Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

New Vulnerability Risk Model Promises More-Efficient Security

Taking into account more factors than the current CVSS makes for a better assessment of actual danger.

BLACK HAT USA 2019 – Las Vegas – Vulnerabilities happen. There's nothing new or mysterious about that. Neither is there mystery around the fact that something must be done to address vulnerabilities. But out of the thousands of common vulnerabilities and exploits (CVEs) discovered each year, which ones should receive a company's attention? That question — and a data-based answer — were the topic of a talk on Thursday at Black Hat USA.

The session, Predictive Vulnerability Scoring System, was presented by Michael Roytman, chief data scientist at Kenna Security, and Jay Jacobs, a security data scientist at Cyentia Institute. In it, they described vulnerability management as the "wicked problem" because management of vulnerability doesn't scale to the volume of vulnerabilities.

They pointed to the statistic that about 10% of vulnerabilities are patched each month, a percentage that doesn't change with the quantity of vulnerabilities exposed. There are too many vulnerabilities for any organization (or collection of organizations) to patch them all, so "we need a strategy to fix what matters."

The key to the strategy is figuring out "what matters." In theory, the Common Vulnerability Scoring System (CVSS) should help: The higher the score, the greater the risk. Unfortunately, anything ranked 7 or above is considered critical, and, Roytman and Jacobs said, "CVSS is DoS-ing your patching policy and wasting your money."

The reason that the researchers say patching for all critical vulnerabilities amounts to a waste is that only 2% to 5% of critical vulnerabilities are ultimately found to be exploited in the wild. For greatest efficiency, then, a scoring system would take into account the factors that make it more likely a vulnerability will be exploited. That system is what the researchers demonstrated from the stage.

The Exploit Prediction Scoring System (EPSS) uses more than a dozen different factors in a model to predict the likelihood that a particular vulnerability will be exploited, and therefore should be given a higher remediation priority. Those factors include things like the CVE, CVSS score, exploits shown in proof-of-concepts, exploits in the wild, and tags for operating systems, vendors, and other variables. The methodology doesn't require that every factor be entered before a result is generated, but the researchers said that the answer becomes more accurate with each additional factor.

The result is a percentage — the higher the percentage, the more likely it is that the vulnerability will be exploited in the wild, and the more important it is that the vulnerability be patched or remediated quickly.

Roytman and Jacobs said that they will be making their methodology available as both an algorithm that can be configured and implemented by others and as an online calculator into which users can plug in data for an answer on any given CVE. As of the posting of this story, the URL for the calculator (http://kennaresearch.com/tools/epss-calculator) was not yet active, but they said that the page, which will also include the white paper explaining the research that led to the new model, will be available soon after the conclusion of Black Hat.

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19642
PUBLISHED: 2019-12-08
On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or ShareNa...
CVE-2019-19637
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_decode_raw_impl at fromsixel.c.
CVE-2019-19638
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function load_pnm at frompnm.c, due to an integer overflow.
CVE-2019-19635
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function sixel_decode_raw_impl at fromsixel.c.
CVE-2019-19636
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_encode_body at tosixel.c.