The concept of prioritization in vulnerability management is significant as it helps to support effective mitigation and remediation strategies across different organizational capability levels.
Abstract
With over 15,000 vulnerabilities already identified in 2023 and 25,227 in 2022, organizations are reliant upon the resources available to them. Organizations are increasingly overwhelmed by the volume of findings and the challenging task of triaging vulnerabilities to determine which to address first in a timely and well- judged manner.
As a result, there is a need for maturing vulnerability management processes and a shift away from traditional severity ratings. With the evolution of threat actor capabilities greatly influencing the rise of exploitation, it is important for organizations to implement sustainable frameworks and standards for prioritization in vulnerability management. This paper stands as the first iteration of a series of communications regarding vulnerability management, focusing on the importance of prioritization and its applicability to organizations using a variety of recommended concepts.
Executive Summary
Network security teams are often encumbered with the ongoing release of vulnerabilities that are
either publicly disclosed or identified as zero-days by vendors and security researchers. Each of these vulnerabilities’ severity and exploitability levels is associated with a Common Vulnerability Scoring System (CVSS) score and, often, with a Common Vulnerabilities and Exposures (CVE) number. These swaths of information have proven cumbersome and, at times, can pose a conundrum to organizations concerning their vulnerability management capabilities. Only 2-7 percent of all published vulnerabilities are ever exploited in the wild and, in many cases, are ignored due to a lack of prioritization.
The concept of prioritization in vulnerability management is significant as it helps to support effective mitigation and remediation strategies across different organizational capability levels. The correlation between prioritization and organizations’ capability level is closely aligned as it can help security teams communicate effectively with stakeholders, identify asset value, and develop remediation policies conducive to the continuity of business-critical systems. Prioritization is a process that spans all capability levels and allows security teams to properly allocate resources to address vulnerabilities associated with severity levels that exceed the organization’s risk appetite.