The Patching Paradox: A Path to Intelligent Vulnerability Management

Imagine: You’re out at sea, sailing through treacherous and uncharted waters. The tips of sharp rocks jutting from the waves give some forewarning of danger, but beneath the surface, twisting reefs and shallow sandbanks threaten to run you aground. Despite your best efforts, it’s only a matter of time before you puncture the hull of your ship and water begins to flood between the leaks and cracks.

As you desperately bail saltwater from the hold and look for ways to patch the holes, you cannot help but lament your fate, wishing you had set out in a more seaworthy and impenetrable vessel, no matter the cost — any price would have been worth paying to keep yourself safe. Better yet, you realize, would have been to hire the best sailors and chart your course ahead of time. After all, you would have never come this way if you’d known these waters held so much danger.

In cybersecurity, there’s no such luck as an unsinkable ship or a map that marks all the hazards. The current is always changing and new threats come as quickly as a summer tsunami. This means that the most effective way to improve your security posture is to focus on identifying the risks that will actually affect your organization, and then prioritize patching the associated vulnerabilities.

The Most Dangerous Rock Is the One You’re Sailing Toward

In theory, the best way to stay protected is to keep every system you use up to date by patching every vulnerability as soon as it’s identified and always using the newest software. In practice, this “patch everything, everywhere” approach is almost impossible to sustain. By some estimates, around 10,000 new component versions featuring bug fixes, security patches, and new features are released every day. Even though any one organization will only use software that represents a small proportion of this number, any cybersecurity team that tries to keep their systems completely up to date day after day will find themselves overburdened and unable to do any other work.

The obvious conclusion is to prioritize patching the vulnerabilities that put your organization at the most risk. But quantifying that risk is not as easy as focusing on vulnerabilities with the highest severity score. Recorded Future has looked at this before — industry research has shown that the biggest threats are not those vulnerabilities that would cause the most damage to your system if exploited, but those vulnerabilities in your organization’s environment that are currently being exploited by actual threat actors in the real world. It’s not the zero-day exploits that nobody has a defense against or some other clever new threat that does the most damage, but vulnerabilities that people know about but just haven’t gotten around to patching.

Chart Your Own Course

The most important first step for managing your vulnerabilities intelligently is to quantify the actual risk each vulnerability poses to your organization. That means looking not at the hypothetical severity of each risk, but at metrics that will help you identify the overlap between the risks that you can fix and the ones that will make the most difference, given the time and resources you have.

Some of the most widely used industry standards for ranking vulnerabilities, like the Common Vulnerability Scoring System (CVSS), may not provide the right information from this perspective. CVSS scores assign severity rankings from zero to 10 to known system vulnerabilities, but the base score in this system is determined by variables like how exploitable a vulnerability is and how significant an impact it would have if it were to be exploited, leaving the score purely in the realm of hypotheticals.

CVSS scores are a good place to start when figuring out how to manage the vulnerabilities in your network because it’s a standardized score, the formula for determining it is free and publicly distributed, and it provides a good foundation. However, the ranking can ignore a lot of information, like an exploit’s frequency of use in criminal activities, that might cause you to shift your focus one way or another.

What really matters the most to any single organization is what vulnerabilities exist in their system that threat actors are exploiting right now, today. Many patches can be ignored because the vulnerabilities they fix just aren’t being targeted by anybody — if it’s broken but no one’s using it, let it lie. On the other hand, some patches that are not rated highly in terms of urgency — maybe relatively few people are using it, or maybe the vulnerability only exists in a small number of environments — may be critical for your organization in particular to fix. That makes vulnerability management tools only as good as the external threat intelligence you have.

Open Waters

For some threats, easy solutions like patches just aren’t out there yet. Beyond just zero-day exploits, some vulnerabilities exist that are both actively exploited by threat actors and also haven’t been patched yet. In those cases, workarounds can still be identified. Adobe Flash, for example, consistently scores high on vulnerabilities that are actually exploited in the wild, with the majority of the top 10 most widely exploited vulnerabilities in 2015 and 2016 being in Adobe products like Flash. Rather than constantly trying to keep up with patches, users can just switch to browsers like Chrome or Firefox that block Flash by default, or install ad blockers on their systems to reduce the possibility of accidentally clicking on Flash-based malware.

In more drastic cases, where a threat is so severe that immediate action must be taken but no patch or other workaround exists, you can always pull the plug. The Canadian Tax Agency, for example, chose to shut down multiple servers after attackers took advantage of a critical vulnerability in their systems known as Apache Struts. And after the Meltdown and Spectre vulnerabilities were identified earlier this year, some researchers recommended that groups using vulnerable processors stop working on sensitive information until better solutions were found.

Deciding how to respond to threats needs to be based on real risks supported by good data. Use automated vulnerability management tools to quickly identify which parts of your system need critical care, and then prioritize those vulnerabilities with threat intelligence that tells you which vulnerabilities are actually most liable to be exploited.

To learn more about how external threat intelligence can help your organization uncover the vulnerabilities in your system that threat actors could be exploiting right now, download our free white paper, “Vulnerability Intelligence From the Dark Web: The Disclosure to Exploit Risk Race.”