Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

New Vulnerability Risk Model Promises More-Efficient Security

Taking into account more factors than the current CVSS makes for a better assessment of actual danger.

BLACK HAT USA 2019 – Las Vegas – Vulnerabilities happen. There's nothing new or mysterious about that. Neither is there mystery around the fact that something must be done to address vulnerabilities. But out of the thousands of common vulnerabilities and exploits (CVEs) discovered each year, which ones should receive a company's attention? That question — and a data-based answer — were the topic of a talk on Thursday at Black Hat USA.

The session, Predictive Vulnerability Scoring System, was presented by Michael Roytman, chief data scientist at Kenna Security, and Jay Jacobs, a security data scientist at Cyentia Institute. In it, they described vulnerability management as the "wicked problem" because management of vulnerability doesn't scale to the volume of vulnerabilities.

They pointed to the statistic that about 10% of vulnerabilities are patched each month, a percentage that doesn't change with the quantity of vulnerabilities exposed. There are too many vulnerabilities for any organization (or collection of organizations) to patch them all, so "we need a strategy to fix what matters."

The key to the strategy is figuring out "what matters." In theory, the Common Vulnerability Scoring System (CVSS) should help: The higher the score, the greater the risk. Unfortunately, anything ranked 7 or above is considered critical, and, Roytman and Jacobs said, "CVSS is DoS-ing your patching policy and wasting your money."

The reason that the researchers say patching for all critical vulnerabilities amounts to a waste is that only 2% to 5% of critical vulnerabilities are ultimately found to be exploited in the wild. For greatest efficiency, then, a scoring system would take into account the factors that make it more likely a vulnerability will be exploited. That system is what the researchers demonstrated from the stage.

The Exploit Prediction Scoring System (EPSS) uses more than a dozen different factors in a model to predict the likelihood that a particular vulnerability will be exploited, and therefore should be given a higher remediation priority. Those factors include things like the CVE, CVSS score, exploits shown in proof-of-concepts, exploits in the wild, and tags for operating systems, vendors, and other variables. The methodology doesn't require that every factor be entered before a result is generated, but the researchers said that the answer becomes more accurate with each additional factor.

The result is a percentage — the higher the percentage, the more likely it is that the vulnerability will be exploited in the wild, and the more important it is that the vulnerability be patched or remediated quickly.

Roytman and Jacobs said that they will be making their methodology available as both an algorithm that can be configured and implemented by others and as an online calculator into which users can plug in data for an answer on any given CVE. As of the posting of this story, the URL for the calculator (http://kennaresearch.com/tools/epss-calculator) was not yet active, but they said that the page, which will also include the white paper explaining the research that led to the new model, will be available soon after the conclusion of Black Hat.

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
NSA Appoints Rob Joyce as Cyber Director
Dark Reading Staff 1/15/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This is not what I meant by "I would like to share some desk space"
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-1067
PUBLISHED: 2021-01-20
NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the implementation of the RPMB command status, in which an attacker can write to the Write Protect Configuration Block, which may lead to denial of service or escalation of privileges.
CVE-2021-1068
PUBLISHED: 2021-01-20
NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the NVDEC component, in which an attacker can read from or write to a memory location that is outside the intended boundary of the buffer, which may lead to denial of service or escalation of privileges.
CVE-2021-1069
PUBLISHED: 2021-01-20
NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the NVHost function, which may lead to abnormal reboot due to a null pointer reference, causing data loss.
CVE-2020-26252
PUBLISHED: 2021-01-20
OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server ...
CVE-2020-26278
PUBLISHED: 2021-01-20
Weave Net is open source software which creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery. Weave Net before version 2.8.0 has a vulnerability in which can allow an attacker to take over any host in the cluster. Weave Net is suppli...