Webinar–5 ways to risk rank your vulnerabilities
•
0 gefällt mir•116 views
Vulnerabilities are an inevitable part of software development and management. Whether they’re in open source or custom code, new vulnerabilities will be discovered as a codebase ages. As stated in the 2019 Open Source Security and Risk Analysis report, 60% of the codebases audited in 2018 contained at least one known vulnerability. As the number of disclosures, patches, and updates grows, security professionals must decide which critical items to address immediately and which items to defer. For more information, please visit our website at www.synopsys.com/software.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (19)
Ähnlich wie Webinar–5 ways to risk rank your vulnerabilities
Ähnlich wie Webinar–5 ways to risk rank your vulnerabilities (20)
Mehr von Synopsys Software Integrity Group
Mehr von Synopsys Software Integrity Group (9)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
Webinar–5 ways to risk rank your vulnerabilities
- 1. Nivedita Murthy (Security Consultant) 5 Ways to Risk Rank Your Vulnerabilities
- 2. © 2019 Synopsys, Inc. 2 Used 96% Did Not Use 4% Open source usage Open source is in everything! 60% 40% 70 % 30 % Cyber security 74 % 26 % Internet & mobile apps 64 % 36 % Finance & healthcare 62 % 38 % Retail & e-commerce In 13 out of 17 industries, more than 50% of the average codebase comprised open source. Source: Synopsys Open Source Security and Risk Analysis
- 3. © 2019 Synopsys, Inc. 3 Security breaches due to open source
- 4. © 2019 Synopsys, Inc. 4 • Get more information! – CVE, Common Vulnerabilities & Exposures: https://cve.mitre.org/index.html – US-CERT: https://www.us-cert.gov/ncas/alerts – NVD, National Vulnerabilities Database: https://nvd.nist.gov – Threat intelligence – Monitor newsfeeds • Vulnerability scoring and its effectiveness – CVSS scores: https://www.first.org/cvss/ – CVSS score provided in NVD is just base score – Does not include “temporal” or “environmental” score – Environmental score differs; it is perceptive – https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator Existing methodologies
- 5. © 2019 Synopsys, Inc. 5
- 6. © 2019 Synopsys, Inc. 6 The 5 Ws
- 7. © 2019 Synopsys, Inc. 7 • What is the vulnerability all about? – XSS? – Injection? – Denial of service? – Remote code execution? • Exploit description • The easier it is, the higher the risk • The higher the damage/impact, the higher the risk What?
- 8. © 2019 Synopsys, Inc. 8 • Who can exploit this vulnerability? • What privileges does the user need to exploit this vulnerability? – None? – Admin/root? – Any authenticated user? Who?
- 9. © 2019 Synopsys, Inc. 9 • Where was this vulnerability found? What is the attack vector? – Application level? – Network level? – Server level? Where?
- 10. © 2019 Synopsys, Inc. 10 • How old is this vulnerability? • The older the wine, the finer it is • Hackers are attracted more to older vulnerabilities • 43% of codebases scanned in 2018 had vulnerabilities over 10 years old—wide landscape When?
- 11. © 2019 Synopsys, Inc. 11 • Why is it not possible to exploit this vulnerability? – Mitigating factors in environment? – Unused functionality? – Different version? Why?
- 12. © 2019 Synopsys, Inc. 12 • What • Who • Where • When Contextual decisions Impact Unauthenticated Admin/root Application/ formServer/database New Old Confidentiality IntegrityAvailability
- 13. © 2019 Synopsys, Inc. 13 Questions?
- 14. Thank You