and that is the effect of time. This is known as the lethality curve. The attackers have a term they call zero day, and it references an attack that works before it is publicly known. The exploit works fine, but it is tightly held by a fairly small number of people who are breaking into systems with it. This is a time of extreme lethality, but the number of uses is fairly low. Eventually, the attack is discovered and published. Now the community knows about it and so do the attackers. We enter a race condition—attackers race to get the exploit, learn to use it, and attack our systems. Defenders rush to apply patches, download new IDS signatures, or implement other countermeasures. During this phase, the attack is still pretty lethal, but the lethality is dropping; however, the incidence of attack attempts goes way up. Finally, we reach the crest of the wave. More and more defenders are patching their systems and applying other countermeasures, and over time, the attack becomes less and less destructive.

Countermeasures

What about firewalls or system patches or operating systems running from CD-ROMs? Countermeasures certainly affect severity and can logically be divided into system countermeasures and network countermeasures.

The five-point scale for system countermeasures is as follows:

5 pointsModern operating system, all patches, added security such as TCP Wrappers and secure shell

3 pointsOlder operating system, some patches missing

1 point No TCP Wrappers/allows fixed unencrypted passwords The five-point scale for network countermeasures is as follows: 5 pointsValidated restrictive firewall, only one way in or out

4 pointsRestrictive firewall, some external connections (modems, ISDN)

2 pointsPermissive firewall (The key question is this: "Does the firewall allow the attack through?")

Calculating Severity

Analysts trained in the GIAC approach to intrusion detection use the following formula to

calculate severity:

(Criticality + Lethality) - (System + Net Countermeasures) = Severity

Take a look at a couple examples. These are taken from the practical project required to achieve GIAC Intrusion Analyst certification. To put the examples in context, the entire analysis process is shown, even though the current focus is on severity.

The approach described here helps reinforce that attacks vary in severity. This discussion examines some of the factors that affect severity. You can cite these factors to help others understand when they ask, "What is it about? This attack that has you spun up?" Having a method to calculate severity can be handy when the handler is in the situation of having to triage, or choose how to deploy finite defensive assets. To the system owner, his system is the most important one in the world (much like everyone's own child is the cutest kid). You can use a severity-grading technique like this one to explain why you applied defensive assets to one owner's system rather than to someone else's.