Everyone struggles with identifying the “right” vulnerabilities to patch. It’s a near universal problem. We are all wondering, “Which vulnerabilities in my long queue are going to get me?”
Most organizations calculate a CVSS (base score or amended) which a solid body of research starting with Alloddi & Massacci, 2014, demonstrates is inadequate to the task.
Exploit Prediction Scoring System (EPSS) is based in the above research, so it could provide a solution. But the web calculator cannot score each open vulnerability in our queue over time: we need to watch the deltas, not a point in time. There’s unfortunately, no working EPSS solution, despite the promise.
CISA have listed 300 “vulnerabilities -currently- being exploited in the wild” in Binding operational directive 22-01.
Finally, CISA have given us a list that isn’t confined to a “Top 10”: Start with these!
Top 10 lists provide some guidance, but what if attackers exploit your #13?
300 is an addressable number in my experience. Besides, you probably don’t have all of them in your apps. > 300. We all can do that much.
The CISA list provides a baseline, a “fix these, now” starting point of actively exploited issues that cuts through the morass of CVSS, EPSS, your security engineer’s discomfort, total vulnerabilities ==> organization “risk”. (If you’re running a programme based upon the total number of open vulnerabilities, you’re being misled.)
https://thehackernews.com/2021/12/why-everyone-needs-to-take-latest-cisa.html