Prioritizing Vulnerability Response with a Stakeholder Specific Vulnerability Categorization
summary
SSVC v2 defines role-specific decision trees (supplier, deployer, coordinator) that map coarse answers to concrete actions, with an example Rockwell RCE showing a CVSS base 9.8 reduced by situational checks. Analysts answer five questions (state of exploitation, exploitability, exposure, safety impact, utility) in under 20 minutes; some checks are automatable via Metasploit/ExploitDB/GitHub/KEV lookups and daily updates. The reference implementation outputs JSON and supports binding to CVE or VRDX; default trees enumerate 36 situations for clear, reproducible triage.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:10Stakeholder Specific Categorization
- 8:25Impact Metrics
- 15:16Decision Points
- 19:21Scoring Example
- 24:44Supplier Tree
- 27:04Questions
- 27:44Bind to a CV
- 29:26Are there tools available
- 30:26What is the CVSS score
- 33:59Recording decisions
related talks
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
32mOperationalizing SSVC
11mVulnerability Supply Chains
23mHitchhikers' Guide to the Vulniverse
27mEffective Vulnerability Management for a DevSecOps Pipeline
59mWho’s Vulnerability Is It Anyway? Harmonizing Stakeholder Roles in Vulnerability Management
43mThe Art of Vulnerability Management - Practical Application of Cyber Triage
45mVulntology - A Methodology to Characterize Vulnerabilities While Providing A Granular & Intuitive...