You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<li><ahref="../../risk/Log4Shell/">Log4Shell Example</a> for an example of a <abbrtitle="Cybersecurity & Infrastructure Security Agency">CISA</abbr><abbrtitle="Known Exploited Vulnerability">KEV</abbr> entry.</li>
1263
1355
</ul>
1264
1356
</div>
1357
+
<h2id="cisa-kev_1"><abbrtitle="Cybersecurity & Infrastructure Security Agency">CISA</abbr><abbrtitle="Known Exploited Vulnerability">KEV</abbr><aclass="headerlink" href="#cisa-kev_1" title="Permanent link">¶</a></h2>
1265
1358
<divclass="admonition quote">
1266
1359
<pclass="admonition-title">Quote</p>
1267
1360
<p>For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity — <abbrtitle="Cybersecurity & Infrastructure Security Agency">CISA</abbr> maintains the authoritative source of vulnerabilities that have been exploited in the wild: the Known Exploited Vulnerability (<abbrtitle="Known Exploited Vulnerability">KEV</abbr>) catalog <ahref="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">https://www.cisa.gov/known-exploited-vulnerabilities-catalog</a>. </p>
<h2id="criteria-for-cisa-to-add-a-vulnerability-to-the-kev-catalog">Criteria For Cisa To Add A Vulnerability To The Kev Catalog<aclass="headerlink" href="#criteria-for-cisa-to-add-a-vulnerability-to-the-kev-catalog" title="Permanent link">¶</a></h2>
1273
1367
<divclass="admonition info">
1274
1368
<pclass="admonition-title">There are three criteria for <abbrtitle="Cybersecurity & Infrastructure Security Agency">CISA</abbr> to add a vulnerability to the <abbrtitle="Known Exploited Vulnerability">KEV</abbr> catalog</p>
<p>“All federal civilian executive branch (FCEB) agencies are required to <abbrtitle="The neutralization or elimination of a vulnerability or the likelihood of its exploitation.">remediate</abbr> vulnerabilities in the <abbrtitle="Known Exploited Vulnerability">KEV</abbr> catalog within prescribed timeframes under Binding Operational Directive (BOD) 22-01, Reducing the Significant <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> of Known Exploited Vulnerabilities. Although not bound by BOD 22-01, every organization, including those in state, local, tribal, and territorial (SLTT) governments and <strong>private industry can significantly strengthen their security and resilience posture by prioritizing the remediation of the vulnerabilities listed in the <abbrtitle="Known Exploited Vulnerability">KEV</abbr> catalogue as well</strong>. <abbrtitle="Cybersecurity & Infrastructure Security Agency">CISA</abbr> strongly recommends all stakeholders include a requirement to immediately address <abbrtitle="Known Exploited Vulnerability">KEV</abbr> catalogue vulnerabilities as part of their vulnerability management plan.</p>
<li><strong>Known Actively Exploited in the wild</strong><ol>
2132
-
<li><abbrtitle="Cybersecurity & Infrastructure Security Agency">CISA</abbr><abbrtitle="Known Exploited Vulnerability">KEV</abbr> lists <strong>a subset</strong> of known actively
2133
-
exploited Vulnerabilities in the wild.</li>
2132
+
<li><ahref="#cisa_kev-cisa_kev"><abbrtitle="Cybersecurity & Infrastructure Security Agency">CISA</abbr><abbrtitle="Known Exploited Vulnerability">KEV</abbr></a> lists <strong>a subset</strong> of known actively
2133
+
exploited Vulnerabilities in the wild. </li>
2134
+
<li><ahref="https://vulncheck.com/kev">Vulncheck <abbrtitle="Known Exploited Vulnerability">KEV</abbr></a> lists additional known actively exploited Vulnerabilities in the wild (and includes <abbrtitle="Cybersecurity & Infrastructure Security Agency">CISA</abbr><abbrtitle="Known Exploited Vulnerability">KEV</abbr> CVEs)</li>
2134
2135
<li><strong>There isn't an authoritative common public list of ALL Vulnerabilities that are Known Actively Exploited in the wild.</strong></li>
2135
2136
</ol>
2136
2137
</li>
@@ -2420,6 +2421,11 @@ <h2 id="risk-data_sources-likelihood-of-exploit-data-sources">Likelihood of Expl
@@ -2436,6 +2442,11 @@ <h2 id="risk-data_sources-likelihood-of-exploit-data-sources">Likelihood of Expl
2436
2442
</tr>
2437
2443
</tbody>
2438
2444
</table>
2445
+
<divclass="admonition note">
2446
+
<pclass="admonition-title">Note</p>
2447
+
<p><ahref="https://vulncheck.com/press/vulncheck-kev">Vulncheck <abbrtitle="Known Exploited Vulnerability">KEV</abbr></a> was launched just before this guide was released.
2448
+
So it has not been included in any analysis for this guide initial release - but will likely be for future releases.</p>
2449
+
</div>
2439
2450
<p><ahref="https://www.first.org/epss/api"><abbrtitle="Exploit Prediction Scoring System">EPSS</abbr> Scores</a> are available for all published CVEs - and cover the range of Likelihood of Exploit from 0 to 100%. </p>
2440
2451
<divclass="admonition tip">
2441
2452
<pclass="admonition-title">The population sizes for Likelihood of Exploit decrease, as Likelihood of Exploit increases</p>
<li><ahref="#risk-log4shell">Log4Shell Example</a> for an example of a <abbrtitle="Cybersecurity & Infrastructure Security Agency">CISA</abbr><abbrtitle="Known Exploited Vulnerability">KEV</abbr> entry.</li>
3842
3853
</ul>
3843
3854
</div>
3855
+
<h2id="cisa_kev-cisa_kev-cisa-kev_1"><abbrtitle="Cybersecurity & Infrastructure Security Agency">CISA</abbr><abbrtitle="Known Exploited Vulnerability">KEV</abbr><aclass="headerlink" href="#cisa_kev-cisa_kev-cisa-kev_1" title="Permanent link">¶</a></h2>
3844
3856
<divclass="admonition quote">
3845
3857
<pclass="admonition-title">Quote</p>
3846
3858
<p>For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity — <abbrtitle="Cybersecurity & Infrastructure Security Agency">CISA</abbr> maintains the authoritative source of vulnerabilities that have been exploited in the wild: the Known Exploited Vulnerability (<abbrtitle="Known Exploited Vulnerability">KEV</abbr>) catalog <ahref="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">https://www.cisa.gov/known-exploited-vulnerabilities-catalog</a>. </p>
<h2id="cisa_kev-cisa_kev-criteria-for-cisa-to-add-a-vulnerability-to-the-kev-catalog">Criteria For Cisa To Add A Vulnerability To The Kev Catalog<aclass="headerlink" href="#cisa_kev-cisa_kev-criteria-for-cisa-to-add-a-vulnerability-to-the-kev-catalog" title="Permanent link">¶</a></h2>
3852
3865
<divclass="admonition info">
3853
3866
<pclass="admonition-title">There are three criteria for <abbrtitle="Cybersecurity & Infrastructure Security Agency">CISA</abbr> to add a vulnerability to the <abbrtitle="Known Exploited Vulnerability">KEV</abbr> catalog</p>
<p>“All federal civilian executive branch (FCEB) agencies are required to <abbrtitle="The neutralization or elimination of a vulnerability or the likelihood of its exploitation.">remediate</abbr> vulnerabilities in the <abbrtitle="Known Exploited Vulnerability">KEV</abbr> catalog within prescribed timeframes under Binding Operational Directive (BOD) 22-01, Reducing the Significant <abbrtitle="The likelihood of a vulnerability being exploited and the potential impact of such an exploit on an organization.">Risk</abbr> of Known Exploited Vulnerabilities. Although not bound by BOD 22-01, every organization, including those in state, local, tribal, and territorial (SLTT) governments and <strong>private industry can significantly strengthen their security and resilience posture by prioritizing the remediation of the vulnerabilities listed in the <abbrtitle="Known Exploited Vulnerability">KEV</abbr> catalogue as well</strong>. <abbrtitle="Cybersecurity & Infrastructure Security Agency">CISA</abbr> strongly recommends all stakeholders include a requirement to immediately address <abbrtitle="Known Exploited Vulnerability">KEV</abbr> catalogue vulnerabilities as part of their vulnerability management plan.</p>
@@ -1432,6 +1437,11 @@ <h2 id="likelihood-of-exploit-data-sources">Likelihood of Exploit Data Sources<a
1432
1437
</tr>
1433
1438
</tbody>
1434
1439
</table>
1440
+
<divclass="admonition note">
1441
+
<pclass="admonition-title">Note</p>
1442
+
<p><ahref="https://vulncheck.com/press/vulncheck-kev">Vulncheck <abbrtitle="Known Exploited Vulnerability">KEV</abbr></a> was launched just before this guide was released.
1443
+
So it has not been included in any analysis for this guide initial release - but will likely be for future releases.</p>
1444
+
</div>
1435
1445
<p><ahref="https://www.first.org/epss/api"><abbrtitle="Exploit Prediction Scoring System">EPSS</abbr> Scores</a> are available for all published CVEs - and cover the range of Likelihood of Exploit from 0 to 100%. </p>
1436
1446
<divclass="admonition tip">
1437
1447
<pclass="admonition-title">The population sizes for Likelihood of Exploit decrease, as Likelihood of Exploit increases</p>
Copy file name to clipboardExpand all lines: risk/Understanding_Risk/index.html
+3-2Lines changed: 3 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -1650,8 +1650,9 @@ <h3 id="threat-likelihood-of-exploit-data-sources">Threat Likelihood of Exploit
1650
1650
</ol>
1651
1651
</li>
1652
1652
<li><strong>Known Actively Exploited in the wild</strong><ol>
1653
-
<li><abbrtitle="Cybersecurity & Infrastructure Security Agency">CISA</abbr><abbrtitle="Known Exploited Vulnerability">KEV</abbr> lists <strong>a subset</strong> of known actively
1654
-
exploited Vulnerabilities in the wild.</li>
1653
+
<li><ahref="../../cisa_kev/cisa_kev/"><abbrtitle="Cybersecurity & Infrastructure Security Agency">CISA</abbr><abbrtitle="Known Exploited Vulnerability">KEV</abbr></a> lists <strong>a subset</strong> of known actively
1654
+
exploited Vulnerabilities in the wild. </li>
1655
+
<li><ahref="https://vulncheck.com/kev">Vulncheck <abbrtitle="Known Exploited Vulnerability">KEV</abbr></a> lists additional known actively exploited Vulnerabilities in the wild (and includes <abbrtitle="Cybersecurity & Infrastructure Security Agency">CISA</abbr><abbrtitle="Known Exploited Vulnerability">KEV</abbr> CVEs)</li>
1655
1656
<li><strong>There isn't an authoritative common public list of ALL Vulnerabilities that are Known Actively Exploited in the wild.</strong></li>
0 commit comments