Tag Archives: Patch Strategy

Threat Intelligence – What is it good for?

31 August 2019

I attended a virtual summit on threat intelligence this week. I watched two interesting presentations and found that I am still not convinced of the value of threat intelligence.

In vulnerability management for example threat intelligence speeds up decision making. But is speed in the decision-making phase of vulnerability management an issue?

OODA Loop

OODA Loop

When we deal with critical vulnerabilities, e.g. vulnerabilities of the WannyCry Class, speed is crucial. The OODA procedural model is perfectly suited as execution procedure for environments where speed is crucial for survival.

OODA, an acronym for Observe, Orient, Decide, Act, was developed by John Richard Boyd in the 1950’s as survival strategy in aerial combat. Colonel Boyd, one of the most influential military strategists ever, transferred OODA to other domains after he retired from the US Air Force.

The picture below shows the OODA procedural model adapted for vulnerability management.

OODA for Vulnerability Management

OODA for Vulnerability Management

We must decide whether urgent action is required if a new critical vulnerability is published. Data collected from OSINT sources, asset details, and experience in the evaluation of vulnerabilities are required for creating a well-founded decision.

Threat intelligence speeds up the Observe and Orient phase by e.g. providing data on exploits seen in the wild. But threat intelligence will neither replace current asset data, which are crucial for the Orient phase, nor speed up the Act phase, where the affected assets are patched, and their correct operations is verified.

So, if you decide on investing in threat intelligence ask yourself the question: What benefits do I expect to gain from threat intelligence in what use cases? Otherwise, it is very likely that you get disappointed.

Have a good weekend.

What is the Most Secure Web Browser?

23 September 2018

For some weeks now I am busy with patch strategy and vulnerability management. When new critical vulnerabilities shows up two questions must be addressed:

  1. How fast must we patch the vulnerable systems?
  2. What vulnerabilities must be patched with highest priority? Or mitigated, if a patch is not available in due time.

Speed is the key in cyber security. The faster we find and patch vulnerable systems the greater is the chance that cyber criminals cannot exploit the vulnerabilities.

The exploit is the weapon in cyber warfare. A vulnerability as such increases the potential risk only. Once an exploit is published that can leverage the vulnerability, the vulnerability becomes a real risk. And if the exploit is “in the wild”, i.e. if the exploit is actively used by cyber criminals for attacks, the IT organization is on red alert.

Unfortunately, no one knows when an exploit spreads in the wild. Therefore, the cautious answer to the above questions is:

“The moment an exploit for a critical vulnerability is published it must be patched directly, at least on critical systems. If a patch is not available proper protective measures must be applied to mitigate the risk effectively.”

Browsers are the most critical systems because they are used in a hostile environment. Browsers are very complex applications, thus prone of errors.  Between 2013 and 2017 about 11% of 40671 vulnerabilities in total were found in the 4 major browsers Chrome, Firefox, Internet Explorer and Edge.

Market Share Browsers 2013 - 2017

Market Share Browsers 2013 – 2017. Data source: StatCounter

Browser Vulnerabilities 2013 - 2017

Browser Vulnerabilities 2013 – 2017

It remarkable to see that 67% of all browser vulnerabilities are related to IE, Edge and Firefox although they have only a small market share (11% in 2017).

Exploit publication date relative to CVE publication date

Exploit publication date relative to CVE publication date 2013 – 2017

The graphic above shows the number of exploits that are published within one month before the CVE is published compared to the number of exploits published within one month after the CVE is published.

Except for Chrome and Firefox the majority of exploits is published after the vulnerability is published. Nevertheless, we have to patch immediately on publication of a CVE.

How many exploits spread in the wild? This question is hard to answer. The Symantec attack signatures give a useful indication. “An attack signature is a unique arrangement of information that can be used to identify an attacker’s attempt to exploit a known operating system or application vulnerability.” 

Exploits in the Wild 2013 - 2017

Exploits in the Wild 2013 – 2017

This is an amazing result, isn’t it.

Have a great week!


Data sources

  1. NIST. NVD Database. https://nvd.nist.gov/
  2. Offensive Security. Exploit Database. https://www.exploit-db.com
  3. Andrea Fioraldi. CVE Searchsploit.
    https://github.com/andreafioraldi/cve_searchsploit/tree/master/cve_searchsploit
  4. NIST. EXPLOIT-DB Reference Map. http://cve.mitre.org/data/refs/refmap/source-EXPLOIT-DB.html
  5. Symantec.com. Attack Signatures.  https://www.symantec.com/security_response/attacksignatures/