jperezduerto.info
Start here · Unit 04
Security frameworks: choose the right map
Processes, controls, weakness names, and severity scores answer different questions.
After this lesson you can
- Choose a reference for a process, control, weakness, or behavior question.
- Distinguish a vulnerability identifier from a weakness class.
- Explain severity scores alongside contextual risk without changing scores arbitrarily.
Security references are easier to use when you start with a question. A framework can organize a program, a testing guide can support a review, and a catalog can name an observed weakness. They complement one another.
Four useful questions
| Your question | A useful reference | What it contributes |
|---|---|---|
| How do we organize security outcomes? | NIST Cybersecurity Framework | Outcomes across Govern, Identify, Protect, Detect, Respond, and Recover. |
| How should an authorized technical assessment be planned? | NIST SP 800-115 | Planning, execution, analysis, and handling findings. |
| What should this application protect, and how can a review be organized? | OWASP ASVS and WSTG | Security requirements and a web testing guide. |
| How can we describe an observed weakness or behavior? | CWE and MITRE ATT&CK | Weakness classes and adversary tactics and techniques. |
These are different kinds of reference, rather than steps in a single universal checklist. The OWASP Top 10 is an awareness document about major web application risks; it is useful for orientation but is not an exhaustive verification standard. Record the edition you use, because categories and requirements evolve.
A name is not a score
CVE identifies a publicly disclosed vulnerability. Its record describes affected products, versions, and supporting information. One record can cover more than one product; the same component may be used in several places. Not every observed problem has a CVE record.
CWE describes a weakness type, such as improper authorization. A fictional school portal might allow a pupil to read another pupil’s private record because a server-side ownership check is missing. The weakness class helps explain the defect even when no CVE has been assigned.
Severity and repair priority
CVSS expresses technical severity with defined metrics. Report the version, vector, and score so someone else can understand the calculation. CVSS v4.0 distinguishes Base, Threat, Environmental, and Supplemental metric groups. Supplemental metrics add information without changing the score.
An organization also considers exposure, affected data, existing controls, exploitation evidence, and service importance. These support a risk assessment and repair priority. If you calculate environmental or threat metrics, document those inputs; do not subtract points from a published score based on intuition.
PredictA useful score, an incomplete decision. A fictional library has two services with the same vulnerability and base score. One handles public opening hours; the other stores borrowing records. Must their repair priorities be identical?
No. Preserve the shared technical severity information, then assess each service’s exposure, data, controls, and operational consequences. Document the reasons for the chosen priority.
References support evidence
ATT&CK describes behavior through tactics, techniques, and procedures. A mapping can help a defender discuss coverage, but it does not identify an actor or prove that a detection works. Similarly, a CWE label does not prove a defect exists. Explain the observed facts, the applicable concept, and the remaining uncertainty.
Continue with security vocabulary or clear reporting.
Terms you met
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Which source best supports checking application security requirements?
Show the answer
Correct answer: OWASP ASVS. ASVS describes verifiable application security requirements.
-
What is the relationship between CWE and CVE?
Show the answer
Correct answer: CWE names weakness types; CVE identifies disclosed vulnerabilities. A disclosed vulnerability can be classified using an applicable weakness type.
-
A published CVSS base score is high. What should a team do?
Show the answer
Correct answer: Preserve the score and vector, assess context, and document its repair priority. Use defined metrics for any recalculated score and explain organizational risk separately.
-
What does a relevant ATT&CK mapping establish?
Show the answer
Correct answer: A shared description of behavior, with evidence still needed. A mapping helps communication; it does not replace observation.
Try it
- WriteFor a fictional school portal, write one question about its review process, one about an access-control requirement, and one about the priority of a repair. Match each to a suitable reference.