Understand Risk-Based Vulnerability Prioritization
Risk-based vulnerability prioritization is an essential cybersecurity strategy that organizations use to identify, evaluate, and prioritize vulnerabilities in their systems based on the organization-specific risk posed by the vulnerability. This method goes beyond traditional vulnerability management approaches, which typically involve scanning for weaknesses and patching them in order of discovery or based on severity. Instead, risk-based prioritization considers the business-specific context of each vulnerability, including its potential impact on the organization’s critical assets and operations, the likelihood of exploitation, and the network exposure and accessibility of the vulnerability.
Risk-based vulnerability prioritization is grounded in the principle that not all vulnerabilities pose an equal threat to an organization. It aims to allocate resources more efficiently by focusing efforts on vulnerabilities that, if exploited, could cause the most damage or are most likely to be exploited by adversaries. This approach requires a comprehensive understanding of an organization’s assets and network, the value of those assets, the vulnerabilities affecting them, and the potential impact of those vulnerabilities being exploited.
Industry-standard risk assessment
For nearly 20 years, severity has been determined by the Common Vulnerability Scoring System (CVSS). CVSS provides a standardized way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity. The score is calculated by assessing the extent to which the vulnerability could threaten a system’s confidentiality, integrity, and availability (the so-called “CIA” triad), together with the likely attack vector and how complex it would be to exploit the vulnerability. Once calculated, the final CVSS score is set for the vulnerability as a numeric value.
The prioritization process can be refined further by factoring in exploitability, measuring the extent to which a vulnerability is currently exploited in the wild. A good vulnerability management program will use threat intelligence to analyze exploitability for each identified vulnerability, including detecting various exploits, such as existing malware and Proof of Concept (POC) code for each exploit.
Predict future exploitability
This process can be augmented by assessing the likelihood of a vulnerability being exploited over a given future timeframe. Organizations such as First.org provide an Exploit Prediction Scoring System (EPSS) to achieve this. A modern vulnerability management solution will use EPSS machine learning models and data analysis to predict the probability of observing any exploitation attempts against a given vulnerability in the next 30-day period. The result of the exploitability check is a numeric value to feed into the risk-based vulnerability assessment, indicating whether an exploit is likely to be available for a vulnerability and whether that exploit will soon be used in the wild, thus increasing the vulnerability’s risk priority.
CVSS severity and exploitability are industry-standard methods for assessing risk. They were sufficient when the organizational attack surface was more contained, and the number of vulnerabilities was smaller. But today, teams are confronted with an ever-expanding attack surface and thousands, if not millions, of vulnerabilities in their environment. Consequently, using Industry-standard metrics such as severity and exploitability alone yields vast numbers of high and critical severity vulnerabilities without providing the insight necessary to know what to fix next or why, leaving teams overwhelmed and not knowing where to start.
A new approach to assessing risk is needed. One that goes beyond this “one-size-fits-all” approach and considers the circumstantial factors unique to an organization.
Customer-specific risk assessment
To fully understand the risks posed by vulnerabilities, organizations need to incorporate an assessment of customer-specific risks, such as the business impact of asset loss and the extent to which an asset could be exposed to attack across the network.
The business impact of the loss of an asset due to a vulnerability is a critical element in risk-based vulnerability prioritization. Assigning a value reflecting the importance of an asset or even using automation to apply values in a range – say a 2 for a test database and 5 for a production database – is a great way to factor the business impact of the loss of the asset into the risk-based prioritization calculation.
Organizations can take their assessment of the business impact of asset loss further and use Cyber Risk Quantification (CRQ) to understand the adjusted monetary risk of an asset’s loss. Including this metric in the risk-based prioritization calculation helps to pinpoint cyber risks with the highest potential financial impact, improving decision-making and strengthening the organization’s overall security posture.
Network exposure
The next — and in many ways, most important — metric in customer-specific risk assessment is exposure across the network, the extent to which an attacker could reach an asset hosting a vulnerability across the network.
To truly understand customer-specific exposure, organizations need a detailed understanding of their attack surface, including the assets, underlying network infrastructure, access routes, and all the relevant security data from scanners and threat intelligence feeds.
Armed with this knowledge, a risk-based prioritization calculation can assess the exposure of an asset hosting a vulnerability based on possible threat origins, including external, internal, partner, and cloud, and take into consideration factors such as whether the asset is inaccessible or protected, for example, by a firewall rule, indirectly accessible via an intermediary asset, or directly accessible.
Customer-specific risk assessment factors such as business impact and network exposure are invaluable because they help to quickly identify vulnerabilities on assets that represent the highest risk to the organization and de-prioritize those that, while they might be of high severity, are inaccessible because of underlying security controls.
Multi-factor risk assessment
Increasingly, organizations are discovering that traditional vulnerability prioritization initiatives based solely on severity and exploitability are no longer sufficient to keep pace with the complexity of the organizational attack surface and the sheer volume of vulnerabilities. Fortunately, modern vulnerability management solutions can help.
A modern vulnerability management solution can automatically prioritize vulnerabilities based on industry-wide and customer-specific factors, providing a risk score that considers both. Using a dynamic security model to inform the assessment, the solution can continuously analyze severity, exploitability, business impact, and exposure, providing the team with prioritized risk scores tailored to the organization’s unique circumstances.
A modern vulnerability management solution provides invaluable insights to the network and the security team, ensuring they understand the risks posed by the latest vulnerabilities, can assess them in the context of their network and critical business assets, and use multi-factor risk scoring to prioritize and inform the remediation program.
Learn more about how the Skybox VTM Solution enables you to assess the attack surface and discover every vulnerability, prioritize according to risk, select from a choice of remediations, and report to stakeholders across the organization.
