Inkqubo yokuQwalasela ukuQwalasela ukuXhaswa (i-EPSS) itshintsha indlela amaqela okhuseleko anamhlanje ajongana ngayo nezisongelo. Kwingxoxo ekhulayo malunga i-cvss vs i-epss, utshintsho lucacile. Nangona i-CVSS igxininisa ubukhali, i-EPSS inika ingqalelo ekusebenziseni izinto kwihlabathi lokwenyani. Lo mahluko ubalulekile—kuba endaweni yokusabela kuyo yonke imiba enzima kakhulu, amaqela anokugxila kwinto abahlaseli abayisebenzisayo ngokwenene. Ngokusebenzisa amanqaku e-EPSS, imibutho iphucula indlela elawula ngayo ubuthathaka kwaye ilungise ezo zibeka umngcipheko wokwenyani.
Rhoqo ngonyaka, ngaphezulu Ii-CVE ezintsha ezingama-20,000 minyaka le. Kuyaqondakala ukuba, ukulandela yonke into kunzima. Amaqela amaninzi aphela ediniwe, echitha iiyure ehlola imiba esenokungaze ikhokelele ekuhlaselweni. Oku kubangela ukuchitha ixesha, iimpendulo ezicothayo, kunye noluhlu olukhulayo lwemisebenzi ebonakala ingapheli.
Kulapho i-eps vs i-cvss yenza impembelelo yokwenyani. I-EPSS itshintsha ingqwalasela kwinto kungenzeka ukuba yingozi kwintoni kunokwenzeka kuza kujoliswa kuye kungekudala. Ngenxa yoko, amaqela anokuthatha amanyathelo ngokukhawuleza, anciphise umsebenzi ongeyomfuneko, kwaye achithe ixesha elungisa izinto ezibalulekileyo ngokwenene.
I-EPSS vs CVSS: Umahluko oPhambili
Xa kuthelekiswa i-cvss vs epss, umahluko ukho oko kukuxelela amanqaku onke:
CVSS ejolise kwi ubunzima obunokubakho yokuba sesichengeni—indlela eyonakalisa ngayo nako kuba.
EPSS uxela kwangaphambili ukuba amathuba okuxhatshazwa kwihlabathi lokwenyani—indlela ekunokwenzeka ngayo ngeke kujoliswe kuyo.
Nangona i-CVSS iqwalasela ubunzima bokusebenzisa, ukusebenzisana kwabasebenzisi, kunye nempembelelo, ayibangeli ukuba abahlaseli basebenzisa ubuthathaka ngokukhutheleyo. I-EPSS izalisa esi sikhewu ngokuqwalasela uthotho lwe-telemetry, ukufumaneka kwekhowudi yokusebenzisa, kunye neepateni zokuhlasela.
Ngoku ka Uphando lwe-EPSS, ngaphantsi kwe-2% yeengxaki ezaziwayo zinamanqaku aphezulu e-EPSS. Ngokwahlukileyo koko, imiba emininzi ebalulekileyo ye-CVSS ayichaphazeleki zizaphuli-mthetho ze-intanethi. Oku kubonisa indlela Ubuthathaka bamanqaku e-EPSS nceda ekuhluzeni ingxolo, uvumele amaqela ukuba agxile kwizisongelo ezithembekileyo nezikhoyo.
Ngaba i-EPSS kunye ne-CVSS zingasebenzisana?
Ngokuqinisekileyo—kwaye bafanele.
I-EPSS kunye ne-CVSS ziyancedisana kwisicwangciso solawulo lobuthathaka esilinganayo:
ukusebenzisa CVSS ukungena kubi kangakanani ubuthathaka bunokuba njalo.
ukusebenzisa EPSS ukungena kunokwenzeka kangakanani kufuneka ixhatshazwe.
Le ndlela inee-layered ezimbini ixhasa i-triage ekrelekrele. Umzekelo:
Ukuba sesichengeni kunye i-CVSS ephezulu + i-EPSS ephezulu → Yilungise ngoko nangoko.
I-CVSS ephezulu + i-EPSS ephantsi → Jonga ngenyameko, kodwa ungayibalulekanga.
I-CVSS ephantsi + i-EPSS ephezulu → Phanda; abahlaseli basenokuba bayibopha ngezinye iimpazamo.
Ngoko ke, amaqela athelekisa i-epss vs cvss ecaleni afumana umbono ocacileyo wento ekufuneka ayilungise—kwaye nini.
Ukubekwa phambili kwehlabathi lokwenyani nge-EPSS
Ukuzekelisa, khawucinge ngenkqubo yakho iphawula ii-CVE ezimbini:
I-CVE-2024-99999
I-CVSS: 9.8 (Ebalulekileyo)
I-EPSS: 0.03 (Ukusetyenziswa okuphantsi)I-CVE-2024-12345
I-CVSS: 6.1 (Ephakathi)
I-EPSS: 0.86 (Amathuba aphezulu okuxhatshazwa)
Yeyiphi ekufuneka uyilungise kuqala? Iindlela ezininzi zokusebenza zemveli ziya kubeka phambili ubuthathaka obubalulekileyo beCVSS. Nangona kunjalo, i-EPSS iyawutshintsha loo mbhalo—uthatha amanyathelo koko kuxhatshazwayo, hayi nje into nako ube yingozi.
Olu tshintsho luvumela amaqela ukuba ukunciphisa iimpawu zobuxoki, wonge ixesha, kwaye uphucule isantya sokulungisa.
Kutheni Ulawulo Lokungakwazi Ukujongana Neengxaki Ze-EPSS Lutshintsha Umdlalo?
I-EPSS ayiniki nje kuphela ukulungiswa okukrelekrele—ivumela ukhuseleko ngomlinganiselo omkhulu:
Amanqaku aDynamic: Uhlaziyo lwe-EPSS imihla ngemihla, lubonisa ulwazi lwamva nje lokuxhaphaza.
UkusabalalaIsebenza kumawakawaka eengxaki, inceda amaqela ukuba ahlule ngokukhawuleza.
Umsebenzi: Yakhelwe kwidatha kawonke-wonke kunye neemodeli ezivulekileyo, i-EPSS inokuqinisekiswa kwaye icacile.
Impembelelo yoMgaqo-nkqubo: Njengoko kuphawuliwe ngu I-FIRST.org, i-EPSS sele inefuthe kwimigaqo-nkqubo yokulungisa imeko kwinqanaba likazwelonke (umz. i-DHS BOD 19-02).
Ngaphezu koko, ulawulo lobuthathaka bamanqaku e-EPSS lunceda abakhuseli ukuba bagxile kwimizamo yabo apho kubaluleke khona kakhulu—kwizisongelo eziyingozi ngokwenene.
Ngaba ufuna ukwenza okungaphaya kokufumana amanqaku uze uqale ukulungisa iingxaki ezifanelekileyo?
Jonga isikhokelo sethu esipheleleyo malunga nendlela yokubeka phambili nokulungisa ubuthathaka ngokufanelekileyo. Funda indlela yokuguqula ulwazi lube yintshukumo—ngokukhawuleza.
I-EPSS vs CVSS Ayisiyonto inye okanye inye—Ingcono xa idibene
At I-Xygeni, sikholelwa ukuba i-cvss vs epss ayilodabi—yintsebenziswano. Zombini iinkqubo zokufumana amanqaku zisebenza ngeendlela ezahlukeneyo, kodwa zixabiseke ngokulinganayo, kulawulo lobuthathaka. Yiyo loo nto i-Xygeni isebenzisa i-EPSS kunye ne-CVSS kunye ukwakha imodeli epheleleyo, eqonda imeko yokubaluleka esebenzisekayo, ekhawulezayo, nesebenzayo.
Kuyo yonke i-vulnerability, i-Xygeni ibonisa:
Ubunzima beCVSS ukuqonda impembelelo enokubakho.
Amanqaku e-EPSS ukuvavanya amathuba okuxhatshazwa.
Uhlalutyo lokufikelela ukuqinisekisa ukuba ikhowudi esengozini iyasebenza ngokwenene.
Idatha yomxholo njengobuntununtunu bezinto eziphathekayo kunye nokubaluleka kweshishini.
Masithathe I-CVE-2023-29827 umzekelo. Le yingxaki yokufaka itemplate esecaleni kweseva echaphazela ejs v3.1.9Ephepheni, ine Amanqaku eCVSS 9.8, ebonisa ubukhali obukhulu. Kodwa nge Amanqaku e-EPSS angama-62.8%, ikwanethuba elikhulu lokuxhatshazwa kungekudala.
I-Xygeni ibonisa yonke le datha kwindawo enye—ubunzima, ukuxhaphaza, ukufikelela, Ubuthathaka be-CWE, kunye nemeko yenguqulelo—ukuze amaqela abone ngoko nangoko ukuba kutheni kubalulekile kwaye enze ntoni emva koko.
Endaweni yokusabela kuyo yonke i-CVSS 9.8 vulnerability, Iqonga likaXygeni libonisa ukuba:
Inokufikeleleka kwi-codebase yakho
Inokuxhaphaka kakhulu endle
Ichaphazela izinto ezibalulekileyo kwezoshishino
Olu phawu lubanzi lunceda ekunciphiseni ukudinwa okukhawulezileyo, ukunciphisa umgudu ochithwayo, kunye nokulungisa ngokuthe ngqo iingozi ezibalulekileyo ngokwenene.
Xa amanqaku e-EPSS edityaniswe nobunzima be-CVSS kunye nomxholo wexesha lokusebenza, ukubeka phambili izinto kuqala kuba yinto esebenzayo—hayi ephendulayoI-Xygeni iguqula ingxolo ibe yingqiqo, ikhokela ukhuselekocisIi-ions ezicacileyo amaqela eDevSecOps kufuneka ahambe ngokukhawuleza kwaye ahlale ekhuselekile.
