Vulnerability prioritization is the only way to properly deal with the enormous number of vulnerabilities that are published on a daily basis. Just because a CVE is rated as a 10 doesn’t necessarily mean that it is the highest priority to remediate at your company. I know this seems counter-intuitive, but there are several factors you need to take into account when prioritizing vulnerabilities:

• CISA’s KEV Catalog
• CVSS metrics:
  • Attack Vector
  • Attack Complexity
  • Privileges Required
• CVE score

CISA’s KEV Catalog

CISA created a known exploited vulnerability catalog that is invaluable when deciding which vulnerabilities to patch and by when. Essentially, when it’s discovered that hackers are exploiting a specific vulnerability, CISA will add it to the catalog with a due date. As you can see in Figure 8.3, CISA has the CVE ID, vendor, description, action to take, and due date. The due date is critical and needs...