Learn to say NO to almost every vulnerability (intro to vPrioritizer)
By: Pramod Rana, Iamvarchashva
Tags: Vulnerability Management, Information Security, Risk Management, Infosec, Open Source

As reflected, on a daily basis, approximately 50 new vulnerabilities become known to industry and even if an organization considers the impact rate of 10%, it’s still very challenging to manage it effectively. So we have a huge number of vulnerabilities to assess and remediate and it’s safe to assume that count is going to increase furthermore. So with this amount organization is focusing (or should focus) on reducing the risk rather than eliminating it.

In today’s time, vulnerability management is (almost) equal to risk prioritisation because

Resources (skillset and time) is limited in every organisation Environment is changing too fast and too frequently (there is no point of doing analysis and remediation of a vulnerability if affected asset is not going to be active for a longer time — small attack surface) Attack surface is increasing exponentially (which again comes down to prioritisation) Remember the 80/20 rule — 20% of vulnerabilities bring 80% of risk

So what is risk? How do we calculate it? What are the factors contributing to risk?

CVSS (historically used) — No

Asset Criticality — No

Asset Accessibility — No

Exploit Availability — No

Ease of Exploitation — No

Threat/Attack Surface (am I target now) — No

All of the Above — Yes

This list is not exhaustive, consider it as living list, which I will keep updating.

Theoretically, the above approach looks appropriate to adopt but it’s not practically possible to do it manually for every vulnerability affecting every asset by every organisation.

To overcome the above challenges I have developed an open-source framework — vPrioritizer, with primary objectives as below:

Centralized — must serve as single-pane-of-glass for vulnerability management Automated — any and every task which can be automated, must be automated Community Analytics — utilization of community analytics to mature the prioritization algorithm over the period of time

vPrioritizer (demo) gives us ability to assess the risk on different layers such as (and hence comprehensive control on granularity of each of risk as described above in risk calculation section):

We can assign significance on per asset basis

We can assess severity on per vulnerability basis

At the same time, we can adjust both factors at asset & vulnerability relationship level

On top of that, community analytics provides insights as suggested risk

Conclusion

vPrioritizer enables us to understand the contextualized risk pertaining to each asset by each vulnerability across organization. It’s community based analytics provides a suggested risk for each vulnerability identified by vulnerability scanners and further strengthens risk prioritization process. So at any point of time teams can make an effective and more informed decision, based on unified and standardize data, about what (vulnerability/ties) they should remediate (or can afford not to) on which (asset/s).

Takeaways

1. Risk is a variable, function of multiple parameters

2. Prioritize correctly — Fix first, what matters most

3. Share with community — that’s the only way to scale

4. Fix fast, test fast, fail fast, adjust fast