Vulnerability Prioritization

The 5% Rule:
  └─ 5% of vulnerabilities account for 95% of exploitation
  └─ Most CVSS Critical vulnerabilities are never exploited
  └─ Some CVSS Medium vulnerabilities are weaponized immediately
  └─ Prioritization based on CVSS alone is not risk-based

EPSS Score:
  └─ 0.0 (very unlikely) to 1.0 (almost certain to be exploited)
  └─ Updated daily based on real-world exploitation data
  └─ Measures exploitation LIKELIHOOD, not impact

Example EPSS Scores:
  └─ CVE-2023-44487 (HTTP/2 Rapid Reset): EPSS 0.97 (97% chance)
  └─ CVE-2024-1709 (ScreenConnect auth bypass): EPSS 0.95
  └─ Average vulnerability: EPSS 0.002 (0.2% chance)

KEV Catalog:
  └─ Maintained by CISA (US Cybersecurity & Infrastructure Security Agency)
  └─ Vulnerabilities confirmed as actively exploited in the wild
  └─ Binding Operational Directive (BOD) 22-01: Federal agencies must patch KEV within 14 days
  └─ ~1,000+ vulnerabilities in the catalog (growing daily)

Priority: KEV vulnerabilities should be patched BEFORE any other vulnerability,
regardless of CVSS score. If it's being exploited, it poses active risk.

Risk Score = f(CVSS, EPSS, KEV, AssetCriticality, ThreatContext)

Tier 1 — IMMEDIATE (Patch within 24-48 hours):
  └─ CVE in KEV catalog AND on critical asset
  └─ CVE with EPSS > 0.90 AND CVSS > 9.0 AND on internet-facing system
  └─ Active exploit observed in the wild targeting your industry

Tier 2 — HIGH (Patch within 7 days):
  └─ CVE in KEV catalog (any asset)
  └─ CVE with EPSS > 0.50 AND CVSS > 7.0 AND on critical asset
  └─ Newly published RCE with public exploit code

Tier 3 — MEDIUM (Patch within 30 days):
  └─ CVSS > 7.0 on critical asset
  └─ CVSS > 9.0 on non-critical asset
  └─ EPSS > 0.50 any asset

Tier 4 — LOW (Patch within 90 days):
  └─ CVSS < 7.0 on non-critical asset
  └─ Low EPSS, not in KEV

Asset Criticality Tiers:

Tier 0 — Critical:
  └─ Internet-facing systems
  └─ PII/PHI databases
  └─ Authentication systems (AD, SSO)
  └─ Payment processing
  └─ Patch target: CVSS Critical in 7 days, High in 30 days

Tier 1 — High:
  └─ Internal production servers
  └─ Internal databases
  └─ CI/CD systems
  └─ Patch target: CVSS Critical in 14 days, High in 45 days

Tier 2 — Medium:
  └─ Development environments
  └─ Corporate workstations
  └─ Patch target: CVSS Critical in 30 days, High in 60 days

Tier 3 — Low:
  └─ Test environments (isolated)
  └─ Legacy systems (in process of decommission)

Why CVSS Alone Fails for Prioritization:
  └─ No exploitation likelihood: CVSS measures technical severity, not whether anyone is exploiting it
  └─ No business context: CVSS 9.0 on a test server is lower risk than CVSS 7.0 on an internet-facing payment system
  └─ No temporal scoring: A CVE published today should be scored differently than one from 5 years ago
  └─ No environmental scoring: Most organisations never customize the environmental metrics
  └─ Score inflation: Vendors push for higher CVSS scores, leading to "CVSS fatigue"
  └─ Binary thinking: Organisations often treat CVSS 6.9 (Medium) as "ignore" and CVSS 7.0 (High) as "must fix" — a 0.1 difference should not drive prioritization

#!/usr/bin/env python3
"""Automated vulnerability prioritization engine"""

import requests
import json
from datetime import datetime, timedelta

# Configuration
KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
EPSS_API = "https://api.first.org/data/v1/epss"
ASSET_CRITICALITY = {
    "internet-facing": 200,
    "critical": 100,
    "high": 50,
    "medium": 20,
    "low": 5
}

def fetch_kev():
    """Fetch CISA KEV catalog"""
    resp = requests.get(KEV_URL)
    return {v['cveID'] for v in resp.json()['vulnerabilities']}

def fetch_epss(cve_ids):
    """Fetch EPSS scores for CVEs"""
    cv = ','.join(cve_ids[:100])  # EPSS API limits to 100 per request
    resp = requests.get(f"{EPSS_API}?cve={cv}")
    scores = {}
    for item in resp.json().get('data', []):
        scores[item['cve']] = float(item['epss'])
    return scores

def prioritize(vulnerabilities):
    """Calculate risk score and priority tier"""
    kev = fetch_kev()
    results = []

    for vuln in vulnerabilities:
        risk_score = 0
        risk_score += vuln['cvss'] * 10  # CVSS contribution

        # EPSS contribution (if available)
        epss = vuln.get('epss', 0)
        risk_score += epss * 100

        # KEV bonus — being exploited NOW
        if vuln['cve'] in kev:
            risk_score += 500

        # Asset criticality
        asset = vuln.get('asset', 'medium')
        risk_score += ASSET_CRITICALITY.get(asset, 20)

        if risk_score >= 800:
            tier = "T1-IMMEDIATE"
            sla = "24-48 hours"
        elif risk_score >= 500:
            tier = "T2-HIGH"
            sla = "7 days"
        elif risk_score >= 200:
            tier = "T3-MEDIUM"
            sla = "30 days"
        else:
            tier = "T4-LOW"
            sla = "90 days"

        results.append({
            'cve': vuln['cve'],
            'risk_score': risk_score,
            'tier': tier,
            'sla': sla
        })

    # Sort by risk score descending
    return sorted(results, key=lambda x: x['risk_score'], reverse=True)

# Example usage
findings = [
    {"cve": "CVE-2024-1709", "cvss": 9.1, "asset": "internet-facing"},
    {"cve": "CVE-2023-44487", "cvss": 7.5, "asset": "critical"},
    {"cve": "CVE-2023-46604", "cvss": 10.0, "asset": "internet-facing"},
    {"cve": "CVE-2024-xxxx", "cvss": 9.8, "asset": "low"},
    {"cve": "CVE-2023-xxxx", "cvss": 5.0, "asset": "high"},
]

# Add EPSS scores
cves = [f['cve'] for f in findings]
epss_scores = fetch_epss(cves)
for f in findings:
    f['epss'] = epss_scores.get(f['cve'], 0)

priority_list = prioritize(findings)
for p in priority_list:
    print(f'{p["cve"]:20s} Score: {p["risk_score"]:4d} → {p["tier"]:15s} SLA: {p["sla"]}')

Business Context Factors:

Revenue Impact:
  └─ Does this system process payments? (PCI scope)
  └─ Is downtime of this system revenue-critical?
  └─ Are there contractual SLAs for this system?

Regulatory Impact:
  └─ Does this system handle PII/PHI? (GDPR, HIPAA scope)
  └─ Is this system in-scope for SOC 2, PCI DSS, or SOX?
  └─ What are the regulatory penalties for a breach?

Reputational Impact:
  └─ Is this system customer-facing?
  └─ Would a breach of this system make headlines?
  └─ Is this a high-visibility system (executive, board, investor-facing)?

Operational Impact:
  └─ Is this a single point of failure?
  └─ Are there compensating controls already in place?
  └─ Can the system be quickly taken offline if needed?

Total Vulnerability Risk =
    (CVSS_Score × 0.3) +
    (Exploitability × 0.25) +    # EPSS, public PoC, KEV
    (Asset_Criticality × 0.25) +  # Internet-facing, PII, revenue-impact
    (Business_Impact × 0.20)      # Regulatory, reputational, operational

Where:
    Exploitability = 100 (KEV) | 70 (public PoC) | 50 (theoretical) | 0 (none)
    Asset_Criticality = 100 (internet-facing + PII) | 70 (critical internal) | 30 (internal) | 10 (test)
    Business_Impact = 100 (breach = existential) | 70 (major fine) | 30 (minor fine) | 10 (no impact)

Level 1 — Initial (Reactive):
  └─ Scan: Ad-hoc scanning (no schedule)
  └─ Prioritization: Ignore until something breaks or auditor asks
  └─ Remediation: When forced (breach, audit finding)
  └─ Metrics: None
  └─ Key risk: Significant unknown vulnerabilities in production

Level 2 — Defined (Scheduled):
  └─ Scan: Monthly scheduled scans on production assets
  └─ Prioritization: CVSS-based (fix all Critical)
  └─ Remediation: Within 30-90 days
  └─ Metrics: Scan coverage, findings per asset
  └─ Key risk: Prioritization by CVSS alone leads to wasted effort

Level 3 — Managed (Risk-Based):
  └─ Scan: Weekly scan with authenticated scanning
  └─ Prioritization: CVSS + EPSS + KEV + asset criticality
  └─ Remediation: SLA-based (Critical 7 days, High 30 days)
  └─ Metrics: Mean time to remediate, fix rate, recurrence rate
  └─ Key risk: Container/cloud scanning may not be fully integrated

Level 4 — Optimized (Continuous):
  └─ Scan: Continuous scanning + CI/CD pipeline integration
  └─ Prioritization: Fully automated risk scoring with business context
  └─ Remediation: Automated patching for known-exploited vulnerabilities
  └─ Metrics: Predictive risk scoring, trend analysis, SLA compliance > 95%
  └─ Key risk: Staying current with evolving threat landscape