@rsrinivasanhome wrote:1) A high CVSS threat mapped against a low value asset
Even a low-value asset can be used as a "jump box" to attack higher valued assets or to launch an internal denial-of-service attack.
2) A high CVSS threat mapped against a very very complex exploit which has very low probability.
That is already baked into the CVSS score.
We use the CVSS primarily to set a "remediation deadline", which is then adjusted primarily based on how publicly accessible the device is. So, a webserver in the DMZ may well get a same-day update, laptops "tomorrow night", and isolated assembly-line equipment may end up waiting for 3rd shift Sunday.
Since most mitigations are "patch and reboot", it really helps to have an automated patching system (e.g. WSUS).
We also strongly emphasize "if you can not afford downtime, invest in High-Availability and/or in network isolation".
