VER-EVA Evaluation

Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are likely exploitable vulnerabilities.

Notes

The simple reality is that most traditional vulnerabilities discovered by scanners or during assessment are not likely to be exploitable; exploitation typically requires an unrealistic set of circumstances that will not occur during normal operation. The likelihood of exploitation will vary depending on so many factors that FedRAMP will not recommend a specific framework for approaching this beyond these rules.

The proof, ultimately, is in the pudding - providers who regularly evaluate vulnerabilities as not likely exploitable without careful consideration are more likely to suffer from an adverse impact where the root cause was an exploited vulnerability that was improperly evaluated. If done recklessly or deliberately, such actions will have a negative impact on a provider's FedRAMP Certification.

Defined terms: Cloud Service Offering, Likely, Likely Exploitable Vulnerability (LEV), Regularly, Vulnerability, Vulnerability Detection

Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are internet-reachable vulnerabilities.

Notes

FedRAMP focuses on internet-reachable (rather than internet-accessible) to ensure that any service that might receive a payload from the internet is prioritized if that service has a vulnerability that can be triggered by processing the data in the payload.

The simplest way to prevent exploitation of internet-reachable vulnerabilities is to intercept, inspect, filter, sanitize, reject, or otherwise deflect triggering payloads before they are processed by the vulnerable resource; once this prevention is in place the vulnerability should no longer be considered an internet-reachable vulnerability.

A classic example of an internet-reachable vulnerability on systems that are not typically internet-accessible is SQL injection, where an application stack behind a load balancer and firewall with no ability to route traffic to or from the internet can receive a payload indirectly from the internet that triggers the manipulation or compromise of data in a database that can only be accessed by an authorized connection from the application server on a private network.

Another simple example is the infamous Log4Shell (https://en.wikipedia.org/wiki/Log4Shell) vulnerability from 2021, where exploitation was possible via vulnerable internet-reachable resources deep in the application stack that were often not internet-accessible themselves.

Defined terms: Cloud Service Offering, FedRAMP Certified, Internet-Reachable Vulnerability (IRV), Vulnerability, Vulnerability Detection

Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to estimate the likely potential agency impact of exploitation on government customers AND assign one of the following Potential Agency Impact N-ratings (PAIN):

• N0: Exploitation is extremely unlikely to have any adverse effects on agencies that use the cloud service offering.
• N1: Exploitation could be expected to have minimal customer effects on one or more agencies that use the cloud service offering.
• N2: Exploitation could be expected to have narrow customer effects on one or more agencies that use the cloud service offering.
• N3: Exploitation could be expected to have a disruptive customer effect on one agency that uses the cloud service offering.
• N4: Exploitation could be expected to have a debilitating customer effect on one agency that uses the cloud service offering OR a disruptive customer effect on more than one federal agency that uses the cloud service offering.
• N5: Exploitation could be expected to have a debilitating customer effect on more than one agency that uses the cloud service offering.

NIST SP 800-53 Rev. 5 controls: RA-3

Defined terms: Cloud Service Offering, Debilitating Customer Effect, Disruptive Customer Effect, Likely, Minimal Customer Effect, Narrow Customer Effect, Potential Agency Impact, Vulnerability, Vulnerability Detection

Providers MUST assume the exploitation of vulnerabilities can be automated UNLESS they have evidence proving otherwise.

Defined terms: Vulnerability

Providers SHOULD evaluate detected vulnerabilities, considering the context of the cloud service offering, to identify logical groupings of affected information resources that may improve the efficiency and effectiveness of vulnerability response by consolidating further activity; FedRAMP Vulnerability Detection and Response rules are then applied to these consolidated groupings of vulnerabilities instead of each individual detected instance.

Defined terms: Cloud Service Offering, Information Resource, Vulnerability, Vulnerability Detection, Vulnerability Response

Providers SHOULD evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are false positive vulnerabilities.

Defined terms: Cloud Service Offering, False Positive Vulnerability, Vulnerability, Vulnerability Detection

Providers SHOULD consider at least the following factors when considering the context of the cloud service offering to evaluate detected vulnerabilities:

• Criticality: How important are the systems or information that might be impacted by the vulnerability?
• Reachability: How might a threat actor reach the vulnerability and how likely is that?
• Exploitability: How easy is it for a threat actor to exploit the vulnerability and how likely is that?
• Detectability: How easy is it for a threat actor to become aware of the vulnerability and how likely is that?
• Prevalence: How much of the cloud service offering is affected by the vulnerability?
• Privilege: How much privileged authority or access is granted or can be gained from exploiting the vulnerability?
• Proximate Vulnerabilities: How does this vulnerability interact with previously detected vulnerabilities, especially partially or fully mitigated vulnerabilities?
• Known Threats: How might already known threats leverage the vulnerability and how likely is that?

NIST SP 800-53 Rev. 5 controls: RA-9

Defined terms: Cloud Service Offering, Fully Mitigated Vulnerability, Likely, Vulnerability, Vulnerability Detection