[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 3 · 3.1.c
AP Cybersecurity · Securing Networks
Assessing Network Risks
Difficulty lowers likelihood, never severity — and a scanner report is an input, not an assessment.
key ideaNetwork exploits often need advanced skill — which lowers likelihood without lowering severity.
The stages
Network findings differ from physical ones in one respect: many require advanced technical ability and knowledge to exploit. That affects likelihood only. A hard-to-exploit vulnerability with catastrophic impact is still a serious finding.
1
Enumerate what exists
Run an automated vulnerability scanner across networks, devices and applications. It reports the vulnerabilities detected, their severity, and mitigation recommendations.
in a network out a scanner report
2
Verify before you believe it
Scanners report what they can infer. Confirm the finding is real and reachable in your topology before scoring it — a finding on an unreachable host is not the same risk.
out confirmed findings
3
Ask what an adversary gains
The CED's three high-impact outcomes are capturing network traffic, spoofing a legitimate device, and launching a DoS. Also ask whether it enables lateral movement.
out an impact statement
4
Adjust likelihood for difficulty
Exploiting a network vulnerability often requires advanced technical ability, which lowers likelihood. It does not lower severity, and it does nothing at all if a working exploit is published.
out a likelihood rating
5
Band and document
High: easy significant impact. Moderate: yields information about systems or devices. Low: difficult to exploit and minimal impact.
out a ranked register
| Band | Test | Illustrative finding |
|---|
| high | easy, significant impact — capture traffic, spoof a device, or DoS | a single unsecured switch an adversary can reach and reconfigure |
| moderate | yields information about systems or devices | an external firewall that responds to probes, revealing what is behind it |
| low | difficult to exploit and minimal impact | access points broadcasting a beacon that reveals little of value |
Both conditions are required for low. Difficult but devastating is not low — that is a high-severity finding whose likelihood happens to be reduced.
Applying it
A scanner report is an input, not an assessment. It knows what is installed; it does not know which host holds regulated data, which is behind a segment boundary, or which has a compensating control you added last year.
automated vulnerability scan, excerptfindings, severity, and recommendations — the scanner's view
severity finding host recommendation
HIGH unauthenticated switch mgmt port sw-core-01 require auth server, disable local accounts
HIGH SMBv1 enabled fs-02 disable SMBv1; patch to current
MEDIUM firewall responds to external ICMP fw-edge drop ICMP from untrusted interfaces
MEDIUM directory listing enabled web-03 disable listing
LOW AP beacon includes vendor string ap-nw-2 suppress vendor info in beacon
HIGH sw-core-01reconfiguring a core switch enables traffic capture — genuinely highHIGH fs-02a real risk, but check whether the host is reachable from where an adversary would beMEDIUM fw-edgea reconnaissance finding — it reveals structure rather than granting accessLOW ap-nw-2difficult to use and low impact — both conditions metrecommendation columnuseful, but the scanner does not know your topology — verify before acting
Worked analysis
EX 1
Score a high finding
A network has a single unsecured switch that an adversary on the LAN could reconfigure. Assess it.
1
State what it enables
Reconfiguring a switch allows capturing network traffic and spoofing a legitimate device.
2
Assess ease
Once on the LAN, no advanced technique is needed — the device is simply unprotected.
3
Assess impact
All traffic through that switch becomes readable — a confidentiality failure across the segment.
4
Band it
Easy and significant → high.
5
Document the mitigation
Ban local accounts, require an authentication server, enable port security, and re-scan to confirm.
EX 2
Difficult but severe
A vulnerability would let an adversary intercept all traffic, but exploiting it requires advanced technical ability and no public exploit exists. Is this low risk?
1
Assess impact
Interception of all traffic — severe.
2
Assess likelihood
Advanced skill required and no published exploit → lower likelihood.
3
Apply the low test
Low requires difficult and minimal impact. The second condition fails.
4
Band it
Not low. Score it on severity with a reduced likelihood — typically moderate to high.
5
Note the fragility
Publication of a working exploit raises likelihood overnight, so record the assumption explicitly.
EX 3
A moderate reconnaissance finding
An external firewall is not configured to suppress responses to probes, so an adversary can learn which services run behind it. Band it.
1
Ask what access it grants
None — nothing is bypassed.
2
Ask what it reveals
Information about systems and devices on the network.
3
Apply the moderate test
That is exactly the CED's moderate band.
4
Say why it still matters
Reconnaissance shortens the attacker’s search and makes the next attempt precise.
5
Document it
Band moderate, with the mitigation drop probe responses on untrusted interfaces.
Check yourself
What can network vulnerabilities lead to?
Show answer
Intercepting and altering data in transit, launching DoS attacks, and moving laterally to reach more sensitive or critical systems.
What does an automated vulnerability scanner produce?
Show answer
A report of the vulnerabilities detected, their severity, and mitigation recommendations — across networks, devices and applications.
How does exploit difficulty affect a network risk score?
Show answer
Successfully exploiting a network vulnerability often requires advanced technical ability and knowledge, which lowers the likelihood. It does not lower the severity.
Give the two conditions for a low network risk.
Show answer
It would be difficult to exploit and would likely have minimal negative impact. Difficult but devastating is not low.