Measure 
What You Fix:
!
Asset Management 
Is Broken
Michael Roytman
Data Scientist, Risk I/O
It is far better to grasp the
universe as it really is than to
persist in delusion, however
satisfying and reassuring.
- C...
Risk =
More Can Happen
Than Will.
2. CVSS Score Reduction
Bad Remediation Metrics
1. Vulnerability Density
Part 1:
!
Fix What Matters
I Love It When You Call Me Big Data
50,000,000 Live Vulnerabilities
1,500,000 Assets
2,000 Organizations
I Love It When You Call Me Big Data
3,000,000 Breaches
Probability A Vuln Having Property X Has Observed Breaches
RANDOMVULN
CVSS 10
CVSS 9
CVSS 8
CVSS 6
CVSS 7
CVSS 5
CVSS 4
Ha...
Probability A Vuln Having Property X Has Observed Breaches
RandomVuln
CVSS 10
Exploit DB
Metasploit
MSP+EDB
0.0 0.1 0.2 0....
Part 2:
!
Measure 
What You Fix
#DoingItWrong
Jet Engine x Peanut Butter SHINY!=
Current State of Remediation Performance Tracking
Where We Want To Be
Data
1.Active Breaches
!
2.Metasploit Module
!
3. ExploitDB Entry
!
4. Popular Target
Framework
Estimate likelihood of breach event
for each vulnerability.
Framework
An asset is only as safe as the
riskiest vulnerability on that asset.
Model
Actively
Breached
Meta
sploit
Exploit
DB
Popular
Target
Vuln
Breached In The Wild?
Metasploit Module Exists?
Exploit...
Model
Actively
Breached
Meta
sploit
Exploit
DB
Popular
Target
Vuln
Actively
Breached
Meta
sploit
Exploit
DB
Popular
Target...
Better?
Model
Actively
Breached
Meta
sploit
Exploit
DB
Popular
Target
Vuln
Actively
Breached
Meta
sploit
Exploit
DB
Popular
Target...
Model
Actively
Breached
Meta
sploit
Exploit
DB
Popular
Target
Vuln
Actively
Breached
Meta
sploit
Exploit
DB
Popular
Target...
Model
Actively
Breached
Meta
sploit
Exploit
DB
Popular
Target
Vuln
Actively
Breached
Meta
sploit
Exploit
DB
Popular
Target...
Model
Actively
Breached
Meta
sploit
Exploit
DB
Popular
Target
Vuln
Actively
Breached
Meta
sploit
Exploit
DB
Popular
Target...
Where We’re Going, We Don’t Need Peanut Butter
Where We’re Going, We Don’t Need Peanut Butter
An Engine Not A Camera
risk.io/jobs
@mroytman
WE HAVE 
JOBS
Measure What You FIx: Asset Risk Management Done Right
Measure What You FIx: Asset Risk Management Done Right
Measure What You FIx: Asset Risk Management Done Right
Measure What You FIx: Asset Risk Management Done Right
Upcoming SlideShare
Loading in …5
×

Measure What You FIx: Asset Risk Management Done Right

720 views

Published on

0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
720
On SlideShare
0
From Embeds
0
Number of Embeds
48
Actions
Shares
0
Downloads
9
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Measure What You FIx: Asset Risk Management Done Right

  1. 1. Measure What You Fix: ! Asset Management Is Broken
  2. 2. Michael Roytman Data Scientist, Risk I/O
  3. 3. It is far better to grasp the universe as it really is than to persist in delusion, however satisfying and reassuring. - Carl Sagan
  4. 4. Risk = More Can Happen Than Will.
  5. 5. 2. CVSS Score Reduction Bad Remediation Metrics 1. Vulnerability Density
  6. 6. Part 1: ! Fix What Matters
  7. 7. I Love It When You Call Me Big Data 50,000,000 Live Vulnerabilities 1,500,000 Assets 2,000 Organizations
  8. 8. I Love It When You Call Me Big Data 3,000,000 Breaches
  9. 9. Probability A Vuln Having Property X Has Observed Breaches RANDOMVULN CVSS 10 CVSS 9 CVSS 8 CVSS 6 CVSS 7 CVSS 5 CVSS 4 Has Patch 0.000 0.010 0.020 0.030 0.040
  10. 10. Probability A Vuln Having Property X Has Observed Breaches RandomVuln CVSS 10 Exploit DB Metasploit MSP+EDB 0.0 0.1 0.2 0.2 0.3
  11. 11. Part 2: ! Measure What You Fix
  12. 12. #DoingItWrong
  13. 13. Jet Engine x Peanut Butter SHINY!= Current State of Remediation Performance Tracking
  14. 14. Where We Want To Be
  15. 15. Data 1.Active Breaches ! 2.Metasploit Module ! 3. ExploitDB Entry ! 4. Popular Target
  16. 16. Framework Estimate likelihood of breach event for each vulnerability.
  17. 17. Framework An asset is only as safe as the riskiest vulnerability on that asset.
  18. 18. Model Actively Breached Meta sploit Exploit DB Popular Target Vuln Breached In The Wild? Metasploit Module Exists? ExploitDB Entry? Popular Target? Less Risky
  19. 19. Model Actively Breached Meta sploit Exploit DB Popular Target Vuln Actively Breached Meta sploit Exploit DB Popular Target Actively Breached Meta sploit Exploit DB Popular Target Actively Breached Meta sploit Exploit DB Popular Target Actively Breached Meta sploit Exploit DB Popular Target …
  20. 20. Better?
  21. 21. Model Actively Breached Meta sploit Exploit DB Popular Target Vuln Actively Breached Meta sploit Exploit DB Popular Target Vuln Actively Breached Meta sploit Exploit DB Popular Target Vuln Actively Breached Meta sploit Exploit DB Popular Target Vuln Actively Breached Meta sploit Exploit DB Popular Target Vuln Actively Breached Meta sploit Exploit DB Popular Target Vuln Asset
  22. 22. Model Actively Breached Meta sploit Exploit DB Popular Target Vuln Actively Breached Meta sploit Exploit DB Popular Target Vuln Actively Breached Meta sploit Exploit DB Popular Target Vuln Actively Breached Meta sploit Exploit DB Popular Target Vuln Actively Breached Meta sploit Exploit DB Popular Target Vuln Actively Breached Meta sploit Exploit DB Popular Target Vuln Asset
  23. 23. Model Actively Breached Meta sploit Exploit DB Popular Target Vuln Actively Breached Meta sploit Exploit DB Popular Target Vuln Actively Breached Meta sploit Exploit DB Popular Target Vuln Actively Breached Meta sploit Exploit DB Popular Target Vuln Actively Breached Meta sploit Exploit DB Popular Target Vuln Actively Breached Meta sploit Exploit DB Popular Target Vuln Asset Asset Asset
  24. 24. Model Actively Breached Meta sploit Exploit DB Popular Target Vuln Actively Breached Meta sploit Exploit DB Popular Target Vuln Actively Breached Meta sploit Exploit DB Popular Target Vuln Actively Breached Meta sploit Exploit DB Popular Target Vuln Actively Breached Meta sploit Exploit DB Popular Target Vuln Actively Breached Meta sploit Exploit DB Popular Target Vuln Asset = 5 Asset = 10 Asset = 4.375
  25. 25. Where We’re Going, We Don’t Need Peanut Butter
  26. 26. Where We’re Going, We Don’t Need Peanut Butter
  27. 27. An Engine Not A Camera
  28. 28. risk.io/jobs @mroytman WE HAVE JOBS

×