The Agency for Cybersecurity and Infrastructure Security (CISA) released a new guide on categorizing stakeholder-specific vulnerabilities (SSVC).
This vulnerability management methodology is designed to assess vulnerabilities and prioritize remediation efforts based on exploit status, security impacts, and prevalence of the affected product in a single system.
SSVC was first created by CISA in conjunction with Carnegie Mellon University Institute of Software Engineering (IES) in 2019.
In 2020, CISA then worked with SEI to develop its custom SSVC decision tree to examine vulnerabilities relevant to the United States Government (USG), as well as State, Local, Tribal, and Territory (SLTT) governments. and critical infrastructure entities.
According to the latest version of SSVC, its new implementation has allowed CISA to better prioritize its response to vulnerabilities and its vulnerability messaging to the public.
Writing about the new guide, CISA Executive Assistant Director Eric Goldstein said organizations of all sizes are challenged to manage the number and complexity of new vulnerabilities.
“Organizations with mature vulnerability management programs are looking for more efficient ways to triage and prioritize efforts. Small organizations struggle to understand where to start and how to allocate limited resources,” Goldstein wrote in a blog post.
“Fortunately, there is a path to more efficient, automated, and prioritized vulnerability management,” the security expert added.
Goldstein explained that organizations can now use CISA’s Custom SSVC Decision Tree Guide to prioritize a known vulnerability based on the evaluation of five decision points: exploitation status, technical impact, automatability, prevalence of mission and impact on public welfare.
“Based on reasonable assumptions for each decision point, a vulnerability will be categorized as Track, Track*, Attend, or Act. A description of each decision and value can be found on the new CISA. SSVC webpage“, concluded Goldstein.
New guidelines come weeks after CISA published a separate report outlining baseline cybersecurity performance objectives (CPGs) for all critical infrastructure sectors.
