Re: [cti] Public review comments from Kaiser Permanente for STIX V1.2.1

Keep in mind that “Exploit" != "Exploit Target". Within TTP, there’s a placeholder “ExploitType” that’s intended to characterize actual exploits. We don’t really have a good way to do that now so it’s pretty bare. There’s a separate “ExploitTargetType”
 as a top-level construct that can represent vulnerabilities, configurations, and weaknesses. That construct does indeed have a CVE_ID field.

So…exploit = representation of the actual exploit code that exploits a vulnerability. Exploit target = representation of the vulnerability that is or might be the target of an exploit.

John

From: <> on behalf of Rich Piazza <>

Date: Sunday, February 7, 2016 at 5:07 PM

To: Beth Pumo <>, "" <>

Subject: RE: [cti] Public review comments from Kaiser Permanente for STIX V1.2.1

I think the "best practices" way of expressing what you want, it to have the TTP be related to an Exploit_Target that describes the CVE, including its ID.

 

Also, notice that the ttp:ExploitType isn't fully specified - from the specs:

 

The ExploitType class is intended to be extended to enable the structured description of an exploit instance.  However, no extension is provided by STIX
 v 1.2.1; producers wanting to represent structured exploit instance information are encouraged to develop such an extension.

 

-----Original Message-----

From:  [mailto:] On Behalf Of Beth Pumo

Sent: Friday, February 05, 2016 3:52 PM

To: 

Subject: [cti] Public review comments from Kaiser Permanente for STIX V1.2.1

 

Comment on this area: STIX Part 5, TTP, Section 3.2.3.1 ExploitType Class: Should CVE_ID be included, considering CAPEC_ID is included for AttackPatternType?

 

Basically, the default extensions for similar classes include attributes for similar ID types. Example: the Exploit Target data model WeaknessType class contains CWE_ID. It should be useful to include an (optional) attribute for CVE numbers on Exploits,
 if the CVE numbers are known.