The National Institute of Standards and Technology has published a white paper that establishes a metric for determining if a product vulnerability has been exploited. The NIST Cybersecurity White Paper, or CWSP, 41 describes the Likely Exploited Vulnerabilities, or LEV, calculation and how organizations can use it to guide their prioritization efforts, the agency said Monday.
LEV, according to NIST, can augment the Exploit Prediction Scoring System, or EPSS, and the Known Exploited Vulnerability, a.k.a. KEV, list.
A New Way to Address IT Vulnerabilities
The white paper offers two versions of the LEV equation: one that utilizes EPSS scores as predictors for 30-day windows as intended and one that divides the EPSS scores by 30 to create single-day predictions.
The second LEV equation, the document revealed, requires more computational resources, incorporates more EPSS scores and takes into account changing EPSS scores.
NIST warned that the LEV has an unknown margin of error. The equation uses the EPSS, which can be inaccurate because it does not include past vulnerability exploitation as an input into its model. Vulnerabilities exploited within 30 days will also not receive an EPSS score bump in a subsequent period.
The agency hopes that the white paper can also identify opportunities to improve popular systems used to determine vulnerability exploitation.
