Value Density (SSVC)

Value Density (ssvc:VD:1.0.0)

The concentration of value in the target

Value	Key	Definition
Diffuse	D	The system that contains the vulnerable component has limited resources. That is, the resources that the adversary will gain control over with a single exploitation event are relatively small.
Concentrated	C	The system that contains the vulnerable component is rich in resources. Heuristically, such systems are often the direct responsibility of “system operators” rather than users.

Value Density (ssvc:VD:1.0.0) JSON Example

{
  "namespace": "ssvc",
  "key": "VD",
  "version": "1.0.0",
  "name": "Value Density",
  "definition": "The concentration of value in the target",
  "schemaVersion": "2.0.0",
  "values": [
    {
      "key": "D",
      "name": "Diffuse",
      "definition": "The system that contains the vulnerable component has limited resources. That is, the resources that the adversary will gain control over with a single exploitation event are relatively small."
    },
    {
      "key": "C",
      "name": "Concentrated",
      "definition": "The system that contains the vulnerable component is rich in resources. Heuristically, such systems are often the direct responsibility of “system operators” rather than users."
    }
  ]
}

Gathering Information about Value Density

See this HowTo for advice on gathering information about the Value Density decision point.