Conflicting PAIN definitions

[trentjohnson-knox]

The Potential Agency Impact N-rating (PAIN) is defined in three places. The triggering event is worded differently in each:

Rule	Page	Wording
FRD-PAI (Potential Agency Impact)	definitions	"likely to result from security incidents or the exploitation of vulnerabilities"
VER-EVA-EPA (Estimate Potential Agency Impact)	vulnerability-evaluation-and-reporting	"impact of exploitation"; every level starts "Exploitation could be expected to…"
IEC-CSO-EFI (Estimate Federal Impact)	incident-evaluation-and-communication	"adverse impact of an incident"; levels read "N3 for a likely disruptive customer effect…"

Each rule covers different combinations of exploit vs incident. A provider can't tell whether PAIN is one rating applied to both vulnerabilities and incidents or two separate ratings. For vulnerabilities that require a physical attack vector, an incident likely would not cause any exploitation as incidents are basically never physical, so the PAIN would be low. However, if exploitation is assumed, then we would assume a threat would have physical access even if the machine is in the cloud. Mitigation does not solve this as one can have a fully mitigated N5 if both the risk of exploitation is negligible, and one picks the pain definition that assumes exploitation.

Additional conflicts:

• VER-EVA-EPA has N0–N5 while IEC-CSO-EFI has only N1–N5.
• VER-EVA-EPA says "MUST evaluate" while IEC-CSO-EFI says "SHOULD promptly estimate".

It would be nice if there was one canonical definition of the PAIN. This could resolve inconsistencies across FRD-PAI, VER-EVA-EPA and IEC-CSO-EFI, and clarify whether PAIN covers both incidents and vulnerability exploitation.

[pete-gov]

It would be nice if there was one canonical definition of the PAIN. This could resolve inconsistencies across FRD-PAI, VER-EVA-EPA and IEC-CSO-EFI, and clarify whether PAIN covers both incidents and vulnerability exploitation.

The FRD-PAI definition is the canonical definition for Potential Agency Impact (PAI), and VER-EVA-EPA and IEC-CSO-EFI each tell you how to calculate a specific type of N-rating and what to do with it. In the future, there may be additional different N-rating calculations for other scenarios. PAI is a defined term, N-rating is the application of rules to calculate PAI for specific circumstances.

PAIN ratings are therefore expected to be evaluated and handled differently depending on the situation. For example, we do not think there is such thing as PAIN0 incident - the definition of that would be that it's not an incident, creating a short circuit.

The PAIN of a vulnerability may be different than the PAIN of an incident, even when related to the exact same scenario. It is important that these remain calculated separately, following the different instructions. It's best to think of Vulnerability PAIN as a different term from Incident PAIN, because in reality they are different things calculated in different ways with different impacts and different responses.

There's a bit more on why even an Incident PAIN evaluation resulting from a Vulnerability PAIN 5 might end up at Incident PAIN 1 or such in this thread there.

[trentjohnson-knox]

Thank you so much. This adds a lot of clarity and that other discussion was enlightening as well.