The session highlighted the vulnerabilities specific to the public sector, highlighting the limitations of traditional frameworks like the Common Vulnerability Scoring System (CVSS) and the risks posed by blind spots in existing assessment methods. Participants reviewed real-world case studies, including unauthorised transfers in Mexican banks, to understand practical implications and lessons learned. The session also introduced a new methodology combining CVSS with Exploit Prediction Scoring System (EPSS).

The second part of the seminar focused on examining the importance of adopting a risk-based methodology, assessing vulnerabilities according to business impacts and prioritising the most critical assets. Participants learned the need for clear asset ownership, management supports and the use of simple, meaningful metrics to track exposure and progress. The session also covered the common challenges of keeping a clean asset inventory and introduced practical methods for developing a reliable one.

Overall, the seminar provided LAC4 members with a comprehensive overview of public-sector vulnerability challenges, real-world incidentss and the limitations of traditional assessment frameworks. It also emphasised the value of a risk-based methodology, clear asset ownerships and practical tools for maintaining an accurate asset inventory.

Most important takeaways from the seminar:

• Adopt a risk-based approach to vulnerability management, prioritising assets according to business impact and potential threat.
• Establish clear asset ownership and ensure management support to maintain an effective vulnerability management programme.
• Use practical tools and methodologies for scanning, analysiss and detection of vulnerabilities across networks and critical systems.
• Prioritise remediation efforts on the most critical vulnerabilities, especially in government and critical infrastructure environments.
• Build and maintain accurate asset inventories, including shadow IT, cloud resourcess and legacy systems, using both automated and manual methods.
• Apply structured workflows and automation for patching and remediation, with compensating controls when immediate fixes are not possible.
• Management support is vital for a well working vulnerability management program
• Understand public-sector challenges and the limitations of traditional frameworks like CVSS.
• Leverage new methodologies such as the combination of CVSS and EPSS to improve detection, prioritisations and response.
• Learn from real-world cases and simulations to bridge theory with practical application, enhancing overall cyber resilience.
• Shift from reactive to proactive strategies, integrating vulnerability assessment into broader cyber risk management practices.

LAC4 remains committed to supporting its members in enhancing their capabilities to identify, assess and mitigate vulnerabilities in critical systems. The seminar was attended by 170 stakeholders and policymakers from LAC4 Participant Nations. It was specifically designed for cybersecurity stakeholders and policymakers from LAC4 member countries, including Antigua and Barbuda, Colombia, the Dominican Republic, Ecuador, El Salvador, Guatemala, Honduras, Panama, Uruguay, the Bahamas and members of RedCLARA.