Everyone struggles with identifying the “right” vulnerabilities to patch. It’s a near universal problem. We are all wondering, “Which vulnerabilities in my long queue are going to get me?”<\/p>\n
Most organizations calculate a CVSS<\/a> (base score or amended) which a solid body of research starting with Alloddi & Massacci, 2014, demonstrates is inadequate to the task.<\/p>\n Exploit Prediction Scoring System (EPSS<\/a>) is based in the above research, so it could provide a solution. But the web calculator cannot score each open vulnerability in our queue over time: we need to watch the deltas, not a point in time. There’s unfortunately, no working EPSS solution, despite the promise.<\/p>\n CISA have listed 300 “vulnerabilities -currently- being exploited in the wild” in Binding operational directive 22-01<\/a>.<\/p>\n Finally, CISA have given us a list that isn’t confined to a “Top 10”: Start with these!<\/p>\n Top 10 lists provide some guidance, but what if attackers exploit your #13?<\/p>\n 300 is an addressable number in my experience. Besides, you probably don’t have all of them in your apps. > 300. We all can do that much.<\/p>\n The CISA list provides a baseline, a “fix these, now” starting point of actively exploited issues that cuts through the morass of CVSS, EPSS, your security engineer’s discomfort, total vulnerabilities ==> organization “risk”. (If you’re running a programme based upon the total number of open vulnerabilities, you’re being misled.)<\/p>\n https:\/\/thehackernews.com\/2021\/12\/why-everyone-needs-to-take-latest-cisa.html<\/p>\n","protected":false},"excerpt":{"rendered":" Everyone struggles with identifying the “right” vulnerabilities to patch. It’s a near universal problem. We are all wondering, “Which vulnerabilities in my long queue are going to get me?” Most organizations calculate a CVSS (base score or amended) which a … Continue reading