Vulnerability Intelligence Report: A Risk-Centric Approach To Prioritization

Kevin Flynn

<p>Tenable Research set out to provide organizations with the real-world data they need to take a risk-centric approach to vulnerability management.</p>
<p>Insight into the true state of cyber exposure - how defenders are actually acting - not how they think or say they are, has so far been difficult to discern.</p>
<p>The newly released <a href="">Vulne... Intelligence Report</a> provides an overview of current vulnerability disclosure trends and insights into real-world vulnerability demographics in enterprise environments. The report analyzes vulnerability prevalence in the wild, based on the number of affected enterprises, to highlight vulnerabilities that security practitioners are dealing with in practice, not just in theory.</p>
<p>With 61% of all vulnerabilities detected in enterprise environments rated as a High severity, cybersecurity teams are challenged to determine which vulnerabilities truly represent a risk. They need to prioritize the most critical vulnerabilities to maximize limited remediation resources. When everything is urgent, triage fails.</p>
<h2>Better prioritization is critical</h2>
<p>In order to prioritize, organizations first need to better understand the actual, not theoretical, impact of vulnerabilities. As a prioritization metric, CVSS has its shortcomings. It lacks granularity at scale and volume, as the majority of vulnerabilities are classified as High or Critical severity. The shift from CVSSv2 to CVSSv3 only adds to the problem, as the majority of vulnerabilities are now registered as either 'High' or 'Critical.'</p>
<p>Common sense dictates that if everything seems important, then nothing is – and a better way of prioritization is needed. Such insight needs to incorporate context, such as threat intelligence, so organizations can prioritize vulnerabilities based on actual threats 'in the wild.'</p>
<p>Tenable Research set out to provide such insight in the <a href="">Vulne... Intelligence Report </a>.</p>
<p>The report analyzes vulnerability prevalence, based on the number of maximum affected enterprises on a single day, to highlight the vulnerabilities security practitioners are dealing with on a daily basis.</p>
<p>On average, an enterprise is finding 870 CVEs across 960 assets every single day. This means prioritization methodologies based on remediating only High severity CVEs still leave the average enterprise with more than 548 vulnerabilities per day to assess and prioritize, often on multiple systems.</p>
<p>This means prioritization methodologies based on remediating only critical CVEs will still leave the average enterprise with over a hundred vulnerabilities per day to prioritize per patch, often on multiple systems. Adding to the problem is the fact that vulnerabilities not defined as ‘critical’ (i.e., having a CVSS score lower than 9), can have a catastrophic effect – for example WannaCry exploited a vulnerability with a score below 9.0 (the vuln was listed as 8.5).</p>
<p>This study confirms managing vulnerabilities is a challenge of scale, velocity and volume. It is not just an engineering challenge, but requires a risk-centric view in order to prioritize thousands of vulnerabilities that superficially all seem the same.</p>
<p>The report introduces the Top 20 Vulnerability Chart – providing insight into the most prevalent vulnerabilities that exist across different technologies in the enterprises. The chart utilizes real-world telemetry data to reveal which vulnerabilities are actually present in enterprise environments and subsequently represent the greatest true risk. Organizations can use this information to put into perspective their own list of vulnerabilities as compared to the larger population.</p>
<h2>Key findings</h2>
<li><i>The haystack is getting bigger</i> – 15,038 new vulnerabilities were published in 2017 in total, versus 9,837 in 2016, an increase of 53%. 2018 is on track for 18,000-19,000 new vulnerabilities. Almost two thirds (61%) of the vulnerabilities enterprises are finding in their environments have a CVSSv2 severity of High (7.0-10.0).</li>
<li><i>But there are few needles</i> - Public exploits are available for just 7% of all vulnerabilities. The reality is that, for most vulnerabilities, a working exploit is never developed and of those an even smaller subset are actively weaponized and employed by threat actors. Finding and fixing the 7% is critical to improving an organization’s cyber exposure.</li>
<p>At current projections, more than 1,500 exploited vulnerabilities will be published in 2018, or just over 28 exploited vulnerabilities every week. Better insight is a necessity, not a ‘nice to have.’ Download the Vulnerability Intelligence Report <a href="">here </a> to gain the insight you need to begin building a risk-based approach to prioritization.</p>
<p><b>Learn More:</b></p>
<li>Download the <a href="">Vulne... Intelligence Report</a>.</li>
<li>Read the eBook: <a href=" to Prioritize Cybersecurity Risk: A Primer for CISOs</a>.</li>
<li>Read our tech blog: <a href=" Vulnerability Intelligence Insights Worth Your Attention</a></li>

Read more >

Published on Nov 7, 2018

People also viewed

Technical Support Engineer

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Technical Support Technical Support
Your Role:Tenable is looking for motivated individuals to join our Technical Support Team. The Technical Support Engineer (TSE) is the first contact for all customers when they require technical assistance.  In a time when the next Spectre and Mel...

Customer Success Manager - APAC Nessus

Singapore Singapore Singapore North Bridge Road, Parkview Square, Singapore, 188788 Customer Success Sales
Your Role:Tenable has an immediate need for a Customer Success Manager who will be responsible for establishing and driving sales activities for our software products within a designated geography. You will be expected to penetrate and prospect na...

Sales Development Representative

Singapore Singapore Singapore North Bridge Road, Parkview Square, Singapore, 188788 Lead Generation Sales
Your Role:The Sales Development Representative supports remote sales teams in and is responsible for generating new business via inbound and outbound phone opportunity qualification. Your Opportunity: Perform outbound calling to generate new sales...

Security Engineer - Mexico

Mexico City Mexico Mexico Presidenta Masarik, Polanco V Seccion, Mexico City, Mexico, 21045 Sales Engineering Sales
Your Role:Tenable is seeking a Security Engineer to support demos and evaluations of enterprise opportunities across the territory. Assist in developing business value propositions around Tenable's products and solutions. Drives sales with technic...

Director of Engineering - Shared Services Infrastructure

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Sensors Engineering
Your Role:Tenable is looking for a talented and energetic Director of Software Engineering to lead the Shared Services Infrastructure (SSI) development team. The SSI team helps organizations address key challenges of traditional vulnerability scan...

Principal UX Designer

San Jose California United States E Santa Clara St., San Jose, California, United States, 95113 Cloud Platforms Engineering
Your Role:Tenable is looking for an extraordinary Principal UX Designer to join our team. Our group is chartered with creating the next generation of security products while at the same time pioneering unprecedented user experience in the digital ...

We have big plans for continued global growth, and we’re looking for people who are creative, flexible and dedicated to helping us build something great – something that matters.