Asset and Vulnerability Scoring

Nodeware scores devices based on a weighted average of all the vulnerabilities found on the device. Individual device scores are calculated similarly to network scores. The details can be found in the Network Score knowledge base article in the Scoring section.

Vulnerability Categories

Nodeware measures vulnerabilities based on the Common Vulnerability Scoring System (CVSS) score, as discussed in the CVSS knowledge base article in the Scoring section. Individual vulnerabilities are categorized into 5 bins based on severity. The categories are Critical, High, Medium, Low, and Info.

Critical Vulnerabilities

A vulnerability categorized as critical requires immediate attention, as they represent vulnerabilities that have a public exploit widely available or have a large impact on the information security of the system and the network at large.

Nodeware identifies critical vulnerabilities with a red exclamation point (!) icon in the status column of network view and via Critical Vulnerability Alerts, as discussed in the Alerts knowledge base article in the How-To section.

High Vulnerabilities

A high severity rating of a vulnerability means that remediation should take place as soon as possible. Publicly available exploits may not exist or be widespread, but it is likely a proof-of-concept exploit exists, or it is feared that black hat individuals or groups have developed one.
Both Critical and High vulnerabilities often require updates to the operating system or system software and are usually directly related to a security bulletin published by the software and hardware vendors.

Medium and Low Vulnerabilities

Vulnerabilities that fall into the Medium and Low bins are often configuration related where remediation is often filtering ports, disabling unused services, and keeping SSL certificates current.

Informational Messages

Vulnerabilities marked Info are not vulnerabilities per se, and usually don't pose any security risk, but rather are meant to inform about accessible services and ports. Informational messages represent data that can be gathered by anyone with authorized or unauthorized access to your network and devices.