You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<h3id="risk-takeaway-prioritize-vulnerabilities-by-exploitation-to-reduce-cost-and-risk">Prioritize vulnerabilities by Exploitation to Reduce Cost and <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr><aclass="headerlink" href="#risk-takeaway-prioritize-vulnerabilities-by-exploitation-to-reduce-cost-and-risk" title="Permanent link">¶</a></h3>
5687
+
<p>Only about 5% or fewer of all <ahref="#risk-understanding_risk-what-vulnerabilities-are-being-exploited">CVEs have been exploited</a>.</p>
5688
+
<p>Prioritizing vulnerabilities that are being exploited in the wild, or are more likely to be exploited, reduces the</p>
5689
+
<ul>
5690
+
<li>cost of vulnerability management</li>
5691
+
<li>risk by reducing the time adversaries have access to vulnerable systems they are trying to exploit </li>
5692
+
</ul>
5686
5693
<h3id="risk-takeaway-use-a-risk-based-prioritization-scheme-that-supports-exploitation-evidence-and-likelihood-of-exploitation-epss">Use a <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Based Prioritization Scheme that supports Exploitation Evidence and Likelihood Of Exploitation (<abbrtitle="Exploit Prediction Scoring System">EPSS</abbr>)<aclass="headerlink" href="#risk-takeaway-use-a-risk-based-prioritization-scheme-that-supports-exploitation-evidence-and-likelihood-of-exploitation-epss" title="Permanent link">¶</a></h3>
5694
+
<p>“The focus should be given to those known to be <ahref="#vendors-qualys">exploited in the wild (<abbrtitle="Cybersecurity & Infrastructure Security Agency">CISA</abbr><abbrtitle="Known Exploited Vulnerability">KEV</abbr>), those with a high likelihood of exploitation (indicated by a high <abbrtitle="Exploit Prediction Scoring System">EPSS</abbr> score), and those with weaponized exploit code available</a>”</p>
5687
5695
<p><imgalt="Exploitation Known evidence or activity" src="../assets/images/threat.png" width="400" /></p>
5688
5696
<ol>
5689
5697
<li>For those using <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Scores and Ratings, using <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> v3 Temporal Metric - Exploit Code Maturity (E) that <strong>supports Exploitation</strong> evidence is a small step with a relatively small (de)prioritization of CVEs.</li>
<h3id="risk-takeaway-refine-the-risk-based-prioritization-scheme-based-on-your-environment-and-your-data">Refine the <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Based Prioritization scheme based on your environment and your data.<aclass="headerlink" href="#risk-takeaway-refine-the-risk-based-prioritization-scheme-based-on-your-environment-and-your-data" title="Permanent link">¶</a></h3>
5697
5705
<ol>
5698
5706
<li>Use CVEs detected in your Incident Response, Bug Bounty, PenTesting findings) to inform your <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr>.</li>
5699
-
<li>Start by picking an <abbrtitle="Exploit Prediction Scoring System">EPSS</abbr> Threshold around 10%, and adjust based on your <abbrtitle="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr> data and your capacity to <abbrtitle="The neutralization or elimination of a vulnerability or the likelihood of its exploitation.">remediate</abbr> the CVEs above that Threshold (in conjunction with <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Severity or other <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> factors) per [Remediation Policy for an Enterprise](../epss/EPSS_Thresholds.md#remediation-policy-for-an-enterprise</li>
<li>Assess <ahref="#risk-epss-applying_epss_to_your_environment-epss-for-your-environment"><abbrtitle="Exploit Prediction Scoring System">EPSS</abbr> for YOUR Environment</a></li>
5709
+
<li>Start by picking an <abbrtitle="Exploit Prediction Scoring System">EPSS</abbr> Threshold around 10%, and adjust based on your <abbrtitle="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr> data and your capacity to <abbrtitle="The neutralization or elimination of a vulnerability or the likelihood of its exploitation.">remediate</abbr> the CVEs above that Threshold (in conjunction with <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Severity or other <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> factors) per <ahref="#epss-epss_thresholds-remediation-policy-for-an-enterprise">Remediation Policy for an Enterprise</a></li>
5710
+
</ol>
5711
+
</li>
5700
5712
</ol>
5701
5713
<h3id="risk-takeaway-be-careful-with-proprietary-risk-based-prioritization-schemes">Be Careful with Proprietary <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Based Prioritization Schemes<aclass="headerlink" href="#risk-takeaway-be-careful-with-proprietary-risk-based-prioritization-schemes" title="Permanent link">¶</a></h3>
5702
5714
<p>If you <strong>implement</strong> a proprietary <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Based Prioritization scheme, keep the following in mind:</p>
<h3id="prioritize-vulnerabilities-by-exploitation-to-reduce-cost-and-risk">Prioritize vulnerabilities by Exploitation to Reduce Cost and <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr><aclass="headerlink" href="#prioritize-vulnerabilities-by-exploitation-to-reduce-cost-and-risk" title="Permanent link">¶</a></h3>
1539
+
<p>Only about 5% or fewer of all <ahref="../Understanding_Risk/#what-vulnerabilities-are-being-exploited">CVEs have been exploited</a>.</p>
1540
+
<p>Prioritizing vulnerabilities that are being exploited in the wild, or are more likely to be exploited, reduces the</p>
1541
+
<ul>
1542
+
<li>cost of vulnerability management</li>
1543
+
<li>risk by reducing the time adversaries have access to vulnerable systems they are trying to exploit </li>
1544
+
</ul>
1520
1545
<h3id="use-a-risk-based-prioritization-scheme-that-supports-exploitation-evidence-and-likelihood-of-exploitation-epss">Use a <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Based Prioritization Scheme that supports Exploitation Evidence and Likelihood Of Exploitation (<abbrtitle="Exploit Prediction Scoring System">EPSS</abbr>)<aclass="headerlink" href="#use-a-risk-based-prioritization-scheme-that-supports-exploitation-evidence-and-likelihood-of-exploitation-epss" title="Permanent link">¶</a></h3>
1546
+
<p>“The focus should be given to those known to be <ahref="../../vendors/Qualys/">exploited in the wild (<abbrtitle="Cybersecurity & Infrastructure Security Agency">CISA</abbr><abbrtitle="Known Exploited Vulnerability">KEV</abbr>), those with a high likelihood of exploitation (indicated by a high <abbrtitle="Exploit Prediction Scoring System">EPSS</abbr> score), and those with weaponized exploit code available</a>”</p>
1521
1547
<p><imgalt="Exploitation Known evidence or activity" src="../../assets/images/threat.png" width="400" /></p>
1522
1548
<ol>
1523
1549
<li>For those using <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Scores and Ratings, using <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> v3 Temporal Metric - Exploit Code Maturity (E) that <strong>supports Exploitation</strong> evidence is a small step with a relatively small (de)prioritization of CVEs.</li>
<h3id="refine-the-risk-based-prioritization-scheme-based-on-your-environment-and-your-data">Refine the <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Based Prioritization scheme based on your environment and your data.<aclass="headerlink" href="#refine-the-risk-based-prioritization-scheme-based-on-your-environment-and-your-data" title="Permanent link">¶</a></h3>
1531
1557
<ol>
1532
1558
<li>Use CVEs detected in your Incident Response, Bug Bounty, PenTesting findings) to inform your <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr>.</li>
1533
-
<li>Start by picking an <abbrtitle="Exploit Prediction Scoring System">EPSS</abbr> Threshold around 10%, and adjust based on your <abbrtitle="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr> data and your capacity to <abbrtitle="The neutralization or elimination of a vulnerability or the likelihood of its exploitation.">remediate</abbr> the CVEs above that Threshold (in conjunction with <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Severity or other <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> factors) per [Remediation Policy for an Enterprise](../epss/EPSS_Thresholds.md#remediation-policy-for-an-enterprise</li>
<li>Assess <ahref="../epss/Applying_EPSS_to_your_environment/#epss-for-your-environment"><abbrtitle="Exploit Prediction Scoring System">EPSS</abbr> for YOUR Environment</a></li>
1561
+
<li>Start by picking an <abbrtitle="Exploit Prediction Scoring System">EPSS</abbr> Threshold around 10%, and adjust based on your <abbrtitle="CVE Common Vulnerability and Exposures. A standardized list of publicly known vulnerabilities and exposures maintained by the MITRE Corporation.">CVE</abbr> data and your capacity to <abbrtitle="The neutralization or elimination of a vulnerability or the likelihood of its exploitation.">remediate</abbr> the CVEs above that Threshold (in conjunction with <abbrtitle="Common Vulnerability Scoring System Standard. A framework for scoring the severity of vulnerabilities based on factors such as exploitability and impact.">CVSS</abbr> Severity or other <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> factors) per <ahref="../../epss/EPSS_Thresholds/#remediation-policy-for-an-enterprise">Remediation Policy for an Enterprise</a></li>
1562
+
</ol>
1563
+
</li>
1534
1564
</ol>
1535
1565
<h3id="be-careful-with-proprietary-risk-based-prioritization-schemes">Be Careful with Proprietary <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Based Prioritization Schemes<aclass="headerlink" href="#be-careful-with-proprietary-risk-based-prioritization-schemes" title="Permanent link">¶</a></h3>
1536
1566
<p>If you <strong>implement</strong> a proprietary <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> Based Prioritization scheme, keep the following in mind:</p>
0 commit comments