Downloaded 12 times
Uploaded byJonathan Cran
Vulnerability Prioritization and Prediction
The document discusses vulnerability prioritization and prediction challenges in cybersecurity, highlighting increasing volumes of vulnerabilities and the need for a data-backed prioritization process. It emphasizes the importance of integrating multiple data sources for risk-based vulnerability management and the emerging need for effective remediation strategies. The document also advocates for using predictive models to enhance efficiency and coverage in vulnerability management efforts.
More Related Content
Similar to Vulnerability Prioritization and Prediction
Vulnerability Prioritization and Prediction
- 1. Vulnerability Prioritization & Prediction in Practice JonathanCran, Research @ Kenna Security Reid Shelton, Senior Director @ Capital One Gartner Security & Risk Management Summit 2018
- 2. 2 2018 Vulnerability ManagementChallenges 1. Increasing Volume (both Vulnerabilities & Threat) 2. Highly Publicized Vulnerabilities 3. No Single Source of Vulnerability Information 4. DevSecOps Enablement
- 3. 3 Challenge: Increasing Volume MitreCNA program signing up more CNAs and fanning out responsibilities, thus enabling more CVEs to be created & tracked (a good thing!)
- 4. 4 Challenge: A FastMoving ThreatExploitExists At CVE assignment date (vs the later publish date), just over 40% of CVEs from 2017 had public exploit code. We need to move FASTER to distribute vulnerability information.
- 5. 5 Challenge: Highly PublicizedVulns Defending prioritization to leadership, then re- explaining when new patches arise took a significant amount of time in early 2018. Teams need a generally accepted data-backed process to prioritize.
- 6. 6 Challenge: DevSecOps Enablement ThreatModelingDevelop Inherit Build Deploy Operate SCA SAST Container Scan, DAST DAST, Bug Bounty, Penetration Testing DevSec Ops Phase Vulnerability Data: More layers and more testing techniques are Driving an integration-first vuln mgmt approach, integrated with each of the steps of the emerging DevSecOps toolchain. Credit @signalsciences, @samnewman
- 7. 7 Approved Gold Image and AMI (updatedevery 2 weeks) APPROVE and PUBLISH ASSESS ON DEV INSTANCES OS Scanner AUTOMATICALLY ADD CLOUD AGENT OS Detection Agent Public Custom AMAZON MACHINE IMAGE (AMI) Live Instances (Rehydration – every 60 days) Agents DevSecOps in Practice Actual process used by a Kenna Customer
- 8. 8 Risk Based VulnerabilityManagement (Network) Infrastructure Sources Application Sources Risk Based Vuln Management integrates many sources – both infrastructure and application data , along with current and relevant threat information to prioritize the most highly targeted vulnerabilities and configuration problems. Threat Sources Kenna Research Team Global Threat Feeds NIPS / NIDS & HIPS / HIDS Antivirus and Endpoint Threat Data WAF & RASP Threat Data SEIM and Analytics
- 9. 9 Risk Based VulnerabilityManagement Vulnerability Identified Public Exploit Exists In-The-Wild Exploitation Exploitation In our Env Takeaways: Only ~2-5% of vulnerabilities are detected as targeted in the wild today according to Kenna Security threat data. A risk scoring system that progressively increases risk scores as threats emerge and are activated helps vuln mgmt teams prioritize risk.
- 10. 10 External “Scannable” CVEs- Q1 2018 Apache Struts 2.3.x - CVE-2017-5638, CVE-2017-9791, CVE-2017-9805 Joomla! 3.7.1 - CVE-2017-8917 Oracle WebLogic 10.3.6, 12.1.x, 12.2.x - CVE-2017-10271 PHP 5.4.2 - CVE-2002-1149, CVE-2012-1823 Jenkins 2.56 - CVE-2017-1000353 Microsoft SMBv1 (ETERNALBLUE) - CVE-2017-0143/4/5 MASTER IPCAMERA (hardcoded password) - CVE-2018-5723 These specific CVEs saw significantly increased activity in Q1 2018 across Kenna Security threat data
- 11. 11 Analysis of RemediationStrategies Coverage: Of all vulnerabilities that should be remediated, what percentage was correctly identified for remediation? (correctly applied effort) Efficiency: Of all vulnerabilities identified for remediation, what percentage should have been remediated? (a measure of effort wasted) Takeaway: There’re no simple rule-based systems for choosing vulns to remediate. Aim to optimize coverage and efficiency.
- 12. 12 Prioritization To Prediction https://www.kennasecurity.com/prioritization-to-prediction-report/ •Speed must be a priority. • The number of CVEs published every year is growing. • Common strategies are about as effective as rolling dice. • A predictive model increases efficiency, reduces workload, and increases coverage. Dig into the research here:
- 13.