Examining Vulnerability Criticality When Risk Ranking Vulnerabilities

Examining Vulnerability Criticality When Risk Ranking Vulnerabilities

Every organization starting a security testing program struggles with addressing vulnerabilities. With limited resources in virtually all organizations, prioritizing this work is a requirement.

My previous post explained three steps to risk ranking your applications. This is critical because, quite simply, some of your applications warrant more scrutiny than others. Those applications that manage sensitive data or are core to achieving your business goals should be at the top of your list. Other applications, perhaps those that can’t be reached from outside your environment, may deserve less of your attention.

Once you have prioritized your applications, the next step is understanding which vulnerabilities pose the greatest risk.

Vulnerability Criticality

Vulnerability Criticality Score 9.8The second step involves looking at the specific vulnerabilities. Your triage team needs to rank order these across all of your applications. A good starting point is to classify the vulnerabilities by severity and exploitability.

When a vulnerability is disclosed through NIST’s National Vulnerability Database (NVD), a 1 – 10 score is also provided using the Common Vulnerability Scoring System (CVSS).  In addition, information is provided about the vulnerability’s impact on application Confidentiality, Integrity, Availability and how difficult it would be for an attacker to exploit this vulnerability. 

The figure above shows a vulnerability with a base score of 9.8 – close to the highest score possible. It reaches this score not only by virtue of the type of vulnerability (input validation error), but by the degree of difficulty for an attacker to exploit the vulnerability. In this case, we see a few key pieces of information:

  • Attack Vector - The vulnerability access vector is the network. In other words, the attacker can be anywhere and remotely exploit the vulnerability.
  • Attack Complexity - The complexity of the vulnerability is low – so less-skilled attackers can take advantage of it, and “repeatable success” can be expected.
  • Privileges Required - No privileges (authentication) are required, simplifying the attack and (again) enlarging the number of potential adversaries. 

Likelihood of an Attack

That all sounds pretty bad, right? What could make it worse? Let’s check the references in the NVD listing…

Likelihood of an attack on a known vulnerability 

How about a publicly available exploit?

Following the link brings you to a detailed proof of concept (sometimes you can even find YouTube videos explaining the exploit). Public exploits are obviously bad news, but not just because it makes a determined hackers job easier. It also subjects you to random, non-targeted attacks.

What Don’t I Fix?

It’s important to remember that security should always support business goals, and that some residual risk will likely always remain. The security team’s task is to make sure the remaining risk is within reasonable bounds. This will differ for each application, but even critical applications may be “ok” with minor, difficult to exploit vulnerabilities – that’s a judgment decision.

Finally, just because you agree to fix a vulnerability, it doesn’t necessarily happen overnight. Depending on engineering resources and release cycles, it may take weeks or months to replace a vulnerable component. Meanwhile, the bad guys are busy looking for targets.

And that’s the subject of the next posting on this topic…

9 Questions To Ask Before You Select an AppSec Solution

0 Comments
Sorry we missed you! We close comments for older posts, but we still want to hear from you. Tweet @black_duck_sw to continue the discussion.
0 Comments

MORE BY THIS AUTHOR

Now It’s Personal – 4 Takeaways From the Equifax Breach

| Sep 18, 2017

If you’re reading this, you have no doubt heard that personal information, including social security numbers, was stolen from Equifax – one of the Big 3 credit reporting agencies. From an industry standpoint, here’s a quick takeaway. Wait – For Once It Could Affect Me? For a lot of breaches, the

| MORE >

Critical Vulnerability CVE-2017-5638 Attacks Escalating

| Sep 14, 2017

 Attacks on Apache Struts 2 have escalated over the past couple of days as hackers exploit this critical vulnerability (CVE-2017-5638), which allows attackers to exploit a code-execution bug in the web application framework. Although a patch was available on Monday, hackers have been exploiting it

| MORE >

"Easy" to Hack Apache Struts Vulnerability CVE-2017-9805

| Sep 7, 2017

"This is as serious as it gets; if remote attackers are allowed to exploit the newly identified vulnerability it can critically damage thousands of enterprises." Oege de Moor, CEO and founder of Semmle. Dozens of Fortune 100 companies are at risk after security researchers at lgtm.com discovered a

| MORE >