Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable 部落格

訂閱

讓媒體閉嘴:以媒體報導作為弱點管理的優先順序排定指標

We wondered whether mainstream media coverage of vulnerabilities changed how companies perform vulnerability management. So we asked them. Here’s what we learned.

In technical circles, vulnerabilities have always been news. More often now though, vulnerabilities are mainstream news. They are regularly covered in business outlets read by company leaders who may not otherwise get involved in the nitty gritty of vulnerability management. 

2018 was a big year for vulnerabilities in the media. Starting off immediately with Meltdown and Spectre in January, it felt like the coverage never stopped. Seeing this, we wondered whether and how this coverage changed the way companies were doing vulnerability management. So we asked them. Through the course of doing broad-scope interviews with CISOs and security analysts, we were sure to ask about their experiences with vulnerabilities in the news.

We asked interviewees “Has news coverage of vulnerabilities impacted your work? If so, how?” 

Most of them had experienced some sort of disruption to their normal operations because of vulnerability news coverage. The top two examples given were the speculative execution vulnerabilities, Meltdown and Spectre, and Struts2. The full report, Headline Vulnerabilities: How Media Coverage Shapes the Perception of Risk, contains details on strategies, tactics, and challenges that developed while responding to these incidents. Our key findings were that: 

  • High-profile vulnerabilities are not just a concern for security teams. These vulnerabilities, whether or not technically critical, can pose serious reputational risks and require relationship management with customers, partners, regulators and other key stakeholders. 
  • Media coverage is not an objective metric for determining the true criticality of a vulnerability, particularly in the context of a specific enterprise. The role of the media is to investigate and report on stories, not conduct risk analysis. They will report on vulnerabilities that are interesting, but not necessarily critical. 
  • However, media coverage may still influence holistic risk evaluations. While security teams are aware that media coverage is not an ideal measure of technical risk, they need to discuss their risk evaluation process with others. They also need to accept that the overall risk presented by a lower-severity vulnerability might require action.
  • Part of the role of a security team is to manage perceived risk and to advise key stakeholders, especially senior decision-makers, and enable a measured response to vulnerabilities based on contextualization, rather than hype. CISOs must be armed with vulnerability data in the proper context in order to properly convey their organizations’ Cyber Exposure to business leaders and invest resources appropriately to reduce risk.

However, there is another angle not covered in the report that I would like to discuss: it isn’t just the coverage in the business press that can impact how vulnerability management gets done. Security teams are tracking a much wider set of channels than their executives are for vulnerabilities. While security teams aren’t using this coverage as a single source of vulnerability intelligence, it can be used as a metric (combined with others) for prioritization. Let’s examine that aspect of the vulnerability media landscape. 

Vulnerability media landscape

While the Headline Vulnerabilities report focuses mainly on how organizations respond to major media coverage, stories that reach the level of the New York Times and broadcast news, the vulnerability media landscape covers a lot more than just those stories. While the pressure to perform is highest when the executive leadership or board of directors becomes aware of a vulnerability, security teams often use media coverage as a metric for severity. Media coverage typically will increase the priority of a vulnerability and this is particularly true once attacks are observed in the wild. For instance, Atlassian published an advisory for vulnerabilities in Confluence Server back on March 20, including a fix for CVE-2019-3396. However, it wasn’t until proof-of-concept (PoC) code and exploitation of this vulnerability became public that media outlets picked up on it. While it may not push it to the top of the pile, media coverage does act as an additional data point for prioritization.

Tenable’s Security Response Team (SRT) tracks vulnerabilities in the news (and other sources) and, since the beginning of 2019, nearly every noteworthy vulnerability disclosed has been covered by the media. That creates a lot of noise for security teams to manage. Media coverage is becoming less useful as a metric because the media landscape is changing. 

Reflecting on the changes to the media landscape, Ryan Seguin, research engineer on the SRT said, "I think over the last five years you've had a perfect storm of factors in the industry. The first major impact on vulnerability media coverage was Heartbleed in 2014, and the second being Twitter becoming the de facto method of communication for researchers. Heartbleed certainly wasn't the first vulnerability to get a catchy name, but in my anecdotal experience, its publication created a sort of vulnerability research gold rush. Since 2014, researchers are increasingly dedicated to being the next person to discover the perfect vulnerability worthy of a great writeup and a dazzling web page. In addition to getting your name out in the world and building your credibility, bug bounty programs have also become more lucrative, and more organized.” This shift in how researchers publicize their work to compete for attention has driven media outlets to deliver the high volume, noisy news cycles we are seeing.

The vulnerabilities and tactics discussed in the report align with the theme of boardroom interest that has maintained popularity in cybersecurity for the last few years. How do security teams not only react to, but capitalize on the increased attention from C-levels and boards? Especially in 2018, that attention turned toward vulnerability management. Whether this attention is triggered by a story in the business press or a technical outlet like Bleeping Computer, security teams need to be able to articulate the risks posed by vulnerabilities in terms that allow key stakeholders to make the best decisions.

Watch: Expert Panel Discusses Headline Vulnerabilities Report at Edge 2019

Update, June 4, 2019: We discussed the report's findings in an Expert Panel session during Tenable's Edge 2019 user conference, May 21-23 in Atlanta. The session was moderated by Paul Roberts, Publisher and Editor in Chief of The Security Ledger, and featured myself along with: Kevin Kerr, CISO, Oak Ridge National Laboratory; Greg Kyrytschenko, Head of Security Services, Guardian; and Ramin Lamei, Senior Director, Information Security Officer, Global Payments. Watch the full session below:

深入瞭解:

相關文章

您可以使用的網路安全最新消息

輸入您的電子郵件,就不會錯過來自 Tenable 專家提供的及時警示與安全指引。

Tenable Vulnerability Management

享受現代、雲端型的弱點管理平台,能夠以無與倫比的準確性查看和追蹤所有資產。

您的 Tenable Vulnerability Management 試用版軟體也包含 Tenable Lumin 和 Tenable Web App Scanning。

Tenable Vulnerability Management

享受現代、雲端型的弱點管理平台,使您能夠以無與倫比的準確性查看和追蹤所有資產。 立即訂閱一年。

100 項資產

選取您的訂閱選項:

立即購買

Tenable Vulnerability Management

享受現代、雲端型的弱點管理平台,能夠以無與倫比的準確性查看和追蹤所有資產。

您的 Tenable Vulnerability Management 試用版軟體也包含 Tenable Lumin 和 Tenable Web App Scanning。

Tenable Vulnerability Management

享受現代、雲端型的弱點管理平台,使您能夠以無與倫比的準確性查看和追蹤所有資產。 立即訂閱一年。

100 項資產

選取您的訂閱選項:

立即購買

Tenable Vulnerability Management

享受現代、雲端型的弱點管理平台,能夠以無與倫比的準確性查看和追蹤所有資產。

您的 Tenable Vulnerability Management 試用版軟體也包含 Tenable Lumin 和 Tenable Web App Scanning。

Tenable Vulnerability Management

享受現代、雲端型的弱點管理平台,使您能夠以無與倫比的準確性查看和追蹤所有資產。 立即訂閱一年。

100 項資產

選取您的訂閱選項:

立即購買

試用 Tenable Web App Scanning

享受完整存取我們專為新型應用程式所設計、屬於 Tenable One 曝險管理平台一部分的最新 Web 應用程式掃描產品。不需耗費大量人力或中斷重要 Web 應用程式,即可高度準確且安全地掃描您整個線上產品系列中是否含有任何弱點。 立即註冊。

您的 Tenable Web App Scanning 試用版軟體也包含 Tenable Vulnerability Management 和 Tenable Lumin。

購買 Tenable Web App Scanning

享受現代、雲端型的弱點管理平台,使您能夠以無與倫比的準確性查看和追蹤所有資產。 立即訂閱一年。

5 個 FQDN

$3,578

立即購買

試用 Tenable Lumin

利用 Tenable Lumin 視覺化並探索您的曝險管理、追蹤經過一段時間後風險降低的情形以及與同業進行指標分析。

您的 Tenable Lumin 試用版軟體也包含 Tenable Vulnerability Management 和 Tenable Web App Scanning。

購買 Tenable Lumin

聯絡業務代表,瞭解 Tenable Lumin 如何協助您取得您整個環境的深入解析和管理網路風險。

免費試用 Tenable Nessus Professional

免費試用 7 天

Tenable Nessus 是目前市場上最全方位的弱點掃描器。

最新 - Tenable Nessus Expert
現已上市

Nessus Expert 新增了更多功能,包括外部攻擊破綻掃描和新增網域及掃描雲端基礎架構的能力。按這裡試用 Nessus Expert。

請填妥以下表單以繼續 Nessus Pro 試用。

購買 Tenable Nessus Professional

Tenable Nessus 是目前市場上最全方位的弱點掃描器。Tenable Nessus Professional 可協助將弱點掃描流程自動化,節省您執行合規工作的時間並讓您與 IT 團隊合作。

購買多年期授權,節省更多。新增 365 天全年無休 24 小時全天候可使用電話、社群及對談的進階支援。

選擇您的授權

購買多年期授權,節省更多。

增加支援與訓練

免費試用 Tenable Nessus Expert

免費試用 7 天

Nessus Expert 是專為現代攻擊破綻所打造,它能讓您從 IT 到雲端洞察更多資訊,並保護貴公司免於弱點危害。

您已經有 Tenable Nessus Professional 了嗎?
升級至 Nessus Expert,免費試用 7 天。

購買 Tenable Nessus Expert

Nessus Expert 是專為現代攻擊破綻所打造,它能讓您從 IT 到雲端洞察更多資訊,並保護貴公司免於弱點危害。

選擇您的授權

購買多年期授權省更多!

增加支援與訓練