The document outlines a framework for risk-ranking vulnerabilities, emphasizing the importance of understanding the nature of vulnerabilities, their potential exploiters, their locations, and their age. It highlights that over 50% of code in many industries comprises open source, which has significant implications for security. The document also provides resources for further information on vulnerabilities and recommends assessing various factors that contribute to risk levels.

1. Nivedita Murthy (Security Consultant)
5 Ways to Risk Rank Your Vulnerabilities

2. © 2019 Synopsys, Inc. 2
Used
96%
Did Not
Use
4%
Open source usage
Open source is in everything!
60%
40%
70
%
30
%
Cyber security
74
%
26
%
Internet & mobile apps
64
%
36
%
Finance & healthcare
62
%
38
%
Retail & e-commerce
In 13 out of 17 industries, more than 50% of the average codebase comprised open source.
Source: Synopsys Open Source Security and Risk Analysis

3. © 2019 Synopsys, Inc. 3
Security breaches due to open source

4. © 2019 Synopsys, Inc. 4
• Get more information!
– CVE, Common Vulnerabilities & Exposures: https://cve.mitre.org/index.html
– US-CERT: https://www.us-cert.gov/ncas/alerts
– NVD, National Vulnerabilities Database: https://nvd.nist.gov
– Threat intelligence
– Monitor newsfeeds
• Vulnerability scoring and its effectiveness
– CVSS scores: https://www.first.org/cvss/
– CVSS score provided in NVD is just base score
– Does not include “temporal” or “environmental” score
– Environmental score differs; it is perceptive
– https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
Existing methodologies

5. © 2019 Synopsys, Inc. 5

6. © 2019 Synopsys, Inc. 6
The 5 Ws

7. © 2019 Synopsys, Inc. 7
• What is the vulnerability all about?
– XSS?
– Injection?
– Denial of service?
– Remote code execution?
• Exploit description
• The easier it is, the higher the risk
• The higher the damage/impact, the higher the risk
What?

8. © 2019 Synopsys, Inc. 8
• Who can exploit this vulnerability?
• What privileges does the user need to exploit this vulnerability?
– None?
– Admin/root?
– Any authenticated user?
Who?

9. © 2019 Synopsys, Inc. 9
• Where was this vulnerability found? What is the attack vector?
– Application level?
– Network level?
– Server level?
Where?

10. © 2019 Synopsys, Inc. 10
• How old is this vulnerability?
• The older the wine, the finer it is
• Hackers are attracted more to older vulnerabilities
• 43% of codebases scanned in 2018 had vulnerabilities over 10 years old—wide landscape
When?

11. © 2019 Synopsys, Inc. 11
• Why is it not possible to exploit this vulnerability?
– Mitigating factors in environment?
– Unused functionality?
– Different version?
Why?

12. © 2019 Synopsys, Inc. 12
• What
• Who
• Where
• When
Contextual decisions
Impact
Unauthenticated
Admin/root
Application/
formServer/database
New
Old
Confidentiality
IntegrityAvailability

13. © 2019 Synopsys, Inc. 13
Questions?

14. Thank You