Vulnerabilities & Threats: Questions and Answers
CVEs, zero-days, CVSS, EPSS, the CISA KEV catalog, malware, social engineering, MITRE ATT&CK and zero trust.
What is a CVE?
A CVE (Common Vulnerabilities and Exposures) ID is a unique identifier, such as CVE-2024-12345, assigned to a publicly disclosed security vulnerability. It lets vendors, researchers and defenders refer to the same flaw without confusion. The CVE Program is sponsored by CISA and operated with MITRE.
Full answer and next stepsWhat is a zero-day vulnerability?
A zero-day is a vulnerability that attackers know about or exploit before the vendor has released a fix, so defenders have had "zero days" to patch. Once a patch exists, the urgent job is to install it, because attackers quickly target systems that remain unpatched.
Full answer and next stepsWhat is CISA’s Known Exploited Vulnerabilities (KEV) catalog?
The KEV catalog is CISA’s list of vulnerabilities with reliable evidence of active exploitation. US federal civilian agencies must fix them by set deadlines, and CISA recommends every organization use the catalog to prioritize patching.
Full answer and next stepsWhat does a CVSS score mean?
CVSS (Common Vulnerability Scoring System) rates the technical severity of a vulnerability from 0 to 10, based on factors such as how it is exploited and its impact. It measures severity, not risk: a high score does not mean the flaw is being exploited or that it matters in your environment.
Full answer and next stepsWhat is EPSS and how is it different from CVSS?
EPSS (Exploit Prediction Scoring System), maintained by FIRST, estimates the probability that a vulnerability will be exploited in the wild in the next 30 days. CVSS describes how bad a flaw could be; EPSS estimates how likely it is to be used, which helps prioritize long patch lists.
Full answer and next stepsHow should I prioritize which vulnerabilities to patch first?
Patch known exploited vulnerabilities first, especially on internet-facing systems, then flaws with high exploitation likelihood (EPSS) and high severity (CVSS) on important assets. Severity alone produces too many "critical" items to act on.
Full answer and next stepsWhat is malware and what are the main types?
Malware is software designed to harm or gain unauthorized access to a device or network. Common types include ransomware, information stealers that take passwords and session cookies, trojans disguised as legitimate apps, spyware, and botnet malware that turns devices into tools for other attacks.
Full answer and next stepsWhat is the MITRE ATT&CK framework?
MITRE ATT&CK is a free, public knowledge base of adversary tactics and techniques based on real-world observations, such as phishing for initial access or credential dumping. Defenders use it to plan detections, map coverage gaps and structure investigations.
Full answer and next stepsWhat is zero trust security?
Zero trust is a security approach that does not grant access based on network location. Every request is verified using identity, device health and context, and users get only the access they need. It replaces the idea that anything inside the office network can be trusted.
Full answer and next stepsGo deeper
Step-by-step articles on this subject are in the SOC guides.