Vulnerability › Module 6 › Lesson 3
Environmental
Collateral damage and security requirements — tailor scores to YOUR asset context.
Visual · t18_environmental
Environmental = how bad on YOUR specific asset placement. Original Cyberlium.
Opening
The same CVE scores differently on a DMZ box versus a disconnected lab VM — context is defender work.
CVSS Environmental metrics modify Base using Confidentiality/Integrity/Availability requirements and modified impact based on asset role. A Medium flaw on YOUR lab jump host you use for $LAB_ASSETS may rate higher than on an isolated scrap VM with no sensitive data. Learn to document environmental rationale in VA reports — 'Critical in scanner, High after environmental because lab VLAN no production data.' Never inflate scores to scare strangers or deflate them to skip patching production you do not own. Adjust only on assets in YOUR inventory with written RoE.
1. Modified impact
Asset role: database vs static dev VM changes business impact even if Base score identical.
Security requirements (CR/IR/AR) reflect data classification on YOUR lab asset tags.
Command guide
Try these commands — Modified impact
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Environmental CVSS — https://www.first.org/cvss/v3.1/specification-document Risk prioritization — https://www.cisa.gov/topics/cybersecurity-best-practices
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
python3 -c "print('Lab isolated VM: lower urgency than internet-facing prod')"
grep environmental "$HOME/cyberlium-lab/t18-cvss-lab.txt" 2>/dev/null || printf 'environmental_note: lab isolated
' >> "$HOME/cyberlium-lab/t18-cvss-lab.txt"Primary tools to practice this lesson: python3, grep. Reference sites: Environmental CVSS (https://www.first.org/cvss/v3.1/specification-document); Risk prioritization (https://www.cisa.gov/topics/cybersecurity-best-practices). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender use
Environmental score drives patch order alongside exposure and compensating controls.
Document assumptions: 'Lab VM, no PII, isolated VLAN' — honest context beats generic scanner default.
3. Scope
Apply environmental notes to $LAB_ASSETS inventory rows only.
No environmental scoring on hosts discovered via internet-wide scan you were not authorized to run.
4. What you ship: environmental adjustment example
One finding with Base vs Environmental delta + asset role sentence + $LAB_ASSETS scope.
5. What you record before the next lesson
Environmental example path.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Mark every classmate scan finding Critical to 'help them patch faster' without their engagement.
Right
Name Environmental metrics. Next: CVSS lab.
Mission: environmental adjustment
1) Pick one $LAB_ASSETS finding. 2) Write Base score and environmental rationale. 3) Write NEVER score stranger assets without RoE.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Modified Attack Vector when behind firewall?”
Knowledge Check
APPLY: Environmental CVSS adjusts for:
Multiple choice
Knowledge Check
APPLY: True or False: Inflating scores on stranger hosts is helpful VA.
True or False
Knowledge Check
APPLY: Same Base score may differ environmentally because:
Multiple choice