Prioritizing Remediation Efforts via Risk-based Scoring

May 11, 2022

Introduction

Because we’re always short of resources and/or time, we must put these two elements to their best use. When it comes to managing vulnerabilities in an enterprise infrastructure, we can make a significant impact in a short time by quickly fixing those vulnerabilities that pose the highest risk to the enterprise. Meanwhile, we don’t want our resources to get overwhelmed by the sheer number of vulnerabilities they encounter on a day-to-day basis or when there’s a critical vulnerability breakout, such as the most recent example: the Apache Log4j vulnerability. We need resources to focus attention on the highest-risk vulnerabilities affecting the enterprise’s critical resources. Scoring and the mechanism used for scoring vulnerabilities and assets plays a vital role within the vulnerability management program.

Challenges With CVSS and Commercial Vulnerability Management Platform Scoring

The most common scoring mechanism used is the Common Vulnerability Scoring System (CVSS). CVSS is a free and open industry standard for assessing the severity of vulnerabilities. One challenge with the CVSS score is that it doesn’t capture the contextual or business risk for an organization that arises from a particular vulnerability. The CVSS base score captures the technical severity of vulnerabilities but doesn’t convey their true risk.

Nearly all top industry vulnerability scanners – such as Tenable, Rapid7 and Qualys – use CVSS as a baseline scoring mechanism. Most often than not, users of such tools use CVSS scoring to prioritize their vulnerabilities, which is not the best approach. Prioritizing vulnerabilities solely based upon the CVSS scoring will not help security teams focus remediation efforts to address vulnerabilities with the highest risk for critical assets.

Consider the following scenarios:

If the CVSS base score is used to prioritize the vulnerabilities in these scenarios, all will be critical and incorrectly given the same priority based upon their score. This highlights the need for a scoring mechanism that can consider the contextual and business risk of the vulnerabilities.

There are temporal and environmental score metrics (which to some extent capture the contextual and associated risk of vulnerabilities) available to complement the CVSS base score. However, using these metrics in enterprise environments where security teams deal with hundreds and thousands of vulnerabilities is overwhelming and complex. Security teams would need to find a mechanism to identify and leverage three base metrics to calculate the temporal score, and 11 base metrics to calculate the environmental score. This makes vulnerability prioritization cumbersome and simply not practical.

Platforms like Rapid7, Tenable and Qualys also have mechanisms to address enterprise risk by integrating threat information as an additional factor in their risk scoring. However, to benefit from these features, organizations must purchase or subscribe to additional or add-on applications that run on top of their VM platforms. Additionally, business context factors are still largely missing, and criticality of the assets must be predefined (by the organization) within the platform, all of which require well-trained resources. Only then can an improved risk-based prioritization of vulnerabilities and assets be achieved.

Based upon our experience working with clients using various vulnerability management platforms, we found that in most cases when an additional application is required to provide the contextual and business risk, it isn’t installed or utilized as an integral part of their vulnerability management platform. Furthermore, the platform often contains minimal asset details and lacks the contextual information necessary for calculating asset criticality.

Solution for Risk-based Scoring of Vulnerabilities and Assets

To address these challenges, we’ve devised a vulnerability and asset scoring mechanism that leverages business context information to more accurately identify the contextual and business risk associated with vulnerabilities and assets, thus enabling the team to correctly prioritize remediation efforts.

It’s critical for the remediation function of a vulnerability management program to identify the real-time risk of vulnerabilities and associated assets. Using this scoring mechanism will help teams determine which assets are the riskiest and which vulnerabilities should be remediated first; this reduces the overall risk to the enterprise significantly and more efficiently.

We start the scoring process by first evaluating the risk scores for vulnerabilities. Factors used in that calculation include the following:

CVSS score is by default included as a component of any vulnerability scanner. Vulnerability intelligence score is collected from any (client-preferred) vulnerability intelligence add-on sources, such as Mandiant Advantage Rating, RiskSense VRR, Tenable VPR, Rapid7 Real Risk Score, etc., normalized to a number between 1-10. Asset criticality and exposure are provided by clients, identified through discussions with key stakeholders or derived from information collected during discovery workshops.

Once we have the above data points, we use the below formula to calculate the vulnerability risk score for each vulnerability on each asset:

Image

The first part of the formula is a sanity check – if the vulnerability intel and CVSS scores are zero, vulnerability risk score will be zero.

The second part of the formula is used to calculate the vulnerability risk score. CVSS, vulnerability intelligence, asset criticality and asset exposure (internal/external) attributes are all used to derive the vulnerability risk score. In the formula, the score attributes are assigned different weights to account for varying levels of importance. For example, the vulnerability intel score will carry more weight than CVSS. Asset criticality and asset exposure are both weighted to help normalize the highest value up to a value of 10. As asset criticality increases, this weight causes it to increase two-and-a-half times, and as the asset exposure goes from 1 (internally exposed) to 2 (externally exposed), this weight causes it to double.

Risk-based vulnerability scoring helps prioritize remediation efforts by determining which assets have the highest risk. To do this, we also calculate the asset risk scores, which complement the vulnerability risk scoring and assists with focusing remediation efforts.

Since an asset can have multiple vulnerabilities, we calculate the asset risk score from the risk scores of each of the vulnerabilities on the asset.

The goal of the asset-vulnerability_(i) risk scoring formula is to prevent the mechanism from being overwhelmed by the sheer number of low- or medium-severity findings. We accomplish this by:

This avoids scenarios where an asset with 15 low-severity findings will have a higher asset risk score than the asset with four critical severity findings.

Once the asset-vulnerability_(i) risk from each of the vulnerabilities on the asset is identified, we calculate the overall risk score of the asset by adding the asset-vulnerability_(i) risk values of all identified vulnerabilities for that asset.

Conclusion

Our methodology for calculating vulnerability risk score and asset risk score helps prioritize the remediation efforts, whether clients are or are not using expensive commercial addons for their VM platforms. Implementing our risk-based approach and focusing upon key attributes essential for scoring the vulnerabilities and assets will help your organization accelerate and concentrate remediation activities in areas that reduce the most risk.