Ngomhla we-17 kweyoKwindla, ngo-2025, iForam of Incident Response and Security Teams (FIRST) yakhupha i-EPSS Version 4, inyathelo elikhulu phambili ekulawuleni ubuthathaka bamanqaku e-EPSS. Ngokungafaniyo neemodeli zemveli ezifana ne-CVSS ezigxila kubukhali bethiyori, isakhelo samanqaku e-EPSS sixela kwangaphambili ukuba zeziphi iingxaki ezinokusetyenziswa kwiintsuku ezingama-30 ezizayo. Oku kunceda imibutho igxile kwizisongelo zokwenyani endaweni yokuchitha ixesha kwimiba engenampembelelo ingako.
Yintoni Entsha kwi-EPSS Version 4?
Inguqulelo yesine ye-EPSS izisa ulwazi olucacileyo lwe-exploit, idatha engcono, kunye nokubeka phambili izinto ngobuchule. Jay Jacobs (Ukhuseleko oluQhelekileyo) kwaye UQasim Arshad uhlaziyo olwabiweyo oluthatha i-EPSS v4 ukuya kwinqanaba elilandelayo. Ngenxa yoko, amaqela ngoku afumana imiqondiso ecacileyo nekhawulezayo yokuba ngabahlaseli banokujolisa phi ngokulandelayo.
Ubukrelekrele Obandisiweyo Bokuxhaphaza: I-EPSS ngoku ijonga idatha yokuxhaphazwa kwehlabathi lokwenyani malunga nobuthathaka obungaphezulu kwe-10,000 inyanga nenyanga—inyusa umngcipheko wokuqalacisioni ye Ubuthathaka bamanqaku e-EPSS iingqikelelo.
Ukuhlanganiswa kweMalware kunye ne-Endpoint: I-EPSS v4 yongeza i-telemetry evela kwiinkqubo zokufumanisa i-endpoint kunye nezixhobo zohlalutyo lwe-malware, ivumela amaqela okhuseleko ukuba abone Amanqaku e-EPSS iipateni ngokukhawuleza.
Umxholo weNgxaki eBanzi: Ikwahlalutya amakhulu emithombo yokhuseleko—ii-RSS feeds, ii-blogs, iiforam—ukubonelela ngolwazi olungcono malunga nezisongelo ezivelayo.
Uphuculo loKwahlulahlula: I-EPSS ngoku idibanisa ubuthathaka phantsi kweentlobo ezingama-22 eziphambili ze-CWE kwaye ayibandakanyi ii-CVE EZIJWAYWEYO, isusa ingxolo engeyomfuneko kwi EPSS uvavanyo lwamanqaku.
Ubungqina Bokusebenza Kakuhle Ngaphezulu kweCVSS: Izifundo ezizimeleyo zibonisa ukuba i-EPSS v4 inciphisa imizamo yokulungisa ngaphezulu kwezihlandlo ezisi-8 xa kuthelekiswa neendlela ezisekelwe kwi-CVSS, ingakumbi xa kubekwa phambili ubuthathaka obuphezulu.
Uyafuna ukuDive nzulu?
Ngaba ufuna ulwazi olupheleleyo ngolawulo lobuthathaka bamanqaku e-EPSS? Ungaphoswa sisikhokelo sethu samanyathelo ngenyathelo sokulungisa oko kubaluleke ngokwenene.
I-Xygeni + EPSS v4: Lungisa iiNgxaki eziBalulekileyo
I-Xygeni idibanisa amanqaku obuthathaka be-EPSS ngqo kubuthathaka bayo ii-funnels zokubeka phambili izintoNgoko ke endaweni yokusukelana nayo yonke inqaku eliphezulu le-CVSS, amaqela agxila kwizinto ezibalulekileyo ngokwenene.
Xa zidityanisiwe iindlela zokusebenzisa imali, ukufikelela lula, kunye nomxholo weshishini, izinto eziza kuqala ziyacaca. Ngenxa yoko, ubuthathaka obuvela kwi-EPSS obubangela umngcipheko wokwenyani buyalungiswa ngokukhawuleza.
Imodeli ye-Xygeni's Full-Stack Prioritization ibandakanya:
- Amanqaku okuxhatshazwa kwe-EPSS: Isebenzisa i-EPSS v4 ukuchonga iivektha zohlaselo ezinokubakho kwiintsuku ezingama-30 ezizayo.
- Ukufikelela Ngexesha Lokusebenza: Iqinisekisa ukuba ikhowudi ebuthathaka isebenza ngokwenene kwimveliso.
- Ingqiqo yoBunzima beCVSS: Yongeza umxholo obanzi malunga nempembelelo enokubakho kwinkqubo.
- Umxholo weShishini: Ihluza iziphumo ngokusekelwe kubunzulu, uvakalelo lwenkqubo, kunye nomngcipheko wokusebenza.
Kunye nohlalutyo lweXygeni, ezi ngcamango zivela ngqo ngaphakathi CI/CD pipelinekunye nomngcipheko dashboards. Ke ngoko, ukubekwa phambili kobuthathaka kuba yinto ezenzekelayo, yexesha langempela, kwaye kuhambelana nendlela isoftware eyakhiwe nesetyenziswa ngayo.
IiFunnels zoKubeka phambili: Iziko lakho loLawulo loBunzima be-EPSS Score
Okokuqala, ii-Xygeni's Prioritization Funnels zisebenzisa izihluzi ezineeleya kuzo zonke iziphumo—SAST, SCA, CI/CD uqwalaselo, IaC iitemplate, kunye neemfihlo. Ngenxa yoko, amaqela anokuchaza imithetho eyenziwe ngokwezifiso okanye eyakhiwe kwangaphambili ukuze aveze ngokuzenzekelayo ubuthathaka obufuna ingqalelo ngokwenene.
Ngaphezu koko, ii-funnels ezakhelwe ngaphakathi kwindawo nganye (SAST, IaC, CI/CD) kunciphisa kakhulu ixesha elichithwa ekucwangciseni iingxaki kwaye, kwangaxeshanye, kunceda ekunciphiseni ukudinwa. Ngenxa yoko, amaqela afumana iziphazamiso ezimbalwa, ukugubungela umngcipheko okungcono, kunye nokulungiswa ngokukhawuleza.
Iingcinga Final
Ngaphandle kwamathandabuzo, i-EPSS Version 4 imisela umlinganiselo omtsha wokubeka phambili izinto ezijolise ekusetyenzisweni kwezixhobo. Ngaphezu koko, xa zidityaniswe nokubonakala kwe-Xygeni ukusuka ekuqaleni ukuya ekupheleni kunye nokuzisebenzela ngokuzenzekelayo, ivula indlela ekrelekrele ngakumbi negxile ekulawuleni ubuthathaka.
Ubuninzi bezoyikiso bunokuba nzima kakhulu. Nangona kunjalo, ukugxila kwenza umahluko omkhulu. Yiyo loo nto ukuhlanganiswa kweXygeni ne-EPSS v4 kuqinisekisa ukuba ukubekwa phambili kwe-EPSS score vulnerability kuhambelana ngokugqibeleleyo nendlela amaqela anamhlanje akha ngayo, avavanya ngayo, kwaye athumela ngayo ikhowudi—ukuze alungise imiba efanelekileyo, ngoku.
