Vulnerability Intelligence Report: A Threat-Centric Approach To Prioritization

Tenable Research set out to provide organizations with the real-world data they need to take a threat-centric approach to vulnerability management.

Insight into the true state of cyber exposure - how defenders are actually acting - not how they think or say they are, has so far been difficult to discern.

The newly released Vulnerability Intelligence Report provides an overview of current vulnerability disclosure trends and insights into real-world vulnerability demographics in enterprise environments. The report analyzes vulnerability prevalence in the wild, based on the number of affected enterprises, to highlight vulnerabilities that security practitioners are dealing with in practice, not just in theory.

With 61% of all vulnerabilities detected in enterprise environments rated as a High severity, cybersecurity teams are challenged to determine which vulnerabilities truly represent a risk. They need to prioritize the most critical vulnerabilities to maximize limited remediation resources. When everything is urgent, triage fails.

Better prioritization is critical

In order to prioritize, organizations first need to better understand the actual, not theoretical, impact of vulnerabilities. As a prioritization metric, CVSS has its shortcomings. It lacks granularity at scale and volume, as the majority of vulnerabilities are classified as High or Critical severity. The shift from CVSSv2 to CVSSv3 only adds to the problem, as the majority of vulnerabilities are now registered as either 'High' or 'Critical.'

Common sense dictates that if everything seems important, then nothing is – and a better way of prioritization is needed. Such insight needs to incorporate context, such as threat intelligence, so organizations can prioritize vulnerabilities based on actual threats 'in the wild.'

Tenable Research set out to provide such insight in the Vulnerability Intelligence Report .

The report analyzes vulnerability prevalence, based on the number of maximum affected enterprises on a single day, to highlight the vulnerabilities security practitioners are dealing with on a daily basis.

On average, an enterprise is finding 870 CVEs across 960 assets every single day. This means prioritization methodologies based on remediating only High severity CVEs still leave the average enterprise with more than 548 vulnerabilities per day to assess and prioritize, often on multiple systems.

This means prioritization methodologies based on remediating only critical CVEs will still leave the average enterprise with over 100 vulnerabilities per day to prioritize per patch, often on multiple systems. Adding to the problem is the fact that vulnerabilities not defined as ‘critical’ (i.e., having a CVSS score lower than 9), can have a catastrophic effect – for example WannaCry exploited a vulnerability with a score below 9.0 (the vuln was listed as 8.5).

This study confirms managing vulnerabilities is a challenge of scale, velocity and volume. It is not just an engineering challenge, but requires a threat-centric view in order to prioritize thousands of vulnerabilities that superficially all seem the same.

The report introduces the Top 20 Vulnerability Chart – providing insight into the most prevalent vulnerabilities that exist across different technologies in the enterprises. The chart utilizes real-world telemetry data to reveal which vulnerabilities are actually present in enterprise environments and subsequently represent the greatest true risk. Organizations can use this information to put into perspective their own list of vulnerabilities as compared to the larger population.

Key findings

• The haystack is getting bigger – 15,038 new vulnerabilities were published in 2017 in total, versus 9,837 in 2016, an increase of 53%. 2018 is on track for 18,000-19,000 new vulnerabilities. Almost two thirds (61%) of the vulnerabilities enterprises are finding in their environments have a CVSSv2 severity of High (7.0-10.0).
• But there are few needles - Public exploits are available for just 7% of all vulnerabilities. The reality is that, for most vulnerabilities, a working exploit is never developed and of those an even smaller subset are actively weaponized and employed by threat actors. Finding and fixing the 7% is critical to improving an organization’s cyber exposure.

At current projections, more than 1,500 exploited vulnerabilities will be published in 2018, or just over 28 exploited vulnerabilities every week. Better insight is a necessity, not a ‘nice to have.’ Download the Vulnerability Intelligence Report here to gain the insight you need to begin building a risk-based approach to prioritization.

Learn More:

• Download the Vulnerability Intelligence Report.
• Read the eBook: How to Prioritize Cybersecurity Risk: A Primer for CISOs.
• Read our tech blog: Three Vulnerability Intelligence Insights Worth Your Attention