely relevant because they describe attacks against your environment.

Dark Web Monitoring

The dark web consists of sites reachable only through anonymizing networks such as Tor. Criminal forums and marketplaces there trade stolen credentials, access to compromised networks, and exploit kits. Monitoring it, usually through a commercial service, can reveal that your credentials or customer data are for sale—an early warning of a breach.

OSINT does not mean "low quality," and commercial does not mean "always right." The exam tests matching the source to the need: sector-specific peer sharing points to an ISAC; free and public points to OSINT; curated feeds sold by a vendor point to proprietary; stolen credentials offered for sale point to dark web monitoring.

Threat Feeds

A threat feed is a continuous, usually machine-readable stream of threat data—IoCs such as malicious IP addresses, domains, URLs, and file hashes, often with context such as confidence, first-seen dates, and associated malware families. Feeds are consumed by SIEMs, firewalls, secure web gateways, EDR platforms, and threat intelligence platforms (TIPs) that aggregate, deduplicate, score, and distribute indicators.

Feeds may be open, commercial, government (AIS), or sector-based (ISAC). Two standards make them interoperable:

• STIX (Structured Threat Information eXpression) is a language and serialization format (JSON in STIX 2.x) for describing threat intelligence. STIX defines objects such as indicators, malware, threat actors, campaigns, attack patterns, vulnerabilities, and relationships between them.
• TAXII (Trusted Automated eXchange of Intelligence Information) is the transport protocol for sharing STIX data over HTTPS. TAXII defines collections (a client requests indicators from a server) and channels (publish-subscribe sharing).

Indicators age quickly—an IP address used by an attacker last month may belong to a legitimate cloud customer today—so analysts evaluate feeds by timeliness, accuracy, relevance, and confidence.

Memory aid

STIX is the what (the structured description); TAXII is the how (the transport). "STIX describes, TAXII delivers."

The Intelligence Life Cycle

Threat intelligence is produced through a repeating life cycle. Variations exist, but the common form has six phases:

• 1. Requirements (planning and direction). Leadership and consumers define what questions intelligence must answer, such as "Which actors target our sector?" or "Which vulnerabilities in our stack are being exploited?" Requirements keep the program focused.
• 2. Collection. Data is gathered from the sources described above: feeds, OSINT, logs, ISACs, and vendors.
• 3. Processing. Raw data is normalized, deduplicated, translated, decrypted, and loaded into a usable format, such as a TIP.
• 4. Analysis. Analysts evaluate the processed data, correlate it, assess reliability, and draw conclusions that answer the requirements.
• 5. Dissemination. Intelligence is delivered to consumers in the right form: executive briefings for strategic needs, block lists and detection rules for tactical needs.
• 6. Feedback. Consumers report whether the intelligence was useful, timely, and accurate, which refines the requirements for the next cycle.

Figure 4.3: The six phases of the threat intelligence life cycle, with feedback driving the next round of requirements

A hospital's security team receives thousands of indicators per day from four feeds, but analysts rarely act on them. The team realizes it skipped the requirements phase: nobody defined what the hospital needs to know. It sets requirements around ransomware actors targeting healthcare and vulnerabilities in its EHR and medical device platforms, drops two irrelevant feeds, joins the Health ISAC, and has SOC analysts rate each disseminated report (feedback). The intelligence becomes smaller, more relevant, and actually used.

Other life cycles exist: vulnerabilities move from discovery through disclosure, CVE assignment, patch release, and deployment, and attacks follow models such as the Cyber Kill Chain (reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives), covered with the Diamond Model in Chapter 26. If a question asks about the life cycle of intelligence, use the six phases above.

Characteristics of Vulnerabilities

Vulnerability Types

Vulnerabilities can be grouped into broad types. Chapter 7 (objective 2.4) explores specific vulnerabilities and attack surfaces in depth; here you need the categories and how they are classified. Type Description Examples

Software and application

Flaws in code or logic Injection, buffer overflow, race conditions, broken authentication

Operating system

Flaws in the OS kernel, services, or drivers Privilege escalation bugs, unpatched services Hardware and firmware

Flaws in physical components or low-level code

Speculative execution flaws, BIOS/UEFI bugs, end-of-life devices

Configuratio

n

Insecure settings rather than defective code

Default credentials, open storage buckets, unnecessary ports and services

Cryptograph

ic

Weak algorithms, poor key management, bad implementations

MD5 or SHA-1 for signatures, hardcoded keys, expired certificates

Network Weaknesses in protocols or architecture Cleartext protocols, flat networks, weak wireless security Supply chain Weaknesses introduced by vendors or components

Vulnerable open-source libraries, malicious updates

Human and process

Weaknesses in people or procedures Susceptibility to phishing, missing change control Physical Weaknesses in facilities Propped-open doors, unmonitored entrances Type Description Examples

Zero-day A flaw unknown to the vendor or with no patch available

Newly discovered exploits used in the wild

The Common Weakness Enumeration (CWE), maintained by MITRE, catalogs types of software and hardware weaknesses—CWE-79 is cross-site scripting, CWE-89 is SQL injection, CWE-787 is out-of-bounds write. CWE describes the class of mistake; CVE identifies a specific instance in a specific product. MITRE publishes an annual list of the most dangerous CWE entries that is useful for secure coding training.

Note

A zero-day vulnerability is one for which the vendor has had zero days to produce a fix, usually because it was unknown to the vendor until it was exploited or disclosed. Once a patch exists, the flaw becomes an n-day: a known vulnerability that is dangerous mainly because organizations have not yet patched it. Most real-world breaches exploit n-days, not zero-days.

Common Vulnerabilities and Exposures (CVE)

CVE is a program that assigns a unique, standardized identifier to each publicly disclosed cybersecurity vulnerability. Before CVE, every vendor and scanner named vulnerabilities differently, making it hard to know whether two reports described the same flaw. A CVE identifier gives everyone a common reference.

Key facts:

• The CVE program is operated by MITRE with sponsorship from CISA.
• Identifiers use the format CVE-YYYY-NNNNN, where the year is the year the ID was assigned or the vulnerability made public, and the sequence number has four or more digits. For example, CVE-2021-44228 is the Log4Shell vulnerability in Apache Log4j.
• IDs are assigned by CVE Numbering Authorities (CNAs): vendors (Microsoft, Google, Cisco), researchers, CERTs, and bug bounty platforms authorized to assign IDs within their scope.
• A CVE Record contains the ID, a brief description, affected products and versions, and references such as vendor advisories. It does not itself guarantee a severity score.
• The National Vulnerability Database (NVD), run by NIST, enriches CVE Records with CVSS scores, CWE classifications, and Common Platform Enumeration (CPE) names that identify affected products in a machine-readable way. CNAs increasingly supply their own CVSS scores as well. Because scanners, patch tools, and advisories all reference CVE IDs, a scan finding can be correlated with a vendor patch and with intelligence about exploitation.

Keep the MITRE and NIST roles straight. MITRE operates CVE (the identifiers) and CWE (the weakness types). NIST operates the NVD (the enrichment database with CVSS scores). FIRST maintains the CVSS standard itself and EPSS.

Scoring with CVSS

The Common Vulnerability Scoring System (CVSS) is an open standard, maintained by the Forum of Incident Response and Security Teams (FIRST), for rating the severity of vulnerabilities on a scale from 0.0 to 10.0. CVSS produces both a numeric score and a vector string that records the value of every metric, so anyone can see why a vulnerability received its score. Two versions are in use: CVSS v3.1 (released 2019 and still widely published) and CVSS v4.0 (released November 2023 and increasingly adopted by CNAs and the NVD).

Qualitative Severity Ratings

Both v3.1 and v4.0 use the same qualitative severity scale. Memorize it.

CVSS v3.1 has three metric groups.

Base metrics describe the intrinsic characteristics of a vulnerability that do not change over time or between environments. The base score is what most advisories publish.

• Metric Abbreviati
• on
• Values Meaning

Attack Vector AV Network (N), Adjacent (A), Local (L), Physical (P)

How remote the attacker can be; Network is worst

Attack Complexity

AC Low (L), High (H) Conditions beyond the attacker's control needed to succeed

Privileges Required

PR None (N), Low (L), High (H) Privileges the attacker needs before exploiting Metric Abbreviati

on

Values Meaning

User Interaction

UI None (N), Required (R) Whether a user must take some action

Scope S Unchanged (U), Changed (C) Whether exploitation affects components beyond the vulnerable one

Confidentiality C High (H), Low (L), None (N) Impact on confidentiality Integrity I High (H), Low (L), None (N) Impact on integrity

Availability A High (H), Low (L), None (N) Impact on availability

The first four base metrics (AV, AC, PR, UI) are the exploitability metrics; C, I, and A are the impact metrics; Scope connects them. A scope change means a vulnerability in one component lets the attacker affect another security authority—for example, escaping from a virtual machine to the hypervisor or from a browser sandbox to the operating system.

Temporal metrics reflect characteristics that change over time:

• Exploit Code Maturity (E): Unproven, Proof-of-Concept, Functional, High, or Not Defined.
• Remediation Level (RL): Official Fix, Temporary Fix, Workaround, Unavailable, or Not Defined.
• Report Confidence (RC): Unknown, Reasonable, Confirmed, or Not Defined.

Temporal metrics can only lower the score from the base value (or leave it unchanged). Environmental metrics let an organization tailor the score to its own environment. They include Security Requirements (Confidentiality, Integrity, and Availability Requirements, each Low, Medium, or High) that weight the impact according to the asset's importance, and Modified Base metrics that let the organization override base values when its configuration changes the picture—for instance, setting Modified Attack Vector to Adjacent if the vulnerable service is not reachable from the internet. A v3.1 vector string looks like this:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base score 9.8 (Critical)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Base score 10.0 (Critical)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base score 7.8 (High)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base score 6.1 (Medium)

The first line reads: network, low complexity, no privileges, no user interaction, scope unchanged, high impact on C, I, and A—the profile of unauthenticated remote code execution. The third line is a typical local privilege escalation bug: the attacker needs a low-privileged account on the box first. The fourth is a typical reflected cross-site scripting flaw: the victim must click a link (UI:R), and the script runs in the browser, a different security scope (S:C).

CVSS v4.0 Metric Groups

CVSS v4.0 reorganizes and refines the standard. It has four metric groups.

• Base metrics remain intrinsic, but with important changes:
• Metric Abbreviati
• on
• Values Change from v3.1
• Attack Vector AV N, A, L, P Unchanged

Attack Complexity AC Low, High Narrowed to conditions such as needing to bypass built-in defenses (for example, ASLR)

Attack Requirements AT None (N), Present (P)

• New: deployment or execution conditions, such as winning a
• race condition or an on-path position
• Privileges Required PR N, L, H Unchanged
• User Interaction UI None (N), Passive
• (P), Active (A)

Now three values distinguishing passive from deliberate user actions

Vulnerable System impact

VC, VI, VA High, Low, None Impact on the vulnerable component itself

Subsequent System impact

SC, SI, SA High, Low, None Impact on other systems; replaces Scope

Scope has been removed. Instead of a yes-or-no scope flag, v4.0 scores impact separately for the vulnerable system and for subsequent systems, which captures the same idea with more precision. Threat metrics replace the v3.1 temporal group. The main metric is Exploit Maturity (E), with values Attacked (exploitation reported or attempted in the wild), POC (proof-of-concept code is public), Unreported (no known POC or exploitation), and Not Defined. Remediation Level and Report Confidence were dropped.

Environmental metrics work as before: Confidentiality, Integrity, and Availability Requirements (CR, IR, AR), plus modified base metrics.

Supplemental metrics are new. They convey extra context but do not change the numeric score. They include Safety (whether exploitation could cause physical harm), Automatable (whether an attacker could automate the kill chain steps at scale, as a worm would), Recovery, Value Density, Vulnerability Response Effort, and Provider Urgency.

CVSS v4.0 also introduces nomenclature that makes clear which groups contributed to a score: Label Metric groups included

• CVSS-B Base only
• CVSS-BT Base and Threat
• CVSS-BE Base and Environmental
• CVSS-BTE Base, Threat, and Environmental

A v4.0 vector for an unauthenticated network-exploitable flaw with full impact on the vulnerable system and none on subsequent systems looks like this:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS-B 9.3 (Critical)

Feature CVSS v3.1 CVSS v4.0

Metric groups Base, Temporal, Environmental

Base, Threat, Environmental, Supplemental

Scope metric Yes (Unchanged/Changed) Removed; replaced by vulnerable and subsequent system impacts

• Attack Requirements No Yes (AT)
• User Interaction values None, Required None, Passive, Active
• Time-varying group Temporal (E, RL, RC) Threat (Exploit Maturity only)

Non-scoring context None Supplemental (Safety, Automatable, and others)

Severity ranges None, Low, Medium, High, Critical

Same ranges

Naming "Base score" CVSS-B, CVSS-BT, CVSS-BE, CVSS-BTE

Common trap

CVSS measures severity, not risk. A base score says how bad a vulnerability is in the abstract; it knows nothing about whether the affected system holds your crown jewels, whether it faces the internet, or whether attackers are using the flaw today. FIRST itself says the base score alone should not be used as a risk score. Questions that ask how to tailor a score to an organization point to environmental metrics; questions about exploitation in the wild point to temporal or threat metrics.

Memory aid

v3.1 groups: Base, Temporal, Environmental (BTE). v4.0 groups: Base, Threat, Environmental, Supplemental—the "T" changed meaning from Temporal to Threat, and S was added but never changes the score.

Prioritization

Large environments carry thousands of open findings. Prioritization decides which to fix first so that limited time and staff reduce the most risk. Sorting purely by CVSS base score is a common and costly mistake: only a small fraction of published vulnerabilities are ever exploited, and many critical-scored flaws sit on systems that attackers cannot reach.

Effective prioritization considers several factors:

• Severity: the CVSS score, ideally with environmental and threat metrics applied.
• Exploitability in the wild: whether the vulnerability appears in the CISA KEV catalog, which lists vulnerabilities confirmed to be actively exploited. U.S. federal civilian agencies are required by Binding Operational Directive 22-01 to remediate KEV entries by set deadlines, and many private organizations adopt KEV as a top priority tier.
• Probability of exploitation: the Exploit Prediction Scoring System (EPSS), also from FIRST, uses data about exploitation activity to estimate the probability (0 to 1) that a vulnerability will be exploited in the next 30 days. A CVSS 9.8 with an EPSS of 0.001 may matter less than a CVSS 7.5 with an EPSS of 0.9.
• Asset criticality and data sensitivity: a vulnerability on a payment server or domain controller outranks the same vulnerability on a test kiosk.
• Exposure: internet-facing systems before internal ones; systems in flat networks before segmented ones.
• Compensating controls: a WAF rule, IPS signature, or segmentation that blocks exploitation lowers urgency (but does not remove the need to patch).
• Business and regulatory requirements: compliance frameworks such as PCI DSS set remediation timeframes.
• Remediation cost and risk: whether a patch requires a reboot, a maintenance window, or extensive regression testing (change management, Chapter 2).

CISA also promotes Stakeholder-Specific Vulnerability Categorization (SSVC), a decision tree that assigns an action (Track, Track*, Attend, or Act) from exploitation status, technical impact, automatability, and mission impact.

• Vulnerability CVSS base KEV EPSS Asset Priority
• RCE in VPN appliance 9.8 Yes 0.94 Internet-facing VPN Immediate
• Privilege escalation in OS 7.8 Yes 0.40 All workstations High

RCE in internal reporting tool 9.8 No 0.01 Isolated, segmented

Vlan

Scheduled

XSS in intranet wiki 6.1 No 0.02 Internal wiki Low

A retailer's weekly scan reports 4,200 open vulnerabilities, 310 of them rated critical. The team cannot patch everything before the holiday freeze. The security manager filters the list against the CISA KEV catalog and finds 12 entries, three of them on internet-facing systems. Those three—including a 9.8 on the remote access gateway—are patched within 48 hours. A 7.2-rated flaw in the point-of-sale software is next, because it is in KEV and the systems process cardholder data. Critical findings on lab systems with no network path from the internet are scheduled for the January window, with compensating segmentation verified in the meantime.

Exam tip

When a question asks what to remediate first, look for clues beyond the score: "actively exploited," "listed in KEV," "public exploit available," "internet-facing," or "processes sensitive data." The answer is usually the vulnerability with the strongest combination of exploitation evidence, exposure, and asset value—not simply the highest CVSS number.

Validating Findings

Prioritization assumes findings are real. Scanners produce false positives (reporting a vulnerability that does not exist, such as flagging a version string that has a backported patch) and false negatives (missing a real vulnerability, often because of an unauthenticated scan). False negatives are the more dangerous error because they create false confidence. Analysts validate high-priority findings with credentialed scans and configuration checks before committing resources; Chapter 16 covers verification in detail.

Note

Expect the terms in this chapter to reappear in scenario questions for other objectives. A Domain 4.0 vulnerability management question might hinge on knowing that environmental metrics tailor CVSS to the organization; a Domain 5.0 risk question might hinge on likelihood and impact.

Chapter Summary

• A threat can cause harm, a vulnerability is a weakness, an exploit takes advantage of the weakness, and risk combines likelihood and impact.
• Likelihood depends on actor capability and intent, exposure, exploit availability, observed exploitation, and existing controls. Impact can be financial, operational, reputational, legal, safety-related, or data-related.
• Threat intelligence may be strategic, operational, or tactical. IoCs are easy for attackers to change; TTPs are harder.
• Intelligence sources include OSINT, proprietary/commercial vendors, government (CISA, AIS, KEV), ISACs, internal telemetry, and dark web monitoring.
• Threat feeds deliver machine-readable indicators. STIX describes intelligence; TAXII transports it over HTTPS.
• The intelligence life cycle: requirements, collection, processing, analysis, dissemination, feedback.
• CVE assigns unique IDs (CVE-YYYY-NNNNN) through CNAs; MITRE operates it, and NIST's NVD enriches records with CVSS, CWE, and CPE. CWE catalogs weakness types.
• CVSS v3.1 groups: Base (AV, AC, PR, UI, S, C, I, A), Temporal (E, RL, RC), Environmental. CVSS v4.0 groups: Base (adds AT, splits impact into vulnerable and subsequent systems, removes Scope, three-value UI), Threat (Exploit Maturity), Environmental, and Supplemental (no score effect). Severity: None 0.0, Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9, Critical 9.0–10.0.
• Prioritization combines severity with exploitation evidence (KEV, EPSS), asset criticality, exposure, compensating controls, and business requirements.

Key Terms

Threat; threat actor; threat vector; vulnerability; exploit; risk; likelihood; impact; risk matrix; threat intelligence; strategic, operational, and tactical intelligence; indicator of compromise (IoC); tactics, techniques, and procedures (TTPs); Pyramid of Pain; MITRE ATT&CK; open-source intelligence (OSINT); proprietary intelligence; ISAC; Automated Indicator Sharing (AIS); dark web; threat feed; threat intelligence platform (TIP); STIX; TAXII; intelligence life cycle; Cyber Kill Chain; zero-day; n-day; Common Weakness Enumeration (CWE); Common Vulnerabilities and Exposures (CVE); CVE Numbering Authority (CNA); National Vulnerability Database (NVD); Common Platform Enumeration (CPE); CVSS; FIRST; base metrics; temporal metrics; threat metrics; environmental metrics; supplemental metrics; vector string; scope; attack requirements; Known Exploited Vulnerabilities (KEV) catalog; EPSS; SSVC; prioritization; false positive; false negative.

Review Questions

• 1. A vulnerability advisory includes the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which description BEST matches this vulnerability?

• A. A local privilege escalation that requires a logged-in user
• B. A remotely exploitable flaw that needs no credentials or user action and fully compromises the system
• C. A flaw exploitable only by an attacker with physical access to the device
• D. A cross-site scripting flaw that requires a victim to click a link

• 2. A security analyst wants to adjust the published CVSS score of a vulnerability to reflect that the affected server stores highly sensitive customer data and is reachable only from an internal management network. Which CVSS metric group should the analyst use?

• A. Base
• B. Temporal
• C. Environmental
• D. Supplemental

• 3. A regional bank wants threat intelligence from organizations that face the same adversaries and share indicators specific to the financial industry. Which source BEST meets this need?

• A. A dark web monitoring service
• B. An information sharing and analysis center
• C. Open-source vendor blogs
• D. The NVD

• 4. Which of the following are new in CVSS v4.0 compared with CVSS v3.1? (Select TWO.)

• A. The Attack Vector metric
• B. The Attack Requirements metric
• C. The Scope metric
• D. Supplemental metrics that do not affect the score
• E. The Privileges Required metric

• 5. A vulnerability scan reports two findings: a CVSS 9.8 flaw on an isolated lab server with no network path from the internet, and a CVSS 7.5 flaw on an internet-facing web server that appears in the CISA KEV catalog. Which should be remediated FIRST, and why?

• A. The 9.8 flaw, because it has the higher severity score
• B. The 7.5 flaw, because it is actively exploited and exposed to the internet
• C. Neither, because both have compensating controls
• D. Both at the same time, because all high and critical findings have equal priority

• 6. An organization's threat intelligence team is normalizing data from several feeds, removing duplicates, and loading the results into a threat intelligence platform. Which phase of the intelligence life cycle is this?

• A. Collection
• B. Processing
• C. Analysis
• D. Dissemination

• 7. Which standard defines how threat intelligence is transported between a client and a server over

Https?

• A. STIX
• B. TAXII
• C. CVSS
• D. CPE

• 8. What is the qualitative severity rating of a vulnerability with a CVSS score of 7.0?

• A. Medium
• B. High
• C. Critical
• D. Low

• 9. An analyst notes that blocking a malware sample's file hash stopped the attack for only a day before the attacker recompiled the malware. Which approach would provide more durable detection?

• A. Subscribing to an additional hash feed
• B. Building detections based on the attacker's tactics, techniques, and procedures
• C. Increasing the CVSS score of related vulnerabilities
• D. Requesting a new CVE identifier for the malware

• 10. Which of the following statements about CVE are correct? (Select TWO.)

• A. CVE identifiers are assigned by CVE Numbering Authorities.
• B. Every CVE Record includes a CVSS score calculated by MITRE.
• C. CVE identifiers follow the format CVE-YEAR-sequence number.
• D. CVE catalogs categories of weaknesses such as SQL injection.
• E. The CVE program is operated by FIRST.

• 11. A security manager wants a data-driven estimate of the probability that each open vulnerability will be exploited within the next 30 days, to supplement CVSS. Which resource provides this?

• A. EPSS
• B. CWE
• C. STIX
• D. CPE

• 12. A credential monitoring service alerts a company that usernames and passwords belonging to its employees are being offered for sale on a criminal marketplace reachable only through Tor. Which intelligence source produced this alert?

• A. Internal telemetry
• B. Government advisory
• C. Dark web monitoring
• D. Threat feed of malicious IP addresses

Answers and Explanations

• 1. B. AV:N means network-exploitable, AC:L is low complexity, PR:N means no privileges, UI:N means no user interaction, and C:H/I:H/A:H means total compromise—the profile of unauthenticated remote code execution (score 9.8). A local privilege escalation would show AV:L and PR:L. Physical access would show AV:P. XSS would show UI:R and typically low impacts.
• 2. C. Environmental metrics, including security requirements and modified base metrics, tailor a score to an organization's assets and configuration. Base metrics are intrinsic and do not change between environments. Temporal metrics (v3.1) reflect exploit maturity and remediation over time. Supplemental metrics (v4.0) add context but do not change the score.
• 3. B. ISACs, such as FS-ISAC, are sector-based communities sharing intelligence among members facing similar adversaries. Dark web monitoring focuses on stolen data for sale. Vendor blogs are general OSINT. The NVD is a vulnerability database, not a peer sharing community.
• 4. B, D. CVSS v4.0 added Attack Requirements (AT) and the Supplemental metric group, which conveys context such as Safety and Automatable without changing the score. Attack Vector and Privileges Required exist in both versions. Scope was removed in v4.0, replaced by separate vulnerable and subsequent system impact metrics.
• 5. B. Active exploitation (KEV listing) combined with internet exposure makes the 7.5 flaw the more urgent risk. A higher base score alone does not determine priority, especially for an isolated system with no path from attackers. No compensating controls are mentioned, and treating all high findings equally ignores risk-based prioritization.
• 6. B. Processing converts collected raw data into a usable form through normalization, deduplication, and loading into tools. Collection is gathering the data. Analysis draws conclusions from it. Dissemination delivers finished intelligence to consumers.
• 7. B. TAXII is the transport protocol for exchanging threat intelligence over HTTPS using collections and channels. STIX is the format that describes the intelligence. CVSS scores vulnerabilities, and CPE names products and platforms.
• 8. B. In both CVSS v3.1 and v4.0, High covers 7.0–8.9. Medium is 4.0–6.9, Critical is 9.0–10.0, and Low is 0.1–3.9.
• 9. B. Hashes sit at the bottom of the Pyramid of Pain; changing them is trivial. TTPs describe attacker behavior, which is costly for the attacker to change, so behavior-based detections last longer. More hash feeds have the same weakness. CVSS and CVE apply to vulnerabilities, not malware samples.
• 10. A, C. CNAs assign CVE IDs, and IDs use the CVE-YYYY-NNNN(N...) format. CVE Records do not necessarily include a CVSS score; scores come from CNAs and from NIST's NVD, not from MITRE. Categories of weaknesses are CWE, not CVE. MITRE, not FIRST, operates the CVE program; FIRST maintains CVSS and EPSS.
• 11. A. The Exploit Prediction Scoring System estimates the probability that a vulnerability will be exploited in the next 30 days. CWE catalogs weakness types, STIX describes threat intelligence, and CPE names affected platforms.
• 12. C. Monitoring criminal marketplaces on anonymizing networks such as Tor is dark web monitoring. Internal telemetry comes from the company's own systems, a government advisory describes threats generally, and an IP address feed would not reveal credential sales.