PREDICTIVE PRIORITIZATION: HOW TO FOCUS ON THE .

PREDICTIVE PRIORITIZATION:HOW TO FOCUS ON THEVULNERABILITIES THATMATTER MOST

ContentsExecutive Summary3Cyber Risk Creates Real Business Risk4Why Traditional Vulnerability Management Efforts Fall Short4Important Things to Know About CVSS Scores5The Attack Surface Is Expanding6A Single IT Asset May Have Multiple Vulnerabilities6Introducing Predictive Prioritization7How Predictive Prioritization Works8Conclusion9Predictive Prioritization: How to Focus on the Vulnerabilities That Matter Most2

Executive SummaryEffective cybersecurity requires more time and resources than cybersecurity and IT teamshave. To make effective use of limited resources, they need to prioritize vulnerabilities andavoid wasting time on superfluous activities.Identifying the subset of vulnerabilities that matter most is tough when most publiclydisclosed vulnerabilities have been rated High or Critical. More precise informationenables better use of time, money and people. Using Predictive Prioritization – a processfor re-prioritizing vulnerabilities based on the probability that they will be leveraged ina cyberattack – organizations can dramatically improve their remediation efficiency andeffectiveness by focusing on the vulnerabilities that matter most.As the sheer number of technology assets increases, securing them all becomes moredifficult. This growing complexity creates vulnerabilities that are difficult to identify andfix because security professionals often lack fundamental visibility into all assets in theorganization’s attack surface. Even if they did have the visibility they need, patching allvulnerabilities with finite resources would be extremely challenging – if not impossible.The numbers are daunting: 15,038 new vulnerabilities were published in 2017 versus 9,837 in2016 – a 53% increase in a single year1. In 2018, 16,500 new vulnerabilities were published.2On average, enterprises find 870 vulnerabilities per day across 960 IT assets.3 Cybersecurityand IT teams don’t have the time or resources to handle all vulnerabilities, so the need toprioritize is obvious.This white paper explains why traditional vulnerability prioritization efforts fall short andhow Predictive Prioritization can help. Using Predictive Prioritization, organizations canexpect a 97% reduction in the number of High and Critical vulnerabilities they need to patchor remediate. And, they can concentrate their efforts on the issues that pose the greatest riskto their organization – while improving the efficiency of scarce security personnel andbudget resources.1 Vulnerability Intelligence Report,Tenable Research, 20182 National Vulnerability Database(NVD)3 Tenable ResearchPredictive Prioritization: How to Focus on the Vulnerabilities That Matter Most3

Cyber Risk Creates Real Business RiskPatching all the vulnerabilities present in an organization is difficult because:Businesses lack the visibility they need into and across all their technology assetsSome assets have multiple associated vulnerabilities, so the total number ofvulnerabilities is too numerous to manage91%of organizationsexperienced onecyberattack in thelast two yearsThere are too few cybersecurity and IT resources available to identify and patchall vulnerabilitiesThe inability to patch all vulnerabilities creates exploit opportunities. According to a studyby the Ponemon Institute4, 91% of organizations have experienced at least one damagingcyberattack over the past two years. 60% have had two or more cyberattacks.Why Traditional Vulnerability Management EffortsFall ShortIn a perfect world, organizations would patch all vulnerabilities. But, the number of patchesrequired across all assets exceeds cybersecurity and IT resources including budget andhuman capital. More than 110,000 vulnerabilities have been published in NIST’s NationalVulnerability Database (NVD), some of which date as far back as 1999. However, not all thosevulnerabilities have been or will be exploited. In fact, very few vulnerabilities will ever beactively exploited.According to the NVD, 16,500 new vulnerabilities were disclosed in 2018. Yet only 7% ofthese vulnerabilities had a public exploit available. Even fewer were actually leveraged byattackers – meaning the vast majority of these vulnerabilities posed only a theoretical risk.For most organizations, the difference between the vulnerabilities that could be exploitedand those likely to be exploited is measured in the thousands, making it extremely difficultto prioritize which vulnerabilities to remediate first, if at all.CVSS is notan effectiveprioritizationmetricbecause it:Lacks the granularityto provide an accuratemeasure of criticalitybased on actual vstheoretical riskProvides a relativelystatic number that doesnot reflect real-timeactivity in the threatlandscapeScores the majority ofvulnerabilities as Highor Critical4 Measuring & Managing the CyberRisks to Business Operations,Ponemon Institute, December 2018Predictive Prioritization: How to Focus on the Vulnerabilities That Matter MostMost44

Important Things to Know About CVSS ScoresCVSS is an industry-standard means of assessing the severity of security vulnerabilities. Thescoring system ranges from 0-10, with 10 representing the highest level of criticality.CVSS scoring criteria changed from CVSSv2 to CVSSv3, which significantly impacted thedistribution of severity ratings. According to CVSSv3 ratings, 60% of vulnerabilities areconsidered High or Critical compared to 31% in CVSSv2 as shown in Figure umCVSSv2HighCriticalCVSSv3Figure 1. CVEs Overall - CVSSv2 to CVSSv3 ClassificationPredictive Prioritization: How to Focus on the Vulnerabilities That Matter Most5

The Attack Surface Is ExpandingAn organization’s attack surface is all the points where an attacker could possibly infiltrate.With digital transformation, the attack surface has expanded past traditional IT assets toinclude mobile devices, cloud, containers, IoT and Industrial Control Systems (ICSs ). SeeFigure 2. Put simply, more devices result in more vulnerabilities.Industrial IoTIoTICS/SCADAEnterprise IoTCloudCloudWeb AppContainerVirtual ctureFigure 2. Digital transformation has resulted in new attack vectorsBusinesses are most adept at handling the traditional vulnerabilities involving servers,desktops and network infrastructure because the tools are the most mature and familiar.Mobile security remains challenging given the device, operating system and browserdiversity; infrastructure complexity; poor app security design; and end users’ generallack of cyber hygiene. Cloud assets, including virtual machines and containers, tend tobe ephemeral, making them hard to see. ICSs predate the Internet, so they weren’t builtwith cybersecurity in mind. And IoT and IIoT are designed for Internet connectivity, but notnecessarily cybersecurity.A Single IT Asset May Have Multiple VulnerabilitiesBeyond that, each IT asset may have multiple vulnerabilities associated with it. For example,5,255 CVEs are associated with the Windows 10 operating system in the NVD at the time thisdocument was written.Predictive Prioritization: How to Focus on the Vulnerabilities That Matter Most6

Introducing Predictive PrioritizationPredictive Prioritization addresses the critical question every organization faces:“Where should we prioritize?” This new, machine learning–enabled process re-prioritizesvulnerabilities based on the probability that they will be leveraged in an attack.Tenable Research InsightsData science-based analysis of over100,000 vulnerabilities to differentiatebetween the real and theoretical risksvulnerabilities pose.Vulnerability ScoreThe criticality, ease of exploit andattack vectors associated withthe flaw.PredictivePrioritizationWHERESHOULD WEPRIORITIZE?97%Reduction in the number ofCritical and High vulnerabilitiesorganizations need to patchThreat IntelligenceInsight into which vulnerabilitiesare actively being exploited byboth targeted and opportunisticthreat actors.Figure 3. Predictive Prioritization provides a predictive,threat-based process for vulnerability remediationSpecifically, Predictive Prioritization combines over 150 data sources, including Tenable vulnerability data and third-party vulnerability and threat data, leveraging a proprietarymachine learning algorithm to identify the vulnerabilities with the highest likelihood ofexploitability in the near-term future.The algorithm analyzes every vulnerability in the NVD to predict the likelihood of anexploit for each. That way, cybersecurity and IT professionals can focus first on the3% of vulnerabilities that have been – or will likely be – exploited.Predictive Prioritization aligns with Gartner’s prioritization approach as part of risk-basedvulnerability management (see Figure 4).Figure 4. Prioritize — This Is The SingleBiggest Improvement (Source: Gartner)55 “Gartner’s Strategic Vision forVulnerability Management,” CraigLawson; Gartner Security & RiskManagement Summit, August 2019,Sydney, AustraliaPredictive Prioritization: How to Focus on the Vulnerabilities That Matter Most7

In fact, Predictive Prioritization differentiates between real and theoretical risks so wellthat organizations can expect to reduce the number of vulnerabilities they need to focuson by 97%. (Note: Predictive Prioritization helps you zero in on the vulnerabilities to fix first.However, that doesn’t mean you should stop there. Continue working your way down the listto further reduce your organization’s risk.)How Predictive Prioritization WorksPredictive Prioritization enables organizations to focus their efforts based on thevulnerabilities that:Are most likely to be exploitedWill have a major impact, if exploitedPredictive Prioritization combines data from various sources including familiar CVSS scores.Each data source is weighted based on its predictive capability. The output of PredictivePrioritization is a vulnerability priority rating (VPR), which is achieved by analyzing 150 distinctvulnerability characteristics in seven categories including:Past threat patternPast threat sourceGARTNERRECOMMENDS:“Start monitoringthis as a keymetric:How manyvulnerabilities, doyou have, that arebeing exploited inthe wild”5Vulnerability metricsVulnerability metadataPast hostilityAffected vendorExploit availability using threat intelligence data5 “Gartner’s Strategic Vision forVulnerability Management,” CraigLawson; Gartner Security & RiskManagement Summit, August 2019,Sydney, AustraliaPredictive Prioritization: How to Focus on the Vulnerabilities That Matter Most8