Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

New Vulnerability Risk Model Promises More-Efficient Security

Taking into account more factors than the current CVSS makes for a better assessment of actual danger.

BLACK HAT USA 2019 – Las Vegas – Vulnerabilities happen. There's nothing new or mysterious about that. Neither is there mystery around the fact that something must be done to address vulnerabilities. But out of the thousands of common vulnerabilities and exploits (CVEs) discovered each year, which ones should receive a company's attention? That question — and a data-based answer — were the topic of a talk on Thursday at Black Hat USA.

The session, Predictive Vulnerability Scoring System, was presented by Michael Roytman, chief data scientist at Kenna Security, and Jay Jacobs, a security data scientist at Cyentia Institute. In it, they described vulnerability management as the "wicked problem" because management of vulnerability doesn't scale to the volume of vulnerabilities.

They pointed to the statistic that about 10% of vulnerabilities are patched each month, a percentage that doesn't change with the quantity of vulnerabilities exposed. There are too many vulnerabilities for any organization (or collection of organizations) to patch them all, so "we need a strategy to fix what matters."

The key to the strategy is figuring out "what matters." In theory, the Common Vulnerability Scoring System (CVSS) should help: The higher the score, the greater the risk. Unfortunately, anything ranked 7 or above is considered critical, and, Roytman and Jacobs said, "CVSS is DoS-ing your patching policy and wasting your money."

The reason that the researchers say patching for all critical vulnerabilities amounts to a waste is that only 2% to 5% of critical vulnerabilities are ultimately found to be exploited in the wild. For greatest efficiency, then, a scoring system would take into account the factors that make it more likely a vulnerability will be exploited. That system is what the researchers demonstrated from the stage.

The Exploit Prediction Scoring System (EPSS) uses more than a dozen different factors in a model to predict the likelihood that a particular vulnerability will be exploited, and therefore should be given a higher remediation priority. Those factors include things like the CVE, CVSS score, exploits shown in proof-of-concepts, exploits in the wild, and tags for operating systems, vendors, and other variables. The methodology doesn't require that every factor be entered before a result is generated, but the researchers said that the answer becomes more accurate with each additional factor.

The result is a percentage — the higher the percentage, the more likely it is that the vulnerability will be exploited in the wild, and the more important it is that the vulnerability be patched or remediated quickly.

Roytman and Jacobs said that they will be making their methodology available as both an algorithm that can be configured and implemented by others and as an online calculator into which users can plug in data for an answer on any given CVE. As of the posting of this story, the URL for the calculator (http://kennaresearch.com/tools/epss-calculator) was not yet active, but they said that the page, which will also include the white paper explaining the research that led to the new model, will be available soon after the conclusion of Black Hat.

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8818
PUBLISHED: 2020-02-25
An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore...
CVE-2020-8819
PUBLISHED: 2020-02-25
An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass ...
CVE-2020-9385
PUBLISHED: 2020-02-25
A NULL Pointer Dereference exists in libzint in Zint 2.7.1 because multiple + characters are mishandled in add_on in upcean.c, when called from eanx in upcean.c during EAN barcode generation.
CVE-2020-9382
PUBLISHED: 2020-02-24
An issue was discovered in the Widgets extension through 1.4.0 for MediaWiki. Improper title sanitization allowed for the execution of any wiki page as a widget (as defined by this extension) via MediaWiki's } parser function.
CVE-2020-1938
PUBLISHED: 2020-02-24
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that ...