diff --git a/src/content/docs/vulnerability-management/understanding-prioritization.mdx b/src/content/docs/vulnerability-management/understanding-prioritization.mdx new file mode 100644 index 00000000000..ecf28c2fdae --- /dev/null +++ b/src/content/docs/vulnerability-management/understanding-prioritization.mdx @@ -0,0 +1,118 @@ +--- +title: Understanding vulnerability prioritization +metaDescription: Use Vulnerability Management to overcome blindspots and assign remediation to developers as a security team. +freshnessValidatedDate: never +--- + +import vmPriority from 'images/vuln-priority-security.webp' + +This document covers: + - Where to find priority ranks in Vulnerability Management + - What data factors into the priority ranks of vulnerabilities + +## Viewing priority rank in Vulnerability Management + +An image showing the vulnerabilities prioritization on the Vulnerability Management vulnerability list page. + +
+ **[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Vulnerability Management > (select vulnerabilities tab)** +
+ +The priority ranking is based on all known data about a vulnerability. The “reason to prioritize” column is a summary and weighting of key CVSS (Common Vulnerability Scoring System), EPSS ( Exploit Prediction Scoring System), IAST confirmed findings, and known active ransomware data. + +## Data influencing priority rank + + + + Severity is based on the vulnerability’s CVSS score. An open industry standard, CVSS uses a formula of several access and impact metrics to calculate the severity of the vulnerability. + + This table shows the tags we’ve assigned corresponding to CVSS scores. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
SeverityCVSS range
Critical9.0 - 10.0
High7.0 - 8.9
Medium4.0 - 6.9
Low0.1 - 3.9
Info / None0.0
+ + + Active ransomware are vulnerabilities that have been used in known ransomware campaigns. The severe economic and reputational impacts of ransomware incidents make these vulnerabilities a high priority. + + + Exploit probability scores are based on EPSS, which rates the probability that a vulnerability will be exploited in the wild. In these cases, there are known instances of threat actors taking advantage of the vulnerability. EPSS scores can look low out of context; however, security experts recommend giving higher priority to all vulnerabilities with an exploit probability above the 85th percentile. This indicates a significant risk that that vulnerability will be exploited. + + This table shows the tags we’ve assigned to each level of exploit probability. + + + + + + + + + + + + + + + + + + + + + +
Exploit probabilityEPSS percentile
Exploit extremely probable >95%
Exploit very probable >90%
Exploit probable >85%
+ + + IAST confirmed are vulnerabilities found in your custom code that are confirmed to actually be exploitable even if threat actors may not be aware of the exploit. + + + +### Example of ranking logic + +A vulnerability that’s "high" severity with an EPSS of “exploit probable” might rank higher than a vulnerability with a "critical" severity but an EPSS level that’s lower than an 85th percentile probability of exploitation. \ No newline at end of file diff --git a/src/images/vuln-priority-security.webp b/src/images/vuln-priority-security.webp new file mode 100644 index 00000000000..b33ee4c5adf Binary files /dev/null and b/src/images/vuln-priority-security.webp differ diff --git a/src/nav/vuln-management.yml b/src/nav/vuln-management.yml index 6f021ebb525..601eb2cebbe 100644 --- a/src/nav/vuln-management.yml +++ b/src/nav/vuln-management.yml @@ -3,6 +3,8 @@ path: /docs/vulnerability-management pages: - title: Get started with vulnerability management path: /docs/vulnerability-management/overview + - title: Understanding vulnerability prioritization + path: /docs/vulnerability-management/understanding-prioritization - title: Manage vulnerabilities as a developer path: /docs/vulnerability-management/dev-workflow - title: Manage vulnerabilities as a security team