Why does CVE management as a primary strategy not work?

It turns out that only about 15% of vulnerabilities are exploitable, so patching every vulnerability is not an efficient use of time.

For security researchers, Common Vulnerabilities and Exposures (CVEs) are always troubling — but perhaps for different reasons than imagined.

While the threats posed by CVEs and the massive amount of remediation work they cause are a headache for IT and security teams, what truly troubles researchers is the relationship between modern security processes and CVEs. Mitigation strategies focus too much on "vulnerability management" and are too CVE-centric, whereas what we really need is an attacker-centric approach to effectively reduce our own risk.

Using vulnerability management as a primary strategy does not really work. According to data from the National Institute of Standards and Technology (NIST), 20,158 new vulnerabilities were discovered in 2021 alone. This was the fifth consecutive record-breaking year for vulnerability discoveries, and the trend continued into 2022. It is impossible for security teams to patch 20,000 new vulnerabilities every year, and even if they could, that is not the work they should be doing.

This may seem counter-intuitive, but in fact, multiple reasons prove it correct. First, recent research shows that only about 15% of vulnerabilities are actually exploitable, so patching every vulnerability is not an efficient use of time for task-heavy security teams. The second and equally important reason is that even if you constantly patch 100% of the CVEs in your network, this may still not effectively stop attackers.

▍Attackers' strategies are diverse

Phishing, spear-phishing, different levels of social engineering, leaked credentials, default credentials, unauthenticated access using standard interfaces (FTP, SMB, HTTP, etc.), open hotspots accessible without passwords, network poisoning, password cracking — the list of tactics employed by attackers is vast and diverse, and many do not even require advanced CVEs, or any CVE at all, to pose a danger to an organization. The previous Uber breach is a great example of how attackers can target an organization without using the latest CVEs or overly complex attack methods.

It is said that the attacker was either an 18-year-old who stole an Uber employee's data through clever social engineering/spear-phishing attacks, or the work of Lapsus$, a South American attacker group that carried out spear-phishing attacks using third-party contractor credentials leaked on the dark web. In either case, there was no complex coding or exploit. Instead, it was a variant of a tried-and-tested, practical existing tactic.

▍What matters is not the vulnerability, but the vector

First, we still need to emphasize that patching is very important, a key component of a strong security posture, and a key component of every security strategy. The problem is that many of today's tools prioritize remediation recommendations based solely on Common Vulnerability Scoring System (CVSS) scores, ignoring the organizational context and the knowledge of how to distinguish the meaningful 15% of vulnerabilities from the other 85%.

Therefore, we believe that what matters is not the vulnerability, but the vector. Just because an attack does not start with a major vulnerability does not mean it will not end with one. The most dangerous vulnerability for an organization might be a 5.7/10 CVSS score hiding at the bottom of a high-score false positive list.

▍Credential leakage is a bigger threat

Credential leakage probably poses a much greater threat to the average organization than the next dozen announced CVEs combined, yet many organizations have no appropriate way to discover if any of their credentials are floating around on the dark web. We act as if attackers spend countless hours developing CVE exploits, when they are actually just looking for the most efficient way to access our networks. Many of today's attackers and attack groups are financially motivated, and just like normal businesses, they want the best return on investment. Why spend time executing complex attacks when you can just buy or scrape credentials?

Right now, our defenses are not working, and as security professionals, we need to re-examine where the weak points are. While vulnerability management remains a core part of any meaningful security strategy, we need to move away from using it as a primary method. Instead, we need to take a close look at the tactics (tactics and techniques) that attackers are using, and build our security strategies around how to stop them. If we want our security measures to be truly effective in reducing our exposure, our strategy must focus on understanding the implementation techniques and methods that attackers use to exploit our weaknesses.

SecOps Security Lab aggregates the industry's top security analysis teams, possessing first-class security research and APT group tracking capabilities, providing clients with the latest and most classic APT attack techniques collected from the internet. Around-the-clock tracking of internet hacker groups and vulnerabilities, using first-hand threat intelligence, reconstructs attack techniques at the first opportunity to provide verification methods for unaffected enterprises.

Currently, SecOps Security Lab has accumulated over 9,000 attack techniques and more than 1,000 different attack scenarios, tracking over 200 APT groups and more than 70 ransomware organizations, thereby helping enterprises verify the effectiveness of their own defense systems from the attacker's perspective, and providing effective mitigation strategy recommendations to targetedly reinforce weak points in security defense.