Overview

The SSVC (Stakeholder-Specific Vulnerability Categorization) feature in Opus Security helps organizations prioritize vulnerability remediation based on the SSVC CISA framework. This data-driven approach considers multiple factors to provide clear, actionable decisions about vulnerability prioritization.

Benefits

• Automated vulnerability prioritization based on multiple contextual factors
• Clear, action-oriented decisions (Act, Attend, Track*, Track)
• Risk-aware prioritization considering business impact and technical factors
• Reduced Mean Time To Remediate (MTTR) through focused efforts
• Alignment with CISA's recommended vulnerability management practices

How SSVC Works

The SSVC feature analyzes vulnerabilities across four key dimensions:

Exploitation Status

Assesses whether the vulnerability is actively being exploited or has the potential to be exploited in the wild.

• None: No evidence of active exploitation or public proof of concept
• POC: Public proof of concept exists or well-known exploitation method
• Active: Confirmed exploitation in the wild

Automatable

Evaluates the likelihood of the vulnerability being exploited through automated tools, increasing the risk of widespread impact.

• Yes: Exploitation can be reliably automated (steps 1-4 of kill chain)
• No: Exploitation cannot be reliably automated

Technical Impact

Measures the potential harm or disruption a successful exploitation could cause to the affected system or organization.

• Total: Vulnerability enables total control or complete information disclosure
• Partial: Limited control or information exposure

Mission & Well-Being Impact

Combines two factors:

Mission Prevalence

The extent to which a disruption impacts Mission Essential Functions across relevant entities, affecting their ability to accomplish core organizational objectives during crises or operational interruptions.

1. Minimal: Component is present but not critical; neither supports nor is essential to Mission Essential Functions
2. Support: Component plays a supportive role for MEFs across multiple entities, enhancing their effectiveness without being directly essential
3. Essential: Component is integral to at least one entity's MEF; its failure could potentially compromise the overall mission

Public Well-Being Impact

The extent to which a system compromise affects the physical, social, emotional, and psychological health of individuals and communities, as defined by the CDC's comprehensive well-being framework

1. Minimal: Effects are negligible across all aspects, falling below thresholds for material harm. No significant physical, environmental, financial, or psychological consequences are observed.
2. Material: Substantial but not catastrophic effects on physical, environmental, financial, or psychological well-being, such as user injuries, occupational hazards, property damage, potential bankruptcies, or widespread emotional distress requiring professional intervention
3. Irreversible: Severe, potentially unrecoverable consequences, including multiple fatalities, destruction of cyber-physical systems, immediate public health threats, ecosystem collapse, or destabilization of social systems like elections or financial grids

SSVC Decisions

Based on these factors, SSVC provides one of four decisions:

• Act: Requires leadership involvement, coordination, and swift action; remediate immediately.
• Attend: Requires supervisory attention and possible notifications; remediate faster than standard updates.
• Track*: Monitor closely for changes; remediate during standard updates.
• Track: No immediate action needed; monitor and remediate during standard updates.

How SSVC Values Are Determined in Opus

Mission & Well-Being value calculation:

Using SSVC in Opus

Viewing SSVC Decisions

1. Navigate to the Risk View
2. Click on any vulnerability to see a detailed analysis
3. If an SSVC recommendation is available, it will appear in the risk score breakdown modal

4. Each Factor displays its corresponding value directly beneath the factor name. For detailed context about a factor's value, hover your cursor over the associated information icon, which will reveal an explanatory tooltip.

   

5. To access detailed explanations for each decision factor without referencing the full documentation, click on the SSVC Decision Points located in the bottom right of the recommendation section.

   

Filtering by SSVC

1. Use the filter options in Risk View
2. Filter by:

• Intelligence -> SSVC Decision (Act, Attend, Track*, Track)
• Intelligence -> Risk Level (Minimal, Material, Irreversible)

Best Practices

1. Prioritize "Act" Decisions: These vulnerabilities require immediate attention
2. Monitor "Attend" Items: Create regular review cycles for these vulnerabilities
3. Review Track* Items: Set up monitoring for potential status changes
4. Use Automation Rules: Leverage automation rules based on SSVC Decision and Risk Level filters
5. Regular Assessment: Review SSVC distributions regularly to track remediation progress

FAQ

Q: How often is SSVC data updated?
A: SSVC calculations are performed automatically during regular data refreshes and scans.

Q: Can I customize SSVC parameters?
A: Currently no, SSVC mapping is strict. We are planning to add a mapping customization feature in the future.

Q: How does SSVC relate to CVSS scores?
A: While CVSS focuses on technical severity, SSVC provides context-aware decisions considering business impact and exploitation status.

Q: What if some SSVC inputs are missing?
A: The system uses conservative default values when inputs are unavailable to ensure security.

CISA Official Documentation

For official CISA SSVC documentation and guidelines, please check the following link: CISA SSVC Official Documentation