[Attacks and Exploits] A penetration tester finishes a security scan and uncovers numerous vulnerabilities on several hosts. Based on the targets'…

The question asks to identify the target most likely to be attacked. The Exploit Prediction Scoring System (EPSS) is the primary metric for this, as it estimates the probability that a vulnerability will be exploited. Targets 1 and 3 have the highest EPSS score (0.6), indicating they are the most likely candidates.

To decide between these two, the Common Vulnerability Scoring System (CVSS) score is used as a secondary factor. CVSS measures the technical severity of a vulnerability. An attacker will prioritize the target with the higher severity. Target 1 has a CVSS score of 4, while Target 3 has a score of 1. Therefore, Target 1 is the most attractive and likely target.

B. This target has a low EPSS score (0.3), indicating a significantly lower probability of being exploited compared to Targets 1 and 3.

C. While having a high EPSS score, its very low CVSS score (1) makes it a much less impactful and attractive target than Target 1.

D. This target's EPSS score (0.4) is lower than that of Targets 1 and 3, making it a less probable target for exploitation.

1. FIRST.org

Exploit Prediction Scoring System (EPSS) Documentation. The official EPSS documentation states

"The Exploit Prediction Scoring System (EPSS) is a data-driven effort for estimating the likelihood (probability) that a software vulnerability will be exploited in the wild." This supports using the highest EPSS score as the primary indicator of attack likelihood. (Source: FIRST.org

EPSS Model

Section: "What is EPSS?")

2. FIRST.org

Common Vulnerability Scoring System v3.1: Specification Document. The official CVSS specification defines it as a system to "convey vulnerability severity." This supports using CVSS to determine the attractiveness of a target when the probability of exploit is equal. (Source: FIRST.org

CVSS v3.1 Specification Document

Section 1. Introduction)

3. Jacobs

J.

et al. (2021). Improving Vulnerability Remediation Through Better Exploit Prediction. In Proceedings of the 30th USENIX Security Symposium. This foundational paper on EPSS discusses its purpose in prioritizing vulnerabilities for remediation based on the threat of exploitation

often in conjunction with severity data like CVSS. (Source: USENIX Security '21

Section 1: Introduction

Paragraph 2). DOI: Available via USENIX Association archives.