Vulnerability Management: Assessing the Risks with CVSS, CISA KEV, EPSS, and SSVC

Vulnerability Basics

• Vulnerability risk assessment
• Vulnerability types and their causes
• Methods for addressing vulnerabilities

1. Vulnerability Severity Conversations

• Intro to determining severity with CVSS
• Making sense of the CVSS Vector String
• Attack method or vector when determining severity
• How attack complexity impacts severity
• How access or privileges required affects severity
• How user interaction affects severity
• Security Scope in CVSS v 3.1
• How impacts affect severity

2. Severity vs. Risk

• Severity and risk are not the same
• Challenges with CVSS and severity scores
• Vendor-specific severity scoring methodologies
• Other vulnerability scoring methodologies: KEV and EPSS
• Solution: Comparing vulnerabilty severity scores

3. Moving from Severity to Risk

• Why severity scores alone aren't enough
• Risk assessment basics
• Exploit availability
• Asset categorization
• Combining severity and risk to drive action
• Solution: Prioritize vulnerabilities for remediation

4. Stakeholder-Specific Vulnerability Categorization

• Intro to SSVC
• SSVC: Exploitation
• SSVC: Automatable
• SSVC: Technical impact
• SSVC: Mission prevalence and public well-being
• Using SSVC
• Solution: Using SSVC to prioritize vulnerabilities

5. Building a RIsk-Based Vulnerability Management Program

• Core components to a program
• Detect vulnerabilities
• Assess the risk
• Assign vulnerablities for remediation
• Remediate and confirm vulnerabilities
• Outliers: Handling celebrity vulnerabilities

Conclusion

• Just the beginning