Risk Calculation

Asset Risk (Risk Score)

CloudGuard analyzes your cloud assets and gives a risk score to each supported asset. CloudGuard considers these factors:

• Base Risk - the attack surface of each asset (example: Common Vulnerabilities and Exposures (CVEs))

• Context Modifiers - the likelihood that the asset is a target for attacks (example: publicly exposed assets)

• Impact Modifiers - the possible impact if the asset is compromised (example: business priority)

CloudGuard recalculates the risk score after you change the rules for risk calculation and after you change the business priority of an asset. If you do not do one of these, CloudGuard recalculates the risk score once every several hours. For more information about rulesets and configuration instructions, see ERM Rulesets.

To see the risk score of your assets, navigate to Risk Management > Protected Assets. For more information, see ERM Protected Assets.

Step 1: CloudGuard Calculates Base Risk Score

1. CloudGuard uses these findings to calculate a base risk score:

   • posture findings

   • CVEs

   • threats
     

   • secrets
     

   CloudGuard supports several vulnerability scanners. CloudGuard's AWP solution finds CVEs, threats, and secrets. In AWS Amazon® Web Services. Public cloud platform that offers global compute, storage, database, application and other cloud services. environments, Amazon Inspector v2 also scans assets for CVEs. The risk score calculation does not include vulnerabilities with Informational and Unknown severity.

2. CloudGuard classifies each finding by severity: Low, Medium, High, or Critical.

3. CloudGuard uses a formula to determine the base risk score for an asset. These are general principles of how the formula compares assets:

   1. An asset with a higher severity finding gets a higher base risk score than an asset with lower severity findings.
      

      Example - Asset A has 1 High severity finding, and Asset B has 20 Medium security findings. Asset A gets a higher base risk score.

   2. If two assets have a highest-level security finding at the same level, the one with a larger number of findings at the highest level gets priority.
      

      Example - Asset C has 2 High severity findings, and Asset D has 4 High severity findings. Asset D gets a higher base risk score.

   3. If two assets have the same number of findings at the highest common level, the asset with more findings at the next highest level gets a higher base risk score.

      Example - Asset E has 2 High severity findings and 2 Medium severity findings. Asset F has 2 High severity findings and 1 Low severity finding. Asset E gets a higher base risk score.

Step 2: CloudGuard Adjusts the Base Risk Score based on Business Priority

After CloudGuard takes findings into account, CloudGuard adjusts the risk score based on the business priority of the asset. For more information about Business Priority and configuration instructions, see Business Priority.

Example 1 - An asset with High Importance and at least one High severity finding gets a Base Risk Score in the range of 5.5-8.5, depending on the number of High/Medium/Low severity findings.

Example 2 - An asset with High Importance and at least one Critical severity finding gets a Base Risk Score in the range of 8.5-10.0, depending on the number of Critical/High/Medium/Low severity findings.

Step 3: CloudGuard Modifies the Base Risk Score based on Context Modifiers

CloudGuard modifies the Base Risk Score based on contextual data, including:

• Network Exposure - The level of network accessibility from the public domain. If a network is partially public and partially private, CloudGuard reduces the risk score by a constant magnitude.

• IAM Exposure - The level of asset accessibility from the public domain. If an asset is partially public and partially private, CloudGuard reduces the risk score by a constant magnitude.

• IAM Sensitivity - The possible damage caused to the cloud environment because of IAM Identity and Access Management (IAM) - A web service that customers can use to manage users and user permissions within their organizations. permissions. The less sensitive the asset, the more CloudGuard reduces the risk score. For more information, see IAM_Sensitivity.

• Data Sensitivity - Indicates if the data in the asset is sensitive or not. If the asset does not hold sensitive data, CloudGuard reduces the risk score by a constant magnitude.