CVSS - Prioritization

rsrinivasanhome — Sun, 25 Aug 2024 05:33:17 GMT

Hi ,

We generally rate/ ranks our pen testing and other security Risks using the CVSS methodology . The big gap we find is that in certain cases we have

1) A high CVSS threat mapped against a low value asset

2) A high CVSS threat mapped against a very very complex exploit which has very low probability.

Has anyone tried the usage EPSS for this purpose ? Do teams use DREAD on top of CVSS ?

Let me know your thoughts .

Re: CVSS - Prioritization

denbesten — Mon, 26 Aug 2024 04:00:22 GMT

@rsrinivasanhome wrote:
1) A high CVSS threat mapped against a low value asset

Even a low-value asset can be used as a "jump box" to attack higher valued assets or to launch an internal denial-of-service attack.

2) A high CVSS threat mapped against a very very complex exploit which has very low probability.

That is already baked into the CVSS score.

We use the CVSS primarily to set a "remediation deadline", which is then adjusted primarily based on how publicly accessible the device is. So, a webserver in the DMZ may well get a same-day update, laptops "tomorrow night", and isolated assembly-line equipment may end up waiting for 3rd shift Sunday.

Since most mitigations are "patch and reboot", it really helps to have an automated patching system (e.g. WSUS).

We also strongly emphasize "if you can not afford downtime, invest in High-Availability and/or in network isolation".

topic CVSS - Prioritization in Threats

CVSS - Prioritization

Re: CVSS - Prioritization