Joye Purser: Prioritize Exploited Vulnerabilities, Then Likelihood and Severity
Summary
Cohesity’s Joye Purser recommends prioritizing active exploitation, then exploit likelihood and severity, while accounting for exposure and business impact. She also outlines remediation targets and cost-conscious defensive controls.
Key points
- Prioritize actively exploited vulnerabilities first, then exploit likelihood and technical severity; adjust for exposure, business criticality, and compensating controls.
- For critical, internet-facing vulnerabilities with known exploitation, Purser says a 24–72-hour remediation target is reasonable, though difficult for many mid-sized organizations.
- Emergency remediation may require interrupting release schedules, dedicating engineering resources, or accepting temporary service disruption; access restrictions or isolation can serve as compensating controls.
- Deception systems can create risk if they are connected to production, use reusable credentials or excessive privileges, or capture sensitive information without appropriate governance.
- Keep deception technology isolated, tightly permissioned, and monitored; avoid unnecessary trust relationships with production environments.
- For limited budgets, Purser recommends phishing-resistant MFA, identity hygiene, OT segmentation, restricted administrative access, protected and tested backups, and visibility into exposed assets.
Article Details
- Defense Focus
- Prioritize vulnerability remediation by active exploitation, then exploit likelihood, then technical severity, adjusted for asset exposure, business criticality, compensating controls, and potential consequences.
- Detection Methods
- Assess exposed assets and identify their owners.
- Evaluate vulnerabilities using active-exploitation status, exploit likelihood, and technical severity, in that order.
- Continuously monitor isolated deception systems.
- Data Sources
- KEV
- EPSS
- CVSS
- Asset exposure and ownership information
- Defensive Actions
- Target remediation within 24 to 72 hours for critical, internet-exposed vulnerabilities with known exploitation.
- Use pre-approved emergency procedures and coordinate security, IT, and application teams for urgent patching.
- When immediate patching is not possible, restrict access, disable the vulnerable feature, or isolate the system.
- Isolate deception environments, tightly limit their permissions, monitor them continuously, and avoid unnecessary trust relationships with production.
- Use phishing-resistant MFA for privileged and remote access; remove dormant accounts, restrict privileged access, enforce least privilege, and rotate or revoke credentials.
- Segment critical operational technology from corporate IT and eliminate unnecessary external access.
- Maintain protected backups of critical systems and test recovery.
- Establish authority and readiness to isolate systems during an incident.