DevelopersDevOpsNewsSecurity

Risk-Based Vulnerability Management Practices Lack A Common Framework: Survey

security
0

The latest findings of Vulcan Cyber‘s ongoing research into vulnerability risk prioritization and mitigation programs highlight the struggle of IT security teams to transition from simple vulnerability identification to meaningful response and mitigation, limiting the risk insights business leaders and IT management professionals need to effectively protect valuable business assets.

According to a Vulcan Cyber survey of more than 200 enterprise IT and security executives conducted by Pulse, 86% of respondents rely on third-party vulnerability severity data to prioritize vulnerabilities with an additional 70% relying on third-party threat intelligence. This trend underscores the status quo in many cyber security organizations today in which many teams over-rely on metrics from third-party sources that lack the necessary context to understand and actually reduce risk specific to the enterprise.

“While IT security teams work hard to defend the modern enterprise, it’s clear that traditional threat intelligence and metrics like vulnerability severity scores are incapable of generating the business-specific insight necessary for comprehensive protection,” said Yaniv Bar-Dayan, co-founder and CEO of Vulcan Cyber, “Cybersecurity teams need the insights, processes, and tooling to prioritize risk for the assets that matter most to their business success.”

The Vulcan Cyber survey also found that the majority of respondents group vulnerabilities by infrastructure (64%), followed by business function (53%) and application (53%). Risk prioritization associated exclusively with infrastructure and application groupings is not meaningful without asset context.

The survey data indicates widespread misalignment among vulnerability prioritization practices in use today. 78% of respondents said highly-prioritized vulnerabilities should be ranked lower, while 69% of respondents also said that lower-ranked vulnerabilities should be ranked higher. More than 80% of respondents agreed that they would benefit from increased flexibility to prioritize vulnerabilities based on their particular risk environment. “Gut feel” should be quantifiable in risk measurement.

To score and prioritize vulnerabilities, the vast majority of decision-makers reported using two or more of the following models: the common vulnerability scoring system (CVSS) (71%), OWASP top 10 (59%), scanner reported severity (47%), CWE Top 25 (38%), or bespoke scoring models (22%). To deliver meaningful cyber risk management a bespoke scoring model that accounts for several industry-standard scoring systems is ideal and most efficient.

A slight majority of survey respondents (54%) reported the most concern over sensitive data exposure as the result of application vulnerabilities, followed by broken authentication (44%), security misconfigurations (39%), insufficient logging and monitoring (35%), and injection (32%). Respondents also indicated that MS14-068 (Microsoft Kerberos unprivileged user accounts) was the most concerning vulnerability to their organizations, over high-profile vulnerabilities such as MS08-067 (Windows SMB aka: Conficker, Downadup, Kido, etc.), CVE-2019-0708 (BlueKeep), CVE-2014-0160 (OpenSSL aka: Heartbleed), and MS17-010 (EternalBlue).

Don't miss out great stories, subscribe to our newsletter.

Login/Sign up