Which CVSS metric captures environmental factors such as security controls and network topology?

Which CVSS metric captures environmental factors such as security controls and network topology?

• A. Base Metric
• B. Temporal Metric
• C. Remediation
• D. Environmental Metric

Answer: (D)

Environmental factors describe how a vulnerability behaves in a specific setting, considering how security controls, network topology, and the importance of confidentiality, integrity, and availability are arranged in that environment. In CVSS, the environmental metrics let you tailor the base score to reflect those real-world conditions. You can adjust components like the modified attack vector, modified attack complexity, modified privileges required, and modified user interaction, as well as the scope and the CIA requirements, to show how the environment amplifies or mitigates the vulnerability’s impact. This makes the score meaningful for a particular deployment—if the environment has strong network segmentation and strict controls, the environmental adjustments can lower the score; if the environment treats confidentiality or availability as critical, the adjustments can raise it. The other metric groups don’t capture these deployment-specific factors: the base metrics describe the inherent vulnerability, temporal metrics reflect how exploitability and remediation change over time, and remediation is a temporal factor, not about environmental conditions.

Environmental factors describe how a vulnerability behaves in a specific setting, considering how security controls, network topology, and the importance of confidentiality, integrity, and availability are arranged in that environment. In CVSS, the environmental metrics let you tailor the base score to reflect those real-world conditions. You can adjust components like the modified attack vector, modified attack complexity, modified privileges required, and modified user interaction, as well as the scope and the CIA requirements, to show how the environment amplifies or mitigates the vulnerability’s impact. This makes the score meaningful for a particular deployment—if the environment has strong network segmentation and strict controls, the environmental adjustments can lower the score; if the environment treats confidentiality or availability as critical, the adjustments can raise it. The other metric groups don’t capture these deployment-specific factors: the base metrics describe the inherent vulnerability, temporal metrics reflect how exploitability and remediation change over time, and remediation is a temporal factor, not about environmental conditions.