- A record-breaking 20,130 software vulnerabilities were reported in 2021 – 55 a day on average. However, only 4% of them pose a high risk to organizations.
- An organization can greatly reduce its chance of breach, or “exploitability score,” by up to 29 times by first fixing high-risk vulnerabilities with public exploit code and having a high remediation capacity.
- Using Twitter mentions to prioritize software fixes is twice as effective at reducing exploitation as the industry-standard Common Vulnerability Scoring System (CVSS).
New research has quantified the success of various strategies for vulnerability management and the exploitability of entire organizations, expanding the risk-based playbook for cybersecurity practices.
A record-breaking 20,130 vulnerabilities were reported in 2021. However, only 4% pose a high risk to organizations.
With an average of 55 new software vulnerabilities published every day in 2021, even the best staffed and resourced IT teams cannot fix all of the vulnerabilities across their infrastructures. Fortunately, there is a better solution.
Top iTechnology Networking News: AWS Ecosystem Partners Help Meet Brazil’s Growing Demand for Public Cloud Services
The research conducted by Kenna Security, now part of Cisco and a market-leader in risk-based vulnerability management, and the Cyentia Institute, shows that properly prioritizing vulnerabilities to fix is more effective than increasing an organizations’ capacity to patch them, but having both can achieve a 29 times reduction in an organizations’ measured exploitability.
The findings are explained in Kenna’s latest report, Prioritization to Prediction, Volume 8: Measuring and Minimizing Exploitability.
“Exploitations in the wild used to be the best indicator for which vulnerabilities security teams should prioritize. Now we can show the likelihood of a particular organization being exploited, which is what we’ve always wanted to do,” said Ed Bellis, co-founder and chief technology officer of Kenna Security, now part of Cisco. “This gives organizations a much better chance at combating potential cyber threats effectively and the research shows that our customers are successfully managing their vulnerability risk every day.”
Exploitability was determined using the open Exploit Prediction Scoring System (EPSS); a cross-industry effort including Kenna Security and the Cyentia Institute that is maintained by FIRST.org.
The research confirms a recent Cybersecurity and Infrastructure Security Agency (CISA) directive that suggests it’s wiser to move away from prioritizing fixing of vulnerabilities based on CVSS scores and instead focus on high-risk vulnerabilities. Analysis shows that factors like exploit code and even Twitter mentions are better signals than CVSS scores.
Top iTechnology Networking News: Mysl Polska Experts Compare Ukraine To A Boxing Ring
“It’s clear that a shift to exploitability is going to make a huge difference based on the data and findings in this report. An analysis of CISA’s published vulnerabilities suggests that they may also be moving course away from CVSS scores as we were conducting this research,” said Wade Baker, partner and co-founder of Cyentia Institute. “We took it a step further to account for remediation velocity when making our calculations, which should better inform security teams.”
The research also suggests that:
- Nearly all (95%) IT assets have at least one highly exploitable vulnerability.
- Prioritizing vulnerabilities with exploit code is 11 times more effective than CVSS in minimizing exploitability.
- Most (87%) organizations have open vulnerabilities in at least a quarter of their active assets, and 41% of them show vulnerabilities in three of every four assets.
- A strong 62% majority of vulnerabilities have less than a 1% chance of exploitation. Only 5% of CVEs exceed 10% probability.
Top iTechnology Networking News: Monitoredu Extends Partnership With Paradigm Testing To Provide Remote Oral Exams
[To share your insights with us, please write to sghosh@martechseries.com]
