1. Vulnerability
Prioritization &
Prediction in
Practice
Jonathan Cran, Research @ Kenna Security
Reid Shelton, Senior Director @ Capital One
Gartner Security & Risk
Management Summit 2018

2. 2
2018 Vulnerability Management Challenges
1. Increasing Volume (both Vulnerabilities & Threat)
2. Highly Publicized Vulnerabilities
3. No Single Source of Vulnerability Information
4. DevSecOps Enablement

3. 3
Challenge: Increasing Volume
Mitre CNA program signing up more CNAs and
fanning out responsibilities, thus enabling more
CVEs to be created & tracked (a good thing!)

4. 4
Challenge: A Fast Moving ThreatExploitExists
At CVE assignment date (vs the later publish
date), just over 40% of CVEs from 2017 had
public exploit code. We need to move FASTER
to distribute vulnerability information.

5. 5
Challenge: Highly Publicized Vulns
Defending prioritization to leadership, then re-
explaining when new patches arise took a significant
amount of time in early 2018. Teams need a
generally accepted data-backed process to prioritize.

6. 6
Challenge: DevSecOps Enablement
Threat ModelingDevelop
Inherit
Build
Deploy
Operate
SCA
SAST
Container Scan, DAST
DAST, Bug Bounty, Penetration Testing
DevSec Ops Phase Vulnerability Data:
More layers and more testing techniques are
Driving an integration-first vuln mgmt
approach, integrated with each of the steps of
the emerging DevSecOps toolchain.
Credit @signalsciences, @samnewman

7. 7
Approved
Gold Image
and AMI
(updated every 2
weeks)
APPROVE and
PUBLISH
ASSESS
ON DEV
INSTANCES
OS
Scanner
AUTOMATICALLY
ADD
CLOUD AGENT
OS
Detection
Agent
Public
Custom
AMAZON MACHINE
IMAGE (AMI)
Live Instances
(Rehydration – every 60 days)
Agents
DevSecOps in Practice
Actual process used by a Kenna Customer

8. 8
Risk Based Vulnerability Management
(Network) Infrastructure Sources Application Sources
Risk Based Vuln Management integrates many sources – both
infrastructure and application data , along with current and relevant
threat information to prioritize the most highly targeted
vulnerabilities and configuration problems.
Threat Sources
Kenna Research Team
Global Threat Feeds
NIPS / NIDS & HIPS / HIDS
Antivirus and Endpoint Threat Data
WAF & RASP Threat Data
SEIM and Analytics

9. 9
Risk Based Vulnerability Management
Vulnerability
Identified
Public
Exploit
Exists
In-The-Wild
Exploitation
Exploitation
In our Env
Takeaways:
Only ~2-5% of vulnerabilities are detected as targeted in
the wild today according to Kenna Security threat data.
A risk scoring system that progressively increases risk
scores as threats emerge and are activated helps vuln
mgmt teams prioritize risk.

10. 10
External “Scannable” CVEs - Q1 2018
Apache Struts 2.3.x - CVE-2017-5638, CVE-2017-9791, CVE-2017-9805
Joomla! 3.7.1 - CVE-2017-8917
Oracle WebLogic 10.3.6, 12.1.x, 12.2.x - CVE-2017-10271
PHP 5.4.2 - CVE-2002-1149, CVE-2012-1823
Jenkins 2.56 - CVE-2017-1000353
Microsoft SMBv1 (ETERNALBLUE) - CVE-2017-0143/4/5
MASTER IPCAMERA (hardcoded password) - CVE-2018-5723
These specific CVEs saw significantly increased activity in Q1 2018 across Kenna Security threat data

11. 11
Analysis of Remediation Strategies
Coverage: Of all vulnerabilities that
should be remediated, what
percentage was correctly identified
for remediation? (correctly applied
effort)
Efficiency: Of all vulnerabilities
identified for remediation, what
percentage should have been
remediated? (a measure of effort
wasted)
Takeaway: There’re no simple rule-based systems for choosing vulns to remediate. Aim to optimize coverage and efficiency.

12. 12
Prioritization To Prediction
https://www.kennasecurity.com/prioritization-to-prediction-report/
• Speed must be a priority.
• The number of CVEs published every year is
growing.
• Common strategies are about as effective as
rolling dice.
• A predictive model increases efficiency,
reduces workload, and increases coverage.
Dig into the research here:

13. Questions?
hello@kennasecurity.com