[Attacks and Exploits] A penetration tester finishes a security scan and uncovers numerous vulnerabilities on several hosts. Based on the targets' EPSS (Exploit Prediction Scoring System) and CVSS (Common Vulnerability Scoring System) scores, which of the following targets is the most likely to get attacked?

The question asks to identify the target most likely to be attacked. The Exploit Prediction Scoring System (EPSS) is the primary metric for this, as it estimates the probability that a vulnerability will be exploited. Targets 1 and 3 have the highest EPSS score (0.6), indicating they are the most likely candidates. To decide between these two, the Common Vulnerability Scoring System (CVSS) score is used as a secondary factor. CVSS measures the technical severity of a vulnerability. An attacker will prioritize the target with the higher severity. Target 1 has a CVSS score of 4, while Target 3 has a score of 1. Therefore, Target 1 is the most attractive and likely target.

B. This target has a low EPSS score (0.3), indicating a significantly lower probability of being exploited compared to Targets 1 and 3.
C. While having a high EPSS score, its very low CVSS score (1) makes it a much less impactful and attractive target than Target 1.
D. This target's EPSS score (0.4) is lower than that of Targets 1 and 3, making it a less probable target for exploitation.

1. FIRST.org, Exploit Prediction Scoring System (EPSS) Documentation. The official EPSS documentation states, "The Exploit Prediction Scoring System (EPSS) is a data-driven effort for estimating the likelihood (probability) that a software vulnerability will be exploited in the wild." This supports using the highest EPSS score as the primary indicator of attack likelihood. (Source: FIRST.org, EPSS Model, Section: "What is EPSS?")

2. FIRST.org, Common Vulnerability Scoring System v3.1: Specification Document. The official CVSS specification defines it as a system to "convey vulnerability severity." This supports using CVSS to determine the attractiveness of a target when the probability of exploit is equal. (Source: FIRST.org, CVSS v3.1 Specification Document, Section 1. Introduction)

3. Jacobs, J., et al. (2021). Improving Vulnerability Remediation Through Better Exploit Prediction. In Proceedings of the 30th USENIX Security Symposium. This foundational paper on EPSS discusses its purpose in prioritizing vulnerabilities for remediation based on the threat of exploitation, often in conjunction with severity data like CVSS. (Source: USENIX Security '21, Section 1: Introduction, Paragraph 2). DOI: Available via USENIX Association archives.