An (Updated) Journey Through Attack Potential, CVSS Score And EPSS Score (A20a)
Can the CVSS provide a useful aid to the evaluator for AVA_VAN evaluation activities? Last year this speaker started a journey for finding differences and commonalities between CVSS and Attack Potential. This talk provides further insights, updates and considerations with the results of a pilot project and explores a new area for Attack Potential calculation using also the Exploit Prediction Scoring System (EPSS) in the residual risk acceptance. Co-authored by Pierpaolo Santucci, Cybersecurity Expert, Agenzia per la Cybersicurezza Nazionale.