The lifecycle of vulnerabilities: why timing is everything

Vulnerability management is vital for security teams: the volume of vulnerabilities rises daily and organised gangs are actively seeking out and exploiting unpatched networks. While the vulnerability disclosure and management industry is maturing rapidly, with an increasing uptake of bug bounty services helping hugely alongside improvements in automated tools, recent research has found that key assumptions behind some of the fundamental strategies – such as responsible disclosure – have flaws. One of the key discoveries was that responsible disclosure of a vulnerability before a patch is ready does not have the desired effect: companies do not respond with a sense of urgency. On average, attackers gain a 47-day advantage over defence teams when investigators release an exploit ahead of a patch’s availability. Image courtesy of Kenna Security and the Cyentia InstituteKenna Security and the Cyentia Institute research looked at 473 vulnerabilities from 2019 in which there was some evidence of exploitation in the wild. For the entire 15-months, attackers had the momentum about 60 percent of the time. The researchers found that around one third of vulnerabilities have exploit code published before a patch is available, and exploit code was already available for over half of vulnerabilities when they were published to the CVE system (and it was eventually exploited in the wild).Power and responsibilityEd Bellis, founder and CTO of Kenna Security, told SC Media UK that although the figures seemed concerning, they represent a small number of the overall vulnerabilities due to the research’s tight focus. “There could be a number of contributing factors here, most obviously the accompanying hype that promotes some vulnerabilities more than others, ensuring they get greater visibility and more attention. And the study covered a single year’s worth of vulnerabilities, so it’s possible there is an anomaly in the data itself. “But, the fact remains that the results raise several questions about responsible exposure, demonstrating that the timing of exploit-code release can shift the balance in favour of attackers.” As the researchers note in the report, releasing exploit code as part of a responsible disclosure timeline is an important step in remediating a new vulnerability, as automated scanners can then update with the details of the exploit. Exploit code can also prove to vendors or asset owners that a vulnerability is real as well as enabling administrators to remediate prior to a patch. A flawed infinite patch strategyThat said, context and risk weighting are key to effective vulnerability management, as Eoin Keary, CEO and founder of Edgescan, told SC Media UK: “Weeding out false positives from the white noise of vulnerability data is very, very important. We need to focus on what matters: patching all vulnerabilities is an unrealistic target, and a low false positive rate is essential to allow for high and critical issues being addressed. “Context is also an important component of how these issues are prioritised and why all organisations need to have a cyber risk management strategy in place.“The idea of saying one vulnerability management solution is better than another because it ‘reports more issues’ is folly. We need to report on the items that matter. “Automation alone, ‘software testing software’, will never truly work – there will always be the need for human expertise to validate the software’s output. We are trying to defend systems from determined, highly expert humans, who in many cases have sophisticated automation tools at their disposal. “For this reason, humans’ ability to understand context will never become obsolete. The most effective solution is the one that augments human capabilities using technology, as opposed to one that aims for 100% automation.”Prioritising the right vulnerabilityFortunately there is good news in general for defenders, with most experts advocating a risk-based approach to vulnerability management as the holy grail. Simone Roe, product manager at Outpost24, told SC Media UK: “This approach means you reduce the sheer volume down to a more manageable ‘patch it now’ because it has a direct risk impact to your business’ list of vulnerabilities. “Using threat intelligence, the real world view of how specific vulnerabilities are being used and targeted by threat actors, as well as understanding the business risk appetite, including which physical servers or machines are the most critical – and which are exposed directly on the internet – allows you to shrink that volume of findings down to between 5% and 10% of the total. “It means vulnerability management becomes more manageable and allows the defenders to ask the question: ‘Do I really need to worry right now about this vulnerability?’”The UK government took action in late 2020, publishing guidelines to businesses, addressing the benefits of having a Vulnerability Disclosure Policy (VDP) in place to reduce the risk of cyber-attacks. But, according to Bellis, the key to success is to ensure that triage of submitted vulnerabilities is a managed service, rather than another internal workload. “More mature enterprises are definitely establishing VDPs and joining bug bounty programmes too, but the managed service element is crucial to ensuring that only high-quality vulnerabilities are presented for remediation. “That way the enterprise security team gets the low hanging fruit, rather than creating a potentially vast triage volume problem.”

Your cyber intelligence source

The lifecycle of vulnerabilities: why timing is everything

Related content

Microsoft Pushes Forward Launch of Recovery Tool

Palo Alto Networks Dismiss Number of Vulnerable Firewalls

Government Security Group Seeking New Members and Expertise

Microsoft Takes Down Phishing-as-a-Service Domains

Research: Half of Working Week Commonly Lost to Manual Tasks

Five Named and Charged in SMS Phishing Effort

Businesses Commonly Attacked Outside of Working Hours

Upcoming Events

The lifecycle of vulnerabilities: why timing is everything

Related content

Microsoft Pushes Forward Launch of Recovery Tool

Palo Alto Networks Dismiss Number of Vulnerable Firewalls

Government Security Group Seeking New Members and Expertise

Microsoft Takes Down Phishing-as-a-Service Domains

Research: Half of Working Week Commonly Lost to Manual Tasks

Five Named and Charged in SMS Phishing Effort

Businesses Commonly Attacked Outside of Working Hours

Upcoming Events

Confirm cancellation

Sign up benefits