March 2023 Summaries

The Exploit Prediction Scoring System (EPSS) is an emerging technology developed by the Forum of Incident Response and Security Teams (FIRST) for estimating the likelihood of a software vulnerability being exploited in the wild. It provides a probability score between 0 and 1, with higher scores indicating a greater probability of exploitation. EPSS is often compared to the Common Vulnerability Scoring System (CVSS), which measures severity based on principal characteristics of a vulnerability. Researchers have found that EPSS outperforms CVSS in terms of reduction in effort for vulnerabilities with a base CVSS above 9.0. However, EPSS should not be considered as a comprehensive solution to all vulnerability prioritization challenges and should be used alongside other vulnerability management techniques such as business impact analysis and fix availability assessment. By adopting an integrated approach to vulnerability prioritization, organizations can make better-informed decisions and allocate resources more effectively to protect their systems and data from potential threats.

Software Bill of Materials (SBOM) is a comprehensive list of components used in the development of software, including their versions and sources. It has gained prominence due to increasing risks associated with third-party dependencies, which can introduce vulnerabilities into software projects. SBOM provides detailed visibility into these dependencies, helping organizations identify potential threats and mitigate them effectively. Two industry standards for generating SBOMs are SPDX and CycloneDX, both of which can be expressed in various formats like JSON, YAML, and XML. As awareness grows, customers may start requesting SBOMs with software products to better understand their risks and compatibility with other supply chains.