New Vulnerability Risk Model Promises More-Efficient Security

BLACK HAT USA 2019 – Las Vegas – Vulnerabilities happen. There's nothing new or mysterious about that. Neither is there mystery around the fact that something must be done to address vulnerabilities. But out of the thousands of common vulnerabilities and exploits (CVEs) discovered each year, which ones should receive a company's attention? That question — and a data-based answer — were the topic of a talk on Thursday at Black Hat USA.

The session, Predictive Vulnerability Scoring System, was presented by Michael Roytman, chief data scientist at Kenna Security, and Jay Jacobs, a security data scientist at Cyentia Institute. In it, they described vulnerability management as the "wicked problem" because management of vulnerability doesn't scale to the volume of vulnerabilities.

They pointed to the statistic that about 10% of vulnerabilities are patched each month, a percentage that doesn't change with the quantity of vulnerabilities exposed. There are too many vulnerabilities for any organization (or collection of organizations) to patch them all, so "we need a strategy to fix what matters."

The key to the strategy is figuring out "what matters." In theory, the Common Vulnerability Scoring System (CVSS) should help: The higher the score, the greater the risk. Unfortunately, anything ranked 7 or above is considered critical, and, Roytman and Jacobs said, "CVSS is DoS-ing your patching policy and wasting your money."

The reason that the researchers say patching for all critical vulnerabilities amounts to a waste is that only 2% to 5% of critical vulnerabilities are ultimately found to be exploited in the wild. For greatest efficiency, then, a scoring system would take into account the factors that make it more likely a vulnerability will be exploited. That system is what the researchers demonstrated from the stage.

The Exploit Prediction Scoring System (EPSS) uses more than a dozen different factors in a model to predict the likelihood that a particular vulnerability will be exploited, and therefore should be given a higher remediation priority. Those factors include things like the CVE, CVSS score, exploits shown in proof-of-concepts, exploits in the wild, and tags for operating systems, vendors, and other variables. The methodology doesn't require that every factor be entered before a result is generated, but the researchers said that the answer becomes more accurate with each additional factor.

The result is a percentage — the higher the percentage, the more likely it is that the vulnerability will be exploited in the wild, and the more important it is that the vulnerability be patched or remediated quickly.

Roytman and Jacobs said that they will be making their methodology available as both an algorithm that can be configured and implemented by others and as an online calculator into which users can plug in data for an answer on any given CVE. As of the posting of this story, the URL for the calculator (http://kennaresearch.com/tools/epss-calculator) was not yet active, but they said that the page, which will also include the white paper explaining the research that led to the new model, will be available soon after the conclusion of Black Hat.

Related Content: