Stop the Presses: Media Coverage as a Prioritization Metric for Vulnerability Management

Claire Tills

We wondered whether mainstream media coverage of vulnerabilities changed how companies perform vulnerability management. So we asked them. Here’s what we learned.

In technical circles, vulnerabilities have always been news. More often now though, vulnerabilities are mainstream news. They are regularly covered in business outlets read by company leaders who may not otherwise get involved in the nitty gritty of vulnerability management. 

2018 was a big year for vulnerabilities in the media. Starting off immediately with Meltdown and Spectre in January, it felt like the coverage never stopped. Seeing this, we wondered whether and how this coverage changed the way companies were doing vulnerability management. So we asked them. Through the course of doing broad-scope interviews with CISOs and security analysts, we were sure to ask about their experiences with vulnerabilities in the news.

We asked interviewees “Has news coverage of vulnerabilities impacted your work? If so, how?” 

Most of them had experienced some sort of disruption to their normal operations because of vulnerability news coverage. The top two examples given were the speculative execution vulnerabilities, Meltdown and Spectre, and Struts2. The full report, Headline Vulnerabilities: How Media Coverage Shapes the Perception of Risk, contains details on strategies, tactics, and challenges that developed while responding to these incidents. Our key findings were that: 

  • High-profile vulnerabilities are not just a concern for security teams. These vulnerabilities, whether or not technically critical, can pose serious reputational risks and require relationship management with customers, partners, regulators and other key stakeholders. 
  • Media coverage is not an objective metric for determining the true criticality of a vulnerability, particularly in the context of a specific enterprise. The role of the media is to investigate and report on stories, not conduct risk analysis. They will report on vulnerabilities that are interesting, but not necessarily critical. 
  • However, media coverage may still influence holistic risk evaluations. While security teams are aware that media coverage is not an ideal measure of technical risk, they need to discuss their risk evaluation process with others. They also need to accept that the overall risk presented by a lower-severity vulnerability might require action.
  • Part of the role of a security team is to manage perceived risk and to advise key stakeholders, especially senior decision-makers, and enable a measured response to vulnerabilities based on contextualization, rather than hype. CISOs must be armed with vulnerability data in the proper context in order to properly convey their organizations’ Cyber Exposure to business leaders and invest resources appropriately to reduce risk.

However, there is another angle not covered in the report that I would like to discuss: it isn’t just the coverage in the business press that can impact how vulnerability management gets done. Security teams are tracking a much wider set of channels than their executives are for vulnerabilities. While security teams aren’t using this coverage as a single source of vulnerability intelligence, it can be used as a metric (combined with others) for prioritization. Let’s examine that aspect of the vulnerability media landscape. 

Vulnerability media landscape

While the Headline Vulnerabilities report focuses mainly on how organizations respond to major media coverage, stories that reach the level of the New York Times and broadcast news, the vulnerability media landscape covers a lot more than just those stories. While the pressure to perform is highest when the executive leadership or board of directors becomes aware of a vulnerability, security teams often use media coverage as a metric for severity. Media coverage typically will increase the priority of a vulnerability and this is particularly true once attacks are observed in the wild. For instance, Atlassian published an advisory for vulnerabilities in Confluence Server back on March 20, including a fix for CVE-2019-3396. However, it wasn’t until proof-of-concept (PoC) code and exploitation of this vulnerability became public that media outlets picked up on it. While it may not push it to the top of the pile, media coverage does act as an additional data point for prioritization.

Tenable’s Security Response Team (SRT) tracks vulnerabilities in the news (and other sources) and, since the beginning of 2019, nearly every noteworthy vulnerability disclosed has been covered by the media. That creates a lot of noise for security teams to manage. Media coverage is becoming less useful as a metric because the media landscape is changing. 

Reflecting on the changes to the media landscape, Ryan Seguin, research engineer on the SRT said, "I think over the last five years you've had a perfect storm of factors in the industry. The first major impact on vulnerability media coverage was Heartbleed in 2014, and the second being Twitter becoming the de facto method of communication for researchers. Heartbleed certainly wasn't the first vulnerability to get a catchy name, but in my anecdotal experience, its publication created a sort of vulnerability research gold rush. Since 2014, researchers are increasingly dedicated to being the next person to discover the perfect vulnerability worthy of a great writeup and a dazzling web page. In addition to getting your name out in the world and building your credibility, bug bounty programs have also become more lucrative, and more organized.” This shift in how researchers publicize their work to compete for attention has driven media outlets to deliver the high volume, noisy news cycles we are seeing.

The vulnerabilities and tactics discussed in the report align with the theme of boardroom interest that has maintained popularity in cybersecurity for the last few years. How do security teams not only react to, but capitalize on the increased attention from C-levels and boards? Especially in 2018, that attention turned toward vulnerability management. Whether this attention is triggered by a story in the business press or a technical outlet like Bleeping Computer, security teams need to be able to articulate the risks posed by vulnerabilities in terms that allow key stakeholders to make the best decisions.

Watch: Expert Panel Discusses Headline Vulnerabilities Report at Edge 2019

Update, June 4, 2019: We discussed the report's findings in an Expert Panel session during Tenable's Edge 2019 user conference, May 21-23 in Atlanta. The session was moderated by Paul Roberts, Publisher and Editor in Chief of The Security Ledger, and featured myself along with: Kevin Kerr, CISO, Oak Ridge National Laboratory; Greg Kyrytschenko, Head of Security Services, Guardian; and Ramin Lamei, Senior Director, Information Security Officer, Global Payments. Watch the full session below:

Learn more:

Read more >

Published on May 22, 2019

People also viewed

Enterprise Territory Manager - Chicago

Chicago Illinois United States Chicago, Illinois, United States Sales Sales
Your Role:Tenable is currently searching for an Enterprise Territory Manager. The Enterprise Territory Manager (ETM) is responsible for establishing and developing business through existing and new clients in an assigned territory.Your Opportunity...

Enterprise Territory Manager - Chicago

Milwaukee Wisconsin United States Milwaukee, Wisconsin, United States Sales Sales
Your Role:Tenable is currently searching for an Enterprise Territory Manager. The Enterprise Territory Manager (ETM) is responsible for establishing and developing business through existing and new clients in an assigned territory.Your Opportunity...

Software Engineer - Web Scraping (Python)

Remote United States Remote, United States, 97458 Research Engineering
Your Role:Tenable is looking for a Software Engineer to join our Automation research team.  This position will involve building and maintaining our framework for automated content creation, validation, and deliveryYour Opportunity: Impact: You wi...

Product Security Architect - Security Development Lifecycle

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Information Security IT
Your Role:As part of the Information Security team, the Principal Product Security Architect will help drive and coordinate security for Tenable’s applications and services portfolio. This includes designing and working on Security Development Lif...

Software Engineer

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Engineering Engineering
Your Role:Are you excited about the opportunity to work with microservices at scale? Do you like knowing that the changes that you deploy to production will improve the customer experience of many users worldwide? Do you like both the exciting, fa...

Software Engineering Manager, UI

San Jose California United States E Santa Clara St., San Jose, California, United States, 95113 Engineering Engineering
Your Role:Tenable is looking for an extraordinary Engineering Manager to join the Tenable.io Engineering team. This is an opportunity to make a high impact while helping the team deliver on a next-generation enterprise web application. The ideal c...

We have big plans for continued global growth, and we’re looking for people who are creative, flexible and dedicated to helping us build something great – something that matters.