Where did the logical-impact values come from? They appear incomplete.

[Crashedmind]

Question

Overall this project looks interesting and promising! Thanks!

@Chris-Turner-NIST , @david-waltermire-nist (I'm interested in the current logical impacts:

• https://pages.nist.gov/vulntology/specification/values/impact-method-type/
• https://pages.nist.gov/vulntology/specification/values/logical-impact/

Why were these ones chosen (versus other ones)? I'm trying to understand the rationale or process behind the selection. No references are given.

I ask because I did an analysis on CVEs (all, and CISA KEV subset) to determine the Impact "phrases". The analysis included Topic Modeling to find key phrases used, and to rank them by occurrence, and deduplicate them by similarity. So I have a draft Taxonomy of Logical Technical Impacts.

I put this here as an issue (rather than a chat comment) - as I may submit a Pull Request or contribute to this list in general... if there's interest.

[Chris-Turner-NIST]

@Crashedmind The current valid value lists are not considered exhaustive. The intent at this stage was to get generalized coverage and make adjustments during practical application of the Vulntology model. We do want to keep a balance between an initial scatter-shot approach with a large volume of seemingly different terminology so we could reduce or avoid the need to untangle many concepts that end up being too conceptually similar (a problem that already exists today when using free text explanations in advisories) or end up needing to be redefined within an alternative object (Ex: Priv escalation being considered an impact instead of an impact method).

If you wish to propose modifications to any valid values list or even request that certain valid values be added feel free to. We do request that for each you include justification for why it is distinct from existing values in addition to why it belongs within the intended object.

[david-waltermire]

Closing this for now. @Crashedmind if you have a suggestion on additional valid values, we can reopen this in the future.

[Crashedmind]

@david-waltermire sorry about the delay in getting back to this.... But in summary the Technical Impacts from MITRE CAPEC are a good reference or start: https://capec.mitre.org/custom/view.html?id=1000.

These are used in CWEs associated with CVEs e.g. https://cwe.mitre.org/data/definitions/917.html

So an Impact and Impact Method Taxonomy might look like...

I'll be presenting on this topic of Impact Taxonomy / Types at BSidesDublin May 18... on the research, data, rationale behind this...

[Crashedmind]

...and some rationale from MITRE https://cwe.mitre.org/community/swa/priority.html

While there are a large number of weaknesses in CWE, there appear to be only eight different consequences or technical impacts to which these failures lead (see the table below). In other words, if a weakness manifests itself in a product in an exploitable manner and an attacker successfully exploits it, then there will be one of eight technical impacts or consequences from that weakness.

Technical Impacts of Software Weaknesses: Read data Modify data Denial-of-Service: unreliable execution Denial-of-Service: resource consumption Execute unauthorized code or commands Gain privileges / assume identity Bypass protection mechanism Hide activities