FOSSA + OWASP LA

July 24th, 2024
Speaker: Chelsea Boling2HOWDY! Who likes an agenda?! 🚀🚀🚀🚀🚀❏❏❏IntrosCVE noise and breaking it throughVulnerability prioritization demonstration

Breaking Through CVE Noise:
Analyzing 5 Key Prioritization Inputs
Streamlining Vulnerability Resolution Process

4Understanding CVE Noise
Managing thousands of CVEs poses significant challenges for security
teams in prioritizing threats effectively.
With thousands of new CVEs reported annually, security teams face thedaunting task of sifting through and prioritizing the most criticalvulnerabilities.
Distinguishing between the severity levels of vulnerabilities is crucial toallocating resources efficiently and addressing the most impactfulthreats first.

5CVSS Scores
The Common Vulnerability Scoring System (CVSS) provides a standardized method for assessing and prioritizing
vulnerabilities based on their severity and impact on systems: https://nvd.nist.gov/vuln-metrics/cvss

EPSS Scores
The Exploit Prediction Scoring System (EPSS) helps security teams predict which vulnerabilities are likely to be exploitedand need immediate attention, enabling proactive security measures.

CISA KEV Catalog
The CISA (Cybersecurity & Infrastructure Security Agency) Known Exploited Vulnerabilities (KEV) Catalog helps identify
vulnerabilities actively exploited in the wild, guiding security teams in focusing on immediate threats with known exploit
activity.

56VEX Data
Vulnerabilities Exposure Factor (VEX) communicates whether or not a vulnerability is exploitable given it’s real world use
case and its potential impact across the business organization.

Reachability Analysis
Reachability analysis infers if the vulnerability is reachable in your ﬁrst-party code. Reachability analysis lists call paths fromyour ﬁrst-party code to vulnerable functions associated with CVEs. This way, you can proactively remediate the issue by
modifying your usage of dependency. This highly depends on your build environment.

Business Context
Prioritization of vulnerabilities comes with what you may know in your own business (e.g. the types of security tools that areavailable (or not available), the cybersecurity budget your organization you may have, the applications that are the mostvaluable to your org).

7CVSS Scores

EPSS Scores

CVSS (Common Vulnerability Scoring System) has long
been seen as the de facto mechanism for vulnerability
prioritization, but industry focus in recent years has shiftedto exploitation as an indicator for vulnerability risk

7

Projects such as EPSSand CISA Known
Exploited Vulnerabilities(KEV) have emerged,
providing visibility into thisdata for the entire
security community.

8

Example of KEV Data

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

89Vulnerability Exploitability Exchange (VEX)
VEX (Vulnerability Exploitability eXchange) is a set offormats used to describe whether vulnerabilities that
affect components of a software product affect theproduct itself.
9

Why is VEX important?
The vast majority of vulnerabilities actually aren’t
exploitable in their real-world product context.
Reasons why include that:●

The vulnerable component isn’t present●

The vulnerable code isn’t present●

The vulnerable code can’t be controlled by anadversary

VEX data (which is provided by the software supplier) complements other●

The vulnerable code isn’t in the execute pathvulnerability inputs (like EPSS, CVSS, and reachability analysis) to provide a●Inline mitigations already exist

more accurate picture of security risk.
https://www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf

10

Vulnerability Exploitability Exchange
VEX Data1011

Answer the basic, adminy questions first❏❏❏❏

Do I know the high level functions of theapplication(s) that I support? List thesefunctions.
What programming languages, frameworks
and package managers are used?
How well do I know about the open source
packages that are used in the applications?
Are there existing processes in place to blockcode changes if there are vulnerabilities
present?

12Recommendations
❏❏
❏
❏
❏

Look at vulnerabilities identified in direct
dependencies
Filter by CVSS score
Is there a fix available?
❏ Start with patches or minor upgrades
Focus on vulnerabilities listed in the KEV
catalog
Sort by the highest EPSS score within thedetected KEV CVEs.

13

Next level recommendation
Explore/review results fromreachability analysis (for contextual
risk assessment)- Previous inputs may or may notapply

14

Let’s tackle vuln
overload in an
actual SCA tool…..
Oh, yeah, likeFOSSA

15

Some takeaways
Combine Severity and Exploitability to Assess Risk
Use CVSS scores for severity and EPSS scores for the likelihood of exploitation to assess overall risk.

Prioritize Actively Exploited Vulnerabilities
Prioritize vulnerabilities in the CISA KEV catalog and use VEX data to understand exploitability and mitigation
availability.

Contextualize with Reachability Analysis
Incorporate reachability analysis to determine if vulnerabilities can be exploited in your environment, ensuring a focusedand relevant risk assessment.

Combine reachability insights (if available/detected) with CVSS, EPSS, KEV, and VEX data to form a comprehensive risk
assessment. This ensures that you prioritize vulnerabilities that are not only severe and exploitable but also relevant to yourspecific threat landscape.

16

Email chelsea@fossa.com for a FREE
pdf on vulnerability resolution!!!!!
Bonus open source compliance resolution ⋆˚࿔inside𝜗𝜚˚⋆

150 × 150

17QA time!!!
Open to discuss…
--

Share your process around resolving vulnerabilities
As an OSS maintainer
You’re actually working at a company (startup, enterprise?)
As a new open source contributor, how can I help?

18

Additional references
CISA.gov justifications:
1.
2.
3.

4.
5.

Component_not_present
Vulnerable_code_not_present
Vulnerable_code_cannot_be_controlled_by_adv
ersaryVulnerable_code_not_in_execute_path
Inline_mitigations_already_exist

FOSSA justifications:
1.
2.
3.
4.

5.
6.
7.

Component_not_present
Incorrect_data_foundInline_mitigations_already_exist
Vulnerable_code_cannot_be_controlled_by_
adversary
Vulnerable_code_not_in_execute_path
Vulnerable_code_not_present
Other (with space for your text)

CycloneDX's VEX options:
1.
2.
3.
4.
5.
6.
7.
8.
9.

code_not_present
code_not_reachable
requires_configuration
requires_dependency
requires_environment
protected_by_compiler
protected_at_runtime
protected_at_perimeter
protected_by_mitigating_control

19

Additional references
Learn more about FOSSA:
https://github.com/fossas/fossa-cli/tree/master
https://docs.fossa.com/
https://fossa.com/blog/using-cisa-kev-catalog/