This document is for:

Invicti Enterprise on-demand, Invicti Enterprise on-premises

How Invicti approaches CISA BOD

The Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive (BOD) 26-04 asks US federal civilian agencies to prioritize vulnerability fixes based on risk rather than severity score alone. To help you follow it, Invicti Enterprise lets you:

• Set the Internet Exposed value on every target. You mark each target as internet-facing or not, which covers the directive's asset exposure factor.
• View CISA's own risk information for each Common Vulnerabilities and Exposures (CVE). For known vulnerabilities found in third-party components, Invicti shows CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) values (Exploitation, Automatable, Technical Impact), whether the CVE is on CISA's Known Exploited Vulnerabilities (KEV) list, and the Common Vulnerability Scoring System (CVSS) vector.

You can then apply the directive's decision model and deadlines in your own process.

compatibility

This feature is available from Invicti Enterprise 26.11.0.

CISA BOD 26-04 model overview

The directive replaces "patch by severity score" with a risk model built on four questions about each vulnerability. CISA provides three of the four factors. Asset exposure is dependent on your environment, so you need to set this yourself.

The following table shows each factor, who supplies the answer, and where it appears in Invicti.

CISA BOD 26-04 factor	Question it answers	Who provides it	Where it appears in Invicti
Asset exposure	Can an unauthenticated user reach the asset from a public network?	You	Target setting: Internet Exposed
KEV status	Is the CVE being exploited in the wild today?	CISA, delivered by Invicti	Known Issues: CISA KEV section
Exploit automation	Can an attacker exploit it automatically, at scale?	CISA, delivered by Invicti	Known Issues: SSVC > Automatable
Technical impact	How much control does exploitation give an attacker?	CISA, delivered by Invicti	Known Issues: SSVC > Technical Impact

Set and view the Internet exposed value on targets

The Internet Exposed setting for a target tells Invicti whether unauthenticated users can reach a target over public networks. This is the CISA BOD 26-04 definition of asset exposure. You set it when you add a target or edit an existing one.

The setting has three values:

• Not Specified (default)
• Yes: The target is accessible to unauthenticated users through public networks.
• No: The target isn't accessible to unauthenticated users through public networks.

important

All existing targets start as Not Specified after the upgrade. Invicti doesn't assume anything on your behalf. If you follow CISA BOD 26-04, review your targets and set each one to Yes or No. If you have many targets, you can set the values through the API. For more information, refer to Use the API.

If the exposure of a website changes, for example when you publish an internal application, update the setting. CISA BOD 26-04 expects priorities to be recalculated when exposure changes.

Invicti displays the Internet Exposed value in the following places:

Where	What you see
Targets page	An Internet Exposed column. A hyphen (-) indicates the default setting Not Specified.
Issues page	An Internet Exposed column. A hyphen (-) indicates the default setting Not Specified.
Issue Details page	An Internet Exposed row.
Scan Summary and scan report	The value of the target's Internet Exposed setting, if the value Yes or No is set on the target.
Issues CSV export	An Internet Exposed column, so you can use the data in your own tracking. An empty cell indicates the default setting Not Specified.

You can also read and set the value through the API. For more information, refer to Use the API.

View CISA risk data for CVEs

When Invicti finds an outdated component with known vulnerabilities, for example an old PHP or Apache version, it lists each CVE under Known Issues. Each CVE also shows the information that CISA publishes about it.

The values come directly from CISA: SSVC from CISA's Vulnrichment program, KEV status from the KEV catalog, and CVSS from the CVE records. Invicti packages this data into the vulnerability database that already ships and updates with the scanner. This means:

• There's nothing to set up. You don't need to configure a CISA feed or integration.
• It works on-premises and in restricted networks, because the scanner doesn't need to contact CISA directly.
• Invicti doesn't reinterpret CISA's data. It shows the values exactly as CISA publishes them.

Each CVE shows the information that CISA publishes about it:

Field	What it means	Possible values
CVSS	The industry-standard severity vector for the CVE. Invicti shows v4 or v3 when available, with older versions as a fallback.	A CVSS vector string
SSVC: Exploitation	Whether anyone has exploited this vulnerability, according to CISA.	active, poc (a proof of concept exists), none
SSVC: Automatable	Whether an attacker can exploit it automatically, without manual steps.	yes, no
SSVC: Technical Impact	Whether the attacker gets full or partial control of the affected component if they exploit it.	total, partial
CISA KEV	Whether the CVE is in CISA's Known Exploited Vulnerabilities catalog, and the date CISA added it. If CISA requires forensic triage for the CVE, Invicti shows that too.	Listed with the date added. Not shown when the CVE isn't listed.

For example, CVE-2012-1823, a PHP command injection vulnerability, shows a CVSS vector, the SSVC values Exploitation active, Automatable yes, and Technical Impact total, and a CISA KEV entry with the date CISA added it.

note

CISA hasn't scored every CVE yet. When a CVE has no CISA data, Invicti shows only the CVSS vector and leaves out the empty SSVC and KEV sections. When CISA adds data for it, the data arrives with regular vulnerability database updates.

The CISA risk data for CVEs appears on the Issue Details page and wherever Known Issues are already listed, such as the Technical Report.

CISA BOD 26-04 focuses on CVEs, so SSVC and KEV apply to Known Issues (CVE-based findings). Invicti also displays the Internet Exposed setting for custom-code findings.

Use the API

If you automate through the API, for example to set the exposure value on hundreds of targets at once or to feed findings into your own tracking, you can make these changes using the existing REST API (version 1.0). There are no new endpoints. Existing endpoints gain a few fields.

Internet exposed setting on targets

What you want to do	Endpoint	Field and behavior
Set the value when you create a target	POST /api/1.0/websites/new	IsInternetExposed: true (Yes) or false (No). If you leave it out, the target starts as Not Specified.
Change the value on an existing target	POST /api/1.0/websites/update PUT /api/1.0/websites/{id}	IsInternetExposed: true or false. If you leave it out, Invicti keeps the current value, so existing scripts keep working unchanged.
Read the value	GET /api/1.0/websites/list GET /api/1.0/websites/get	IsInternetExposed: true, false, or null (Not Specified).
See the value on findings	GET /api/1.0/issues/allissues Also todo, waitingforretest, addressedissues, get, and report	WebsiteIsInternetExposed: taken from the target of the issue. true, false, or null.

Because a missing field means "keep the current value," the API can set Yes or No but can't reset a target to Not Specified. You can do that in the user interface.

CISA risk data on CVEs

Issue responses already include a VersionIssues list with the known CVEs for an outdated component. Each entry now also carries the CISA fields shown in the user interface.

Field	Meaning	Values
Cvss	CVSS vector (best available: v3.x, or v2 as a fallback)	Vector string
CvssV4	CVSS v4 vector, when published	Vector string or empty
Exploitation	SSVC: Exploitation	active, poc, none, or empty
Automatable	SSVC: Automatable	yes, no, or empty
TechnicalImpact	SSVC: Technical Impact	total, partial, or empty
IsKev	Listed in the CISA KEV catalog	true, false
KevDateAdded	Date CISA added the CVE to KEV	Date or empty
ForensicTriage	CISA flags the CVE for forensic triage	true, false

The following shortened example shows what you might see for an issue in the API response (values for CVE-2012-1823):

{
  "WebsiteName": "php",
  "WebsiteIsInternetExposed": true,
  "VersionIssues": [
    {
      "Title": "PHP Improper Neutralization ... (Command Injection) Vulnerability",
      "ExternalReferences": "CVE-2012-1823",
      "Cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "CvssV4": null,
      "Exploitation": "active",
      "Automatable": "yes",
      "TechnicalImpact": "total",
      "IsKev": true,
      "KevDateAdded": "2022-03-25T00:00:00",
      "ForensicTriage": false
    }
  ]
}

---

Need help?

Invicti Support team is ready to provide you with technical help. Go to Help Center