Less panic patching, more precision
This article from Cisco Talos discusses a shift in cybersecurity threat intelligence prioritization, moving away from solely relying on CVSS scores to incorporate exploit prediction and broader data enrichment. The core message is to use the Exploit Prediction Scoring System (EPSS) alongside CVSS to assess the actual risk of vulnerabilities, rather than just their theoretical severity. Additionally, the article highlights the need for more comprehensive and timely vulnerability data, advocating for decentralized approaches like GCVE to supplement traditional sources like CISA's KEV catalog, and introduces Cisco Talos's new EvidenceForge tool for generating realistic synthetic security logs.
The article emphasizes a critical change in how cybersecurity teams approach vulnerability management. Traditionally, the Common Vulnerability Scoring System (CVSS) has been the dominant metric for prioritizing patching, focusing on the potential impact of a vulnerability. However, the author argues that CVSS alone is insufficient, as it only assesses the ‘badness’ of a vulnerability in theory, not its likelihood of being exploited. This is where the Exploit Prediction Scoring System (EPSS) comes into play, providing a probability of exploitation within the next 30 days, based on real-world signals. Combining CVSS and EPSS allows for a more informed triage process, directing resources to the most critical vulnerabilities.
The piece also addresses the challenges of obtaining timely and accurate vulnerability data. CISA's KEV catalog, while valuable, is centralized, conservative, and primarily focused on U.S. federal visibility. To address this, Cisco Talos promotes a decentralized approach called Global CVE (GCVE), which leverages multiple sources of exploitation evidence to provide a more complete picture. GCVE’s speed of enrichment and broader exploitation signal are key advantages over traditional NVD pipelines. Finally, the article introduces EvidenceForge, a new open-source tool from Cisco Talos designed to generate realistic synthetic security logs, addressing the shortage of high-quality, labeled datasets for threat hunting and detection validation.