What is Risk Based Vulnerability Management?

Risk-based vulnerability management is a cybersecurity process that aims to identify and remediate vulnerabilities that pose the greatest risk to an organization.

Demand for this capability has increased in recent years given the exponential rise in endpoints as well as increased complexity within the IT environment. These issues, coupled with other business priorities, such as the shift to the cloud and other transformation efforts have stretched many IT teams, making it necessary to prioritize activity and optimize limited resources. Risk-based vulnerability management is one way to help these teams identify and remediate those vulnerabilities that are most likely to be exploited and negatively impact the business.

What is the difference between risk-based vulnerability management and vulnerability management?

To understand the difference between risk-based vulnerability and legacy vulnerability management, it is important to first clarify the following definitions:

A vulnerability, as defined by the International Organization for Standardization, is “a weakness of an asset or group of assets that can be exploited by one or more threats.”

A threat is something that can exploit a vulnerability.

A risk is what happens when a threat exploits a vulnerability.

Both risk-based vulnerability and legacy vulnerability management tools are capable of identifying risks within the environment. However, risk vulnerability management demonstrates a far more effective prioritization of the most immediate and critical risks to the organization. Key components of a risk-based vulnerability management include:

• Integrated threat intelligence: Data is collected, processed and analyzed to better understand a threat actor’s motives, targets and attack behaviors.
• Comprehensive risk scores: Risk is evaluated and calculated based on asset criticality, severity of risk, probability of attack, impact to the business and other important factors.
• Automation: Artificial intelligence (AI), machine learning (ML) and other intelligent automation applications automate tasks within the risk assessment process to streamline activity and optimize resources.

Benefits of risk-based vulnerability management

Organizations that leverage risk-based vulnerability management assume many benefits, including:

• Improved accuracy: The use of threat intelligence and threat hunting capabilities enables organizations to make faster, more informed, data-backed security decisions in the fight against threat actors. This results in a proactive approach that allows the IT team to focus time and resources on the most critical vulnerabilities within the environment.
• Broader visibility: Risk-based vulnerability management guarantees visibility into all assets across the entire attack surface. This includes modern assets, such as mobile devices and cloud-based applications, which are often not supported by legacy tools.
• Continuous protection: Rather than taking static snapshots of vulnerable data and providing outdated results, a modern risk-based vulnerability management tool continually scans and monitors the environment. This helps organizations detect vulnerabilities even as they evolve.
• Efficiency gains: Risk-based vulnerability management uses advanced technology to automate many aspects of the assessment process. This also allows the IT team to streamline recurring activity and focus on high-value activity.

How to Prioritize Cybersecurity Risks When They Arise

While most organizations face a myriad of vulnerabilities within their environment, a select few pose a critical risk to the organization. Here are four key considerations when prioritizing vulnerabilities:

1. What is an acceptable level of risk? An organization should set a threshold that determines what level of risk the business is willing to accept. This threshold should be defined in terms of resources needed to remediate an event, potential downtime in the event of an attack, the cost of remediation efforts, the impact of reputational harm, and potential loss of sensitive data or intellectual property (IP).
2. How probable is the risk? A risk-based vulnerability management system leverages current attack exploits and historical data, as well as analytics and predictive modeling to determine the likelihood of an attack for each vulnerability. It is important to note that this analysis can only be carried out effectively if an organization is continuously collecting threat context and vulnerability data.
3. How severe is the risk? The severity of risk is calculated by multiplying its financial cost by its probability. This gives a clear indication of the magnitude of the threat.
4. How urgent is the risk? Adversaries can strike at any time. However, a risk-based vulnerability management tool will help the organization understand how imminent an attack is. It will also help the team consider other business contexts, such as staff availability, customer demand and even the time of year, which may influence how the organization responds.

How Risk Assessment Scoring Methodologies Work

Prioritizing risk involves intelligent risk scoring. The Common Vulnerability Scoring System (CVSS) is a free and open industry standard that CrowdStrike and many other cybersecurity organizations use to assess software vulnerabilities and calculate the vulnerability severity, urgency and probability. CVSS scores range from 0.0 to 10.0. 

In addition, the National Vulnerability Database (NVD) applies a severity rating to the CVSS score. The NVD’s information originates from the MITRE corporation and their cybersecurity framework, the MITRE ATT&CK Framework. This framework correlates adversary groups to campaigns, so security teams can better understand the adversaries they are dealing with, evaluate their defenses and strengthen security where it matters most.

How to Create a Successful Risk-based Vulnerability Management Program

The market is saturated with vulnerability management solutions, each claiming leading qualities. When creating a successful risk-based vulnerability management program, it is important to consider the following:

Real-time visibility:

• Can the vulnerability management tool detect security vulnerabilities in a timely manner?
• Does the tool provide end-to-end visibility for all endpoints and assets within the organization’s IT environment?
• Does the solution offer scanless technology to see and interact with data in real time?
• Does the solution offer protection to endpoints whether they are on or off the network?

Endpoint performance:

• Is the risk-based vulnerability management tool a lightweight solution that can be deployed and updated with little impact to endpoint performance?

Automation:

• Does the solution leverage the latest in AI, ML and intelligent automation to streamline cyber risk assessment and free up valuable resources within the IT team?

Integration:

• How well does the solution integrate within the organization’s existing cybersecurity architecture and solutions?
• Does the vendor offer built-in integrations to expedite patching and vulnerability remediation efforts?
• What support does the vendor provide to ensure that the system is properly integrated with other tools and technologies?