Selelekela sa Sistimi ea ho Fumana Lintlha tsa Ponelopele ea Tšebeliso e Mpe #
Sistimi ea ho Bala Ponelopele ea Tšebeliso e Bonolo (EPSS) ke mohlala o tsamaisoang ke data o bolelang esale pele monyetla oa hore bofokoli bo sebelisoe hampe matsatsing a 30 a tlang. E ntlafalitsoe ke FIRST.org, EPSS e abela CVE ka 'ngoe lintlha tsa monyetla ho tloha ho 0 ho isa ho 1, e thusang lihlopha tsa tšireletso ho beha lintho pele ho latela kotsi ea sebele, eseng feela botebo ba khopolo-taba. Ho fapana le CVSS, e lekanyang tšusumetso, lintlha tsa EPSS li shebana le monyetla, e leng se etsang hore e be tsa bohlokoa bakeng sa taolo e sebetsang ea bofokoli.
Ka Hlakubele 2023, tsa morao-rao Phetolelo ea EPSS (v3) e qaliloe, e eketsa ts'ebetso ka 82% ho hlwayeng bofokoli bo ka sebelisoang hampe. Qetellong, sena se etsa hore e be sesebelisoa sa bohlokoa leanong lefe kapa lefe la ts'ireletso.
Tlhaloso:
EPSS ke eng? #
EPSS e bolela esale pele monyetla oa hore bahlaseli ba tla sebelisa bofokoli matsatsing a 30 a tlang. Lintlha li ntlafatsoa letsatsi le letsatsi, li thusa mekhatlo ho tsepamisa maikutlo bofokoling bo nang le kotsi e kholo. Lintlha li tloha ho 0 ho isa ho 1—lintlha tse phahameng li bontša monyetla o moholo oa ho sebelisoa hampe.
Sephetho sa EPSS Vulnerability ke eng 'me se baloa joang? #
Sephetho sa ho ba kotsing sa EPSS se u bolella hore na bahlaseli ba ka sebelisa bofokoli hakae matsatsing a 30 a tlang. Ho fapana le litsamaiso tsa setso tse lekanyang botebo feela, se totobatsa hore na ke mathata afe a bakang kotsi e potlakileng haholo, e le hore sehlopha sa hau se ka lokisa se bohlokoa ka ho fetisisa.
Sephetho sena se tloha ho 0 ho isa ho 1. Boleng bo haufi le 1 bo bolela hore bahlaseli ba ka 'na ba e shebana le eona haufinyane. Mohlala, phoso e nang le sephetho se tlase sa CVSS empa e le sephetho se phahameng sa EPSS e ka 'na ea hloka tlhokomelo e potlakileng hobane bahlaseli ba se ba ntse ba e batla.
Ka ho sebelisa EPSS, sehlopha sa hau se lula se tsepamisitse maikutlo litšokelong tsa lefats'e la nnete 'me se ntlafatsa tsela eo u laolang bofokoli ho pholletsa le hau pipeline.
The Sephetho sa EPSS e hula data ho tsoa mehloling e mengata, ho kenyeletsoa:
- Sesupo sa CVE: Sesupo se ikhethang se tsoang ho Lethathamo la CVE la MITRE e fanang ka lintlha tsa bohlokoa mabapi le bofokoli bo bong le bo bong.
- Sephetho sa EPSS: Sephetho sa monyetla se tloha ho 0 ho 1, e bontšang monyetla oa ho sebelisoa hampe.
- Boemo ba liperesente: Sena se beha lintlha tsa bofokoli ha li bapisoa le tse ling, e leng se fanang ka moelelo oa boemo ba eona ba kotsi bo lekanyelitsoeng.
Ka ntle ho lintlha tsa nako ea sebele, EPSS e boetse e fana ka lintlha tsa nalane, tse lumellang lihlopha ho latela mekhoa ea likotsi ha nako e ntse e ea le ho fetola maano a tsona ka ho latela. Kaha e ntlafatsoa letsatsi le letsatsi, lihlopha tsa tšireletso li ka lula li itšetleha ka lintlha tsa morao-rao ho etsa tlhaiso-leseling e nepahetseng.cisHo feta moo, lihlopha li ka khoasolla data ka mokhoa oa CSV, e leng se etsang hore ho be bonolo ho sekaseka bofokoli le ho beha pele boiteko ba tokiso.
Ka kakaretso, lintlha tsa bofokoli ba EPSS li matlafatsa lihlopha ho lula li le ka pele ho bahlaseli ka ho tsepamisa maikutlo bofokoli bo bakang kotsi e kholo maemong a sebele. Ka lintlafatso tsa letsatsi le letsatsi le lintlha tse tšepahalang tse tsoang mehloling e mengata, e fana ka mokhoa o sebetsang oa taolo ea bofokoli.
Kamoo Mohlala oa EPSS o Bolelang Pele Tšebeliso e Mpe ea ho ba Kotsing #
Sistimi ea ho Fumana Lintlha tsa Ponelopele e bolela esale pele monyetla oa ho sebelisoa hampe ka mokhoa oa mehato e mehlano:
- Boitsebiso ba Data: Ho bokella tlhahisoleseding ho tsoa mehloling e kang NVD, Sebelisa-DB, 'me CISA.
- Bopaki ba Tšebeliso e Mpe: Ho latela mesebetsi ea sebele ea ho sebelisa batho hampe.
- Koetliso ea Mohlala: Ho sebelisa ho ithuta ka mochini ho utloisisa kamano pakeng tsa bofokoli le tšebeliso e mpe.
- gogolo: Ho ntlafatsa ho nepahala ha mohlala ka ho tswela pele.
- Lintlafatso tsa Letsatsi le Letsatsi: Ho phatlalatsa lintlha tse nchafalitsoeng tsa bofokoli letsatsi le letsatsi, ho fa lihlopha temohisiso ea nako ea sebele.
EPSS khahlanong le CVSS: Phapang ke efe le hore na ke hobane'ng ha e le ea bohlokoa #
Leha e ka ba 'nete hore CVSS e shebane le tšusumetso ea khopolo-taba ea bofokoli, Sistimi ea Lintlha tsa Tlhahlobo ea Exploit e totobatsa monyetla oa tšebeliso e mpe lefatšeng la 'nete. Ka ho kopanya ka bobeli, lihlopha tsa tšireletso li ka etsa hore ho be bohlale le ho latela likotsi.cisli-ion.
- CVSS = e ka ba mpe hakae
- EPSS = ho na le monyetla o mokae oa hore ho etsahale
Ka lehlakoreng le leng, CVSS e hlalosa tshenyo e ka bang teng eo bofokodi bo ka e bakang. Ka lehlakoreng le leng, Exploit Prediction Scoring System e hlwaya hore na ke bofokodi bofe boo bahlaseli ba ka bo sebedisang haholo haufinyane. Ka hona, dihlopha tsa tshireletso tse sebedisang ditsamaiso tsena ka bobedi mmoho di ka beha bofokodi pele ka katleho le ho lokisa seo e hlileng e leng sa bohlokwa.
Bakeng sa lintlha tse ling mabapi le ho kopanya EPSS le CVSS, sheba Blog ea Xygeni mabapi le ho fumana lintlha ka CVE kapa e New Standard
Lisebelisoa tsa Tšireletso tsa Xygeni OSS: Li tsamaisoa ke EPSS #
Ho Xygeni, re sebelisa Sistimi ea ho Bala Lintlha tsa Exploit Prediction ho Open Source Security Tools Ho thusa lihlopha ho tsepamisa maikutlo bofokoding boo bahlaseli ba ka bo sebelisang haholo. Mona ke kamoo re sebelisang EPSS ho etsa hore taolo ea bofokodi e be bohlale:
- Ho fumana lintlha tsa CVE le kopanyo ea EPSS: Lisebelisoa tsa rona tsa OSS li kopanya Sistimi ea ho Bala Ponelopele ea Exploit le CVSS ho beha maemo a bofokoli ho latela monyetla oa bona oa ho sebelisoa hampe. Mohlala, re beha pele bofokoli bo kang CVE-2021-44228, e nang le lintlha tse phahameng tsa CVSS le lintlha tse phahameng tsa bofokoli ba EPSS.
- Tlhahlobo e Tsoetseng Pele ea Phihlello: Ha re hlwaye feela bofokodi. Re hlahloba hore na bo ka sebelisoa hampe tikolohong ea hau e itseng, re netefatsa hore sehlopha sa hau se tsepamisa maikutlo litšokelong tse ka sebelisoang le tse kotsi haholo.
- Litemoso tsa Nako ea Sebele le Tlhokomelo e Tsoelang Pele: Lisebelisoa tsa rona tsa OSS li lula li beha leihlo bofokoli bo bocha 'me li fana ka litemoso tsa nako ea sebele ha bofokoli bo kotsi bo hlaha. Mokhoa ona oa ho nka bohato o boloka sehlopha sa hau se le ka pele ho bahlaseli.
Sireletsa Software ea Hao: Leka Lisebelisoa tsa OSS tsa Xygeni ka Demo ea Mahala kapa Teko ea Mahala #
Na u se u loketse ho ntlafatsa taolo ea hau ea bofokoli? Lisebelisoa tsa Xygeni tsa OSS, tse tsamaisoang ke EPSS, li u thusa ho tsepamisa maikutlo litšokelong tse bohlokoa ka ho fetisisa. Kopa a demo or Leka kajeno ho bona kamoo re ka u thusang ho lula u le ka pele ho bahlaseli
Lipotso Asked hangata #
Ha e le hantle, lintlha tsa EPSS li lekanya monyetla oa hore bofokoli bo tla sebelisoa hampe matsatsing a 30 a tlang. Ka ho khetheha, lintlha tsena li tloha ho 0 ho isa ho 1. Ka lebaka leo, lintlha tse phahameng li bontša monyetla o moholo oa tšebeliso e mpe ea lefats'e la 'nete—ho bolelang hore lihlopha tsa tšireletso li ka beha pele bofokoli boo li lokelang ho bo sebetsana le bona pele ho latela kotsi ea 'nete, eseng feela botebo ba khopolo-taba.
EIt e emetse Exploit Prediction Scoring System. Ha e le hantle, ke mohlala o hakanyang monyetla oa hore bofokoli bo sebelisoe hampe. Ka lebaka leo, e thusa mekhatlo ho beha likarabo tsa ts'ireletso pele ho latela kotsi ea 'nete.
E ntjhafatswa letsatsi le letsatsi ho bontsha bohlale ba moraorao ba ditshoso le mesebetsi e di sebedisang hampe. Ka lebaka leo, dihlopha tsa tshireletso di dula di dumellana le dikotsi tse fetohang—haholoholo dibakeng tse fetohang moo nako e leng bohlokwa.
O ka fihlella lintlha tsa ho bolela esale pele tsa tšebeliso ka kotloloho ka har'a Xygeni—ha ho hlokahale hore o sebelise tse arohaneng dashboards. Sethala sa rona se sebedisa dintlha tsena ka boiketsetso ho beha pele bofokodi bo itshetlehileng hodima kotsi ya sebele, kahoo o lokisa seo ho ka etsahalang hore se sebediswe hampe pele.
The Bofokoli ba EPSS lintlha li bolela esale pele hore na ho ka etsahala hakae ho sebelisa bofokoli naheng. Kamehla e sebelisa lintlha tsa litšokelo tsa lefats'e la sebele, metadata ea CVE, le ML ho hakanya likotsi tse ka bang teng. Lintlha tse phahameng tsa bofokoli ba EPSS li bolela monyetla o moholo oa ho sebelisoa hampe matsatsing a 30 a tlang.
