Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions docs/_includes/default_automatable_values.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
!!! tip "Default Automatable Values"

If nothing is known about [*Automatable*](/reference/decision_points/automatable.md), the safer answer to assume is [*yes*](/reference/decision_points/automatable.md).
[*Value Density*](/reference/decision_points/value_density.md) should always be answerable; if the product is uncommon, it is probably
[*diffuse*](/reference/decision_points/value_density.md).
6 changes: 1 addition & 5 deletions docs/howto/bootstrap/collect.md
Original file line number Diff line number Diff line change
Expand Up @@ -105,11 +105,7 @@ we can suggest something like defaults for some decision points.
means they do not know where the devices are or how they are controlled, so they should assume
[*System Exposure*](../../reference/decision_points/system_exposure.md) is [*open*](../../reference/decision_points/system_exposure.md).

!!! tip "Default Automatable Values"

If nothing is known about [*Automatable*](../../reference/decision_points/automatable.md), the safer answer to assume is [*yes*](../../reference/decision_points/automatable.md).
[*Value Density*](../../reference/decision_points/value_density.md) should always be answerable; if the product is uncommon, it is probably
[*diffuse*](../../reference/decision_points/value_density.md).
{% include-markdown "../../_includes/default_automatable_values.md" %}

!!! tip "Default Safety Values"

Expand Down
2 changes: 2 additions & 0 deletions docs/howto/gathering_info/automatable.md
Original file line number Diff line number Diff line change
Expand Up @@ -20,3 +20,5 @@ Liveness of Internet-connected services means quite a few overlapping things [@b
For most vulnerabilities, an open port does not automatically mean that reconnaissance, weaponization, and delivery are automatable.
Furthermore, discovery of a vulnerable service is not automatable in a situation where only two hosts are misconfigured to expose the service out of 2 million hosts that are properly configured.
As discussed in in [Reasoning Steps Forward](../../topics/scope.md), the analyst should consider *credible* effects based on *known* use cases of the software system to be pragmatic about scope and providing values to decision points.

{% include-markdown "../../_includes/default_automatable_values.md" %}
2 changes: 2 additions & 0 deletions docs/reference/decision_points/automatable.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,8 @@ print(example_block(LATEST))

See this [HowTo](../../howto/gathering_info/automatable.md) for advice on gathering information about the Automatable decision point.

{% include-markdown "../../_includes/default_automatable_values.md" %}

!!! tip "See also"

Automatable combines with [Value Density](./value_density.md) to inform
Expand Down
Loading