Users responsible for prioritizing remediation efforts have several tools and frameworks available to them: CVSS, EPSS, SSVC, and more. While these all take different approaches, they have one thing in common: they assess the characteristics of a vulnerability in some way, and produce a score or recommendation, so that users can prioritize accordingly. These tools can all be useful, and have their place in vulnerability management, but because they typically focus on the vulnerability, rather than the user, their outputs can lack context, be misunderstood or misused, and may have important caveats.
In this talk, I’ll explore a proof-of-concept framework I've developed to address these problems, with a working title of PRACTICE (Prioritizing Remediation by Aggregating Customized and Tailored Information - a Conceptual Example). Before I get to PRACTICE, I’ll provide some context by briefly walking through CVSS, EPSS, SSVC, the KEV Catalog, CVEMap, and other tools and frameworks in the context of prioritization – discussing the results they produce, their drawbacks, and what they tell (and don't tell) users.
I’ll then move on to the main part of the talk: PRACTICE itself. PRACTICE is an experimental, transparent methodology for remediation prioritization, which takes a novel approach to the problem by putting the user and their unique environment - rather than vulnerabilities and their characteristics - at the center of the issue. It allows highly granular, customized input (via external configuration files, which can also be customized) about a user’s specific environment, priorities, and circumstances relating to a given vulnerability - including attack vectors; security controls and their coverage and configuration; impact; remediation effort and the potential for disruption; and more. All the inputs in each of these categories can be weighted individually, so that users get an informed understanding of how a vulnerability affects them uniquely – therefore enabling them to prioritize on a completely tailored basis.
As for the output, there are no calculations, no scores, and no recommendations. Instead, PRACTICE produces a visual, colour-coded, at-a-glance summary of a user’s answers, providing a simple graphical decision-making aid for how a vulnerability might affect their organization, based on their security posture and priorities in relation to that specific vulnerability. Unlike most other tools and frameworks, the whole idea is that, by design, two organizations might see completely different outputs for the same vulnerability, and can therefore prioritize accordingly.
After walking through the philosophy and design of PRACTICE, I’ll show some demos of prioritizing the remediation of some real vulnerabilities, from the perspectives of some hypothetical organizations with different security postures and priorities; discuss future research efforts and the PRACTICE to-do list; talk about how the PRACTICE approach could work at-scale; and encourage attendees to get involved with contributing to the development of PRACTICE as I continue to think about and build on this proof-of-concept.
Matt Wixey is a senior threat researcher at Sophos, where he conducts and reports on security and threat intelligence research. He previously led cybersecurity R&D capabilities at a professional services firm and a law enforcement agency, digging into emerging attack vectors, vulnerabilities, and new technologies. Matt has presented original research at multiple conferences, including Black Hat USA, Black Hat Europe, DEF CON, ISF Annual Congress, 44Con, and BruCon.
