Title: INTROSEC / intro
Tags: intro

Q: What is CVE?
A: Cmmon Vulnerabilities and Exposures; identifiers for public vulnerabilities
Format: CVE-[4 Digit Year]-[Sequential Identifier], e.g. CVE-2022-31629

Q: What is CWE
A: Common Weakness Enumeration. A CVE can have one or more CWEs

Q: CVEs are issued by whom?
A: CVE Numbering Authorities (CNAs)

Q: What is CVSS
A: CVSS assigns CVEs a severity scoreusing the Common Vulnerability Scoring System. Levels: Low, Medium, High, Critical

Q: Explain Open Design.
A: The security of a system should not depend on the secrecy of its protection mechanisms.

Q: Explain Comparmentalization.
A: Organize resources into isolated gropus (compartments) of similar needs.

Q: Explain Minimum Exposure.
A: Minimize the attack surface a system presents to an adversary.

Q: Explain Least Privilege.
A: Any component (and user) of a system should operate using the least set of privileges necessary to complete it's job.

Q: Explain Fail-Safe Defaults.
A: The system should start in a secure state and return to a secure state in the event of a failure.

Q: Explain Complete Mediation.
A: Access to every security-relevant object must be monitored and controlled.