Vulnerability Statistics Snapshot

1. Most occurrences of a vulnerability with a minimum CVSS v3.0 score of 8.0;

2. Most occurrences of a vulnerability with a minimum EPSS score of 0.9.

The challenge here is precisely how to define “significant risk”. Should it be based on CVSS or EPSS? The result impacts prioritization in all cases.  First, let’s ‘set a clean slate’ by defining these terms:

• EPSS: The Exploit Prediction Scoring System (EPSS) is a data-driven effort for estimating the likelihood (probability) that a software vulnerability will be exploited in the wild. https://www.first.org/epss/
• CVSS: The Common Vulnerability Scoring System (CVSS) provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity. https://www.first.org/cvss/

• Additionally, consider this additional component that indicates those vulnerabilities ‘out in the wild’ of the Internet.
  CISA KEV: A maintained list by the Cybersecurity and Infrastructure Security Agency (CISA) of vulnerabilities known to be exploited on the Internet:
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog/

Note that estimating the most common occurrence of a vulnerability based on specific risk criteria can result in significant differences depending on the approach to estimating risk. In this case, we compare vulnerabilities using CVSS v3.0 and EPSS attributes. As a result, there is a significant difference in results between using a CVSS and EPSS selection criteria.  Top takeaways;

• 6 of the Top 20 vulnerabilities with a CVSS of 8.0 or above are listed on the CISA KEV (highlighted in the table below in blue); 
• 12 of the Top 20 vulnerabilities with an EPSS of 0.9 or above are listed in the CISA KEV  (highlighted in the table below in blue); 

• EPSS appears to be more aligned with CISA KEV than CVSS based on the sample space used; 
• EPSS covers more than 7,000 vulnerabilities, whilst CISA KEV currently contains 1,000+ vulnerabilities. 

Overall, a combination of CVSS and EPSS ratings is recommended when attempting to prioritize security vulnerabilities. Introducing threat intelligence mapping to discovered vulnerabilities would also improve pragmatic, laser-focused prioritization. Realize that CVSS v4.0 introduces new attributes, such as threat intelligence which should improve CVSS effectiveness. Realize that context matters when it comes to vulnerability prioritization – as not all vulnerabilities are created equal. It’s the business risk of these vulnerabilities that is most important.

Besides these industry-established risk-rating systems, Edgescan also delivers validated vulnerability data and quickly rates the severity level of each exposure using a proprietary scoring process called EVSS (Edgescan Validated Security Score). This is a key component of our Risk-based Vulnerability Management (RBVM) solution, which uses automation combined with human intelligence to uniquely test for vulnerabilities that cannot be uncovered through traditional vulnerability scanning alone. 

Based on this recent snapshot of information, I’d encourage you to consider this to optimize your vulnerability management program – and reduce any headaches in your remediation process.