將資料轉化為行動：以情資推動的弱點管理
Prioritizing vulnerabilities with context has always been a challenge for vulnerability management teams – and this task isn’t getting easier as published CVEs continue to grow. To remedy this, many enterprises are forced to invest in products and services to protect their environments with various intelligence data and tools. In this blog, we explain how Tenable Vulnerability Intelligence and Exposure Response help organizations to make data-driven decisions to better prioritize and operationalize their programs.
弱點管理對企業而言似乎是一個難以跨越的障礙。如何應對大量且數量快速增加的已公佈 Common Vulnerabilities and Exposures (CVE)。做為一家從一開始成立就專注於弱點管理的企業，Tenable 也與這個問題戰鬥，不過更加複雜：由於我們廣大的客戶群，我們必須能在盡可能最多的產品中涵蓋最多的 CVE，同時還要能維持風險背景資訊、正確性與可靠性。
The solution isn’t to try to check for every possible combination of CVEs and affected products. We have to prioritize the most critical vulnerabilities with accurate and targeted context. To make these decisions quickly and precisely, Tenable leverages a vast, searchable database of vulnerability information from both external sources and from Tenable Research. This is the same data source that drives a new capability in the Tenable Vulnerability Management product called Vulnerability Intelligence, which is aimed at helping customers better operationalize their vulnerability management programs and make quick data-driven prioritization decisions.
狀況不秒，而且愈來愈糟
We’re only halfway through 2024, and we’re well on pace to exceed 30,000 published CVEs this year. Further complicating matters, we’re seeing more and more CVEs in underlying components, frameworks, and language libraries. This means organizations aren’t fixing a single application but rather tracking down and fixing every application that leverages the impacted vulnerable component.
運用 Vulnerability Intelligence (弱點情資) 來建立優先排序策略
Tenable 每天除了為我們重要產品提供最新的弱點涵蓋範圍，我們也持續留意下一個重大弱點，確保我們能盡可能以最快的速度加以應變。要確保我們迅速做出明智的決策，運用來自 Vulnerability Intelligence (弱點情資) 的背景資料至關重要。此外，在我們面臨大量積壓的 National Vulnerability Database (NVD) 的情況下，Vulnerability Intelligence (弱點情資) 資料組能讓我們跟上最新弱點和風險的步調，因為我們不會只被單一資料來源限制住。
開啟 Vulnerability Intelligence (弱點情資) 功能時，您會看到一個代表我們想要強調具有最高威脅的弱點之風險類別的六角形。雖然這不是決定條件所使用的唯一指標，Vulnerability Intelligence (弱點情資) 中的類別還會根據匯入推動我們風險評分決策的 Tenable 弱點資料庫的資料點。
類別包括：
- 新興威脅：這是一組受到我們安全應變團隊積極監控的弱點，通常從該團隊到 plugin 的開發有直接的途徑，以便涵蓋這些弱點，尤其是 Vulnerabilities of Interest 和 Vulnerabilities of Concern 類別中的弱點。
- VPR gives our teams a numerical score to quickly input and sort on, though as with any score, understanding the context behind it is critical.
- 勒索軟體突顯與這類攻擊有關的弱點，由於是在重要的企業應用程式之中，因為這些弱點可能會對任何一家企業造成特別危險的攻擊。
如上面螢幕截圖所示，專注於這些目標類別的任何一項，就能大幅減少應聚焦的 CVE 數量。Contrasted against the about 250,000 CVEs that have been published, the numbers above become far more manageable and speak to real risk, as opposed to the severity scores that come from leveraging CVSS metrics.
將資料轉化為優先排序策略
有許多企業仍根據基本的優先排序指標執行作業，無論是鎖定特定產品、CVSS 分數或專屬規定。通常這是由於他們必須遵守特定的合規性標準，或者只是因為需要有某種可衡量的標準而已。雖然以簡易的 CVSS 分數或嚴重性追蹤與衡量很直接明瞭，但卻無法提供太多背景資訊，也無法提供一個可證明風險影響性的策略。
這也正是 Tenable Vulnerability Management 中最新的 Exposure Response (曝險應變) 功能可協助我們的地方。Exposure Response (曝險應變) 能讓團隊研擬出可衡量以及能夠反映出真正風險的弱點管理策略。任何弱點管理方案中最重要的工具之一就是追蹤效能。不幸的是，由於新弱點的數量最終都被定期修復的弱點數量抵銷，使得大多數的圖表看起來都是一條沒有起伏的水平線。透過擁有更精準的目標，就有可能在經過一段時間後真正能衡量成效，並設定可達成的服務等級協議 (SLA) 目標。
CISA KEV 計畫
美國網路安全暨基礎設施安全局 (Cybersecurity and Infrastructure Security Agency) 的已知被利用弱點 (Known Exploited Vulnerabilities，簡稱 KEV) 目錄 已成為一項寶貴且常用的資源，能夠讓企業將重點放在有證據顯示受到猖獗利用的特定弱點上。雖然 KEV 也並不完備，但與這些特定 CVE 相關的風險以及許多企業付出在 KEV 上的關注使其成為 Tenable Research 團隊用來追蹤弱點涵蓋範圍的一些基準之一。弱點管理團隊使用 Exposure Response (曝險應變) 就能以類似的方式建立可追蹤、以 CISA KEV 為基礎的計畫，用來評定其修復工作的效能。如前所述，服務等級協議 (SLA) 和效能評定是任何修復策略的關鍵。我們致力於盡可能以最快的速度涵蓋 KEV 弱點，理想上是在這些弱點被列入 KEV 之前，不過，如果無法在此之前，通常也會在 KEV 公布後的數小時內就加以涵蓋。
Exposure Response (曝險應變) 正好提供了實現這類衡量機制所需的工具。有了與 KEV 相關的能見度和風險，將服務等級協議設定為幾天之內以及將目標設定在維持修復超過 90% 發現的弱點，才會變得有意義。關鍵是確保能夠衡量與達成企業所實施的策略。
Unlike the 250,000 CVEs that have been published, to date there are only 1,134 CVEs in the CISA KEV catalog. With only a handful of CVEs added to the KEV each month, this is an impactful set of CVEs that teams can actually measure performance against.
總結
弱點修復的優先排序與落實一直以來都是弱點管理團隊最主要的挑戰。每年公布的大量弱點代表著團隊根本無法追趕，而缺乏易於存取的背景資訊通常也讓優先排序淪為猜測、產生大量工作、或成效不彰的有限修復成果，例如只能專注於 CVSS 嚴重性。Tenable Vulnerability Management 推出 Vulnerability Intelligence (弱點情資) 功能，在單一位置提供所有需要的背景資訊，而 Exposure Response (曝險應變) 則能落實目標性、可衡量的弱點管理工作流程。
深入瞭解
相關文章
Never Trust User Inputs -- And AI Isn't an Exception: A Security-First Approach
August 6, 2024As AI transforms industries, security remains critical. Discover the importance of a security-first approach in AI development, the risks of open-source tools, and how Tenable's solutions can help protect your systems.
Your Exposure Ends Here: Introducing the New Tenable Brand
August 5, 2024At Tenable, our mission is to manage and reduce cyber risk, because cyber risk is business risk. Feedback from dozens of top CISOs is reflected in our latest brand evolution. Tenable is the exposure management company that helps customers know where their weaknesses lie, expose their risk and close the gaps. Welcome to Tenable. Your exposure ends here.
Cybersecurity Snapshot: Data Breach Costs Rise, as Ransomware Attacks Fall, Reports Find
August 2, 2024IBM’s latest “Cost of a Data Breach Report” finds these data-theft incidents getting more expensive. Plus, the IT-ISAC says that ransomware attacks fell in Q2 due to law-enforcement disruptions of ransomware groups. Meanwhile, check out a Carnegie Mellon comp sci professor’s take on AI system security. And Tenable’s headed to Black Hat – visit our booth! And much more!
Do You Think You Have No AI Exposures? Think Again
August 6, 2024As AI usage becomes more prevalent in organizations globally, security teams must get full visibility into these applications. Building a comprehensive inventory of AI applications in your environment is a first step. Read on to learn what we found about AI application-usage in the real world when we analyzed anonymized telemetry data from scans using Tenable’s products.
Never Trust User Inputs -- And AI Isn't an Exception: A Security-First Approach
August 6, 2024As AI transforms industries, security remains critical. Discover the importance of a security-first approach in AI development, the risks of open-source tools, and how Tenable's solutions can help protect your systems.
Your Exposure Ends Here: Introducing the New Tenable Brand
August 5, 2024At Tenable, our mission is to manage and reduce cyber risk, because cyber risk is business risk. Feedback from dozens of top CISOs is reflected in our latest brand evolution. Tenable is the exposure management company that helps customers know where their weaknesses lie, expose their risk and close the gaps. Welcome to Tenable. Your exposure ends here.
- Exposure Management
- Vulnerability Management
- Exposure Management
- Risk-based Vulnerability Management