VULNERAFebruary 28, 2024

Navigating the Maze
Making Sense of Vulnerability Risk Indicators

Raffi Erganian, Cofounder – VULNERAVULNERA

February 28, 2024

Who We Are

Raffi Erganian

Joe Luna

Who We’ve Helped

VULNERA

February 28, 2024

What we’ll cover
Vulnerability Context
NVD Challenges
The Tools
Lagging Indicators
Prioritization
Easy WinsVULNERA

February 28, 2024

Vulnerability Context

VULNERA

February 28, 2024

NVD Dashboard

VULNERA

February 28, 2024

Awareness Overload

Existing CVE’s
New CVE’s
Vendor Advisories
Zero-Days
Ransomware Activity
APT Activity

TNA
VELE
RNOIATM
RFOINYour
Organization

VULNERA

February 28, 2024

Tools at our disposal
Industry, community, and vendor risk ratings/metrics

NVD, CVE, CVSS, CWE

CISA KEV, EPSS

Vendor Ratings

VULNERAFebruary 28, 2024

NIST & The NVD
The industry standard repository for vulnerabilities

CVSSCWE

DelayAccuracy

VULNERA

February 28, 2024

LAGGING INDICATORS
Exposure Window and Risk Tolerance
Delayed Response
Missed Opportunities for Mitigation
False Sense of Security
Compliance Risks

19 days

44 days23 days

CISA KEVEPSSScanners

VULNERA

February 28, 2024

Live DemoVULNERA

February 28, 2024

Stop reducing vulnerability risk
to a single score.

VULNERA

February 28, 2024

Prioritizing
Reducing the noise

Know Your Assets

NVD, CVSS, & CWE

CISA KEV / News / VIP-TIP

EPSS?

VULNERA

Know
Your
AssetsFebruary 28, 2024

IP Connected

Services, Software, & Applications

3rd Party Libraries, Frameworks, & Dependencies

VULNERA

February 28, 2024

Vulnerability
Prioritization
Awareness with Insight drives Action

Awareness

Insight

News, Peers,
Advisories, NVD,CISA KEV, etc

Deployed solutions &technologies

ActionCatalyst

Policies,
Procedures &Playbooks

Awareness vsTechnology Based
SignalsVULNERA

February 28, 2024

Awareness

NVD
Advisories
CISA

News

TIP/VIP

Peers & Social
Media

Awareness requires legwork.
You need to keep a pulse on what’s happening.

VULNERA

February 28, 2024

Insight

Asset
Inventory

SoftwareInventory

Vulnerability
Scanners

SBOM

What tools can you rely on for insight?

VULNERA

February 28, 2024

Challenges
Insight is uselesswithout Awareness
Awareness inactionable
without InsightNo action without
Insight + AwarenessVULNERAInsightPitfalls

February 28, 2024

ScheduleAgents

Would you run AV
once a week?

False negatives,
unsupported assets

Port Coverage

Excluded Checks

False negatives,skipping ports

Missing valuable
insight

VULNERA

February 28, 2024

Easy Wins
CNAs & Vendor Advisories

CVSS & CWE

Leverage TIP/VIPVULNERA

February 28, 2024

Easy Wins
Asset & Software Inventory

Edge Device/App List

Vulnerability Scanning

SBOM

VULNERA

February 28, 2024

Easy Wins
Policies, Procedures, Playbooks

Tabletop – Core Edge Device

Tabletop – 3rd Party Lib

Tabletop – SoftwareVULNERA

February 28, 2024

Prioritizing
CVSS, CWE, Advisories, News, Social MediaCISA KEV / VIP-TIP
CONTEXT

Vulnerability Scanner Signature & Score
EPSS Score / Percentile

LAG

VULNERA

February 28, 2024

Context is KingIs the vulnerability being actively exploited?
Is it used in ransomware or by APT groups?
Does it have publicly available POC’s?
Does it result in RCE? Code Injection? Authentication bypass?

VULNERA

February 28, 2024

Live Demo #2

VULNERA

February 28, 2024

Q&A

VULNERA

February 28, 2024

Get in Touch
Stay up to date with the latest research
Subscribe to our Vulnerability Intelligence Newsletter

raffi@vulnera.com

Follow us on LinkedIn