According to the CISSP For Dummies4, the best way to determine the priority of the remediation efforts after a vulnerability assessment has been conducted is to use a risk-based approach. A vulnerability assessment is the process of identifying and measuring the weaknesses and exposures in a system, network, or application, that may be exploited by threats and cause harm to the organization or its assets. A risk-based approach is a method that prioritizes the remediation efforts based on the level of risk associated with each vulnerability, which is calculated by considering the impact and likelihood of the threat exploiting the vulnerability. A risk-based approach helps to allocate the resources and efforts to the most critical and urgent vulnerabilities, and to reduce the overall risk to an acceptable level. Using an impact-based approach is not the best way to determine the priority of the remediation efforts, as it only considers the potential consequences of the threat exploiting the vulnerability, but not the probability of the occurrence. An impact-based approach may overestimate or underestimate the risk level of some vulnerabilities, and may not reflect the true urgency and severity of the vulnerabilities. Using a criticality-based approach is not the best way to determine the priority of the remediation efforts, as it only considers the importance or value of the asset or system that is affected by the vulnerability, but not the threat or the vulnerability itself. A criticality-based approach may overestimate or underestimate the risk level of some vulnerabilities, and may not reflect the true urgency and severity of the vulnerabilities. Using a threat-based approach is not the best way to determine the priority of the remediation efforts, as it only considers the characteristics and capabilities of the threat that may exploit the vulnerability, but not the vulnerability or the impact itself. A threat-based approach may overestimate or underestimate the risk level of some vulnerabilities, and may not reflect the true urgency and severity of the vulnerabilities.
References: 4