Vulnerabilities / Threats

10/31/2017
10:30 AM
Ed Bellis
Ed Bellis
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Stop Counting Vulnerabilities & Start Measuring Risk

When security teams report on real risk, executive teams can gain a much better understanding of the company's security posture.

As a security team, you are what you measure. The problem is that too many security teams are counting vulnerabilities, not measuring risk. It's time we examine how vital it is for security teams to establish risk-based metrics, while offering some examples of both the right and wrong measures to use.

Why is the distinction between these approaches so vital? It's essential for security teams to understand the spectrum of risk, based both on the likelihood of an incident and the potential damage that may result.

Fundamentally, risk measurement provides a way for security teams to work smarter. They can focus their time, budget, and resources on what matters most: reducing risk. Risk measurement also provides teams with a centralized way to accumulate, analyze, and report on risk, which helps significantly improve operational efficiency.

When you adopt a risk management approach, you focus on what poses the largest and likeliest effects on the business, effectively tracking and making progress toward the ultimate goal: reducing uncertainty. Contrast this with measuring the quantity of vulnerabilities, where metrics are focused on measuring work rather than outcomes.

Before we can discuss risk, let's establish definitions. Rather than starting from scratch, I'd suggest you take a look at these from the Open Group and Daniel Miessler:

It's often easiest to think of risk as uncertainty, and our job as security professionals is to remove as much uncertainty as we can.

The Problem: Security Can't Go It Alone
The security team has started taking a risk management approach and everything is going to be rosy, right? Not exactly. Once a security team embraces risk management, the hard work is just beginning. The rest of the organization needs to start following the team's example. How does security build support for risk management across teams?

For security teams and the business to succeed in reducing uncertainty, risk management must be incorporated into operations across the organization. When security starts to be part of operations — rather than an ad hoc afterthought— the critical efforts that need to happen, do happen.

To begin, focus on two key steps:

  • Measurement. Practitioners must make sure they're measuring actual risk. All key stakeholders should buy off on what is being measured and ensure actual risk reduction is being addressed.
  • Integration. Once you're reporting on risk, it's critical to make sure risk management is part of operations.

Step 1: Selecting the Right Metrics for Measuring Risk
I meet with practitioners from a wide range of industries and often see the same missteps. Chief among these is that security teams are measuring the wrong things.

More often than not, teams take a "best practices" approach. Security analysts may run a report and find their checklist of vulnerabilities has been unaddressed for longer than 90 days. Then they'll prioritize efforts based on this aging data, focusing on how long a vulnerability has existed. Likewise, I often see companies focusing on the security news of the day over items that may be less attention-getting but pose a greater risk.

Contrast these somewhat arbitrary approaches with a risk-based strategy. With a risk-based approach, you may realize that those older vulnerabilities don't pose as much risk, but that three vulnerabilities discovered yesterday pose both a great likelihood of resulting in an incident and significant potential damage to the business. With this insight, the need to remediate these three vulnerabilities sooner is clear.

When you focus on the quantity or aging of vulnerabilities, you deprioritize higher-risk items that have a high likelihood or impact.

These contrasting scenarios underscore the importance of tracking and reporting with the right metrics. Metrics are vital in guiding behavior and play a key role in measuring success, tracking progress, getting buy-in, and investing in new approaches

It can be far better to address one high-risk vulnerability than even 100 low-risk vulnerabilities. The key is to establish metrics and analytics that measure risk in an empirical, meaningful way, so you can make these calculations with clarity.

While specific metrics that are optimal will vary somewhat depending on the nature of the business and environment, there are some common do's and don'ts when it comes to choosing metrics.

Here are some metrics to avoid:

  • Total open vulnerabilities
  • Average vulnerability age
  • Total vulnerabilities open longer than X days

Organizations that use a risk-based approach can consider tracking a number of key metrics:

  • Remediation rate of high-risk vulnerabilities with breakdowns
  • Median time to remediate a high-risk vulnerability
  • Median time to discover a high-risk vulnerability
  • Number of high-risk assets (which is very different than tracking high-risk vulnerabilities)

By and large, if you're tracking these metrics and seeing progress, you are making real improvements in reducing risk.

Step 2: Integrate Risk Management into Operation Processes
When it comes to operationalizing risk management, don't start by trying to create new operational processes. Instead, focus on transparently integrating risk management into existing processes.

Too often, security teams create out-of-band tools and procedures — and results suffer. Under any circumstances, it will be challenging to get teams to focus on security activities. Creating unique tools and workflows significantly exacerbates this challenge.

To significantly enhance your odds of success, leverage existing teams' processes wherever possible. Look to bake risk management into existing tools and workflows that staff members are using every day, including bug tracking and incident management. In effect, you're starting with what everyone is doing today and applying a risk-based lens to it.

The Payoff of Operationalizing Risk Management
When security teams adopt risk management, good things start to happen for these groups:

  • Security staffers start measuring real risk and understand how best to reduce uncertainty.
  • Those in IT operations become more productive. They aren't stuck feeling like they're doing busywork for the security folks; rather, they get visibility into risks facing the business and how they can play a part in reducing them.

When security teams start tracking and reporting on real risk, executive teams can gain a much better understanding of the company's security posture, how it's changing, and, most importantly, which efforts and investments need to be made to improve it.  

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

 

Ed Bellis is a security industry veteran and expert and was once named Information Security Executive of the Year. He founded Kenna Security to deliver a data-driven, risk-based approach to remediation and help IT teams prioritize and thwart would-be security threats. Ed is ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Microsoft Word Vuln Went Unnoticed for 17 Years: Report
Kelly Sheridan, Associate Editor, Dark Reading,  11/14/2017
Companies Blindly Believe They've Locked Down Users' Mobile Use
Dawn Kawamoto, Associate Editor, Dark Reading,  11/14/2017
121 Pieces of Malware Flagged on NSA Employee's Home Computer
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/16/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Managing Cyber-Risk
An online breach could have a huge impact on your organization. Here are some strategies for measuring and managing that risk.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.