Speaker 1: All right, let's dive into this risk based vulnerability management
Speaker 1: RBV RBVM. Yeah, you know how it works, why it matters,
Speaker 1: why it matters?
Speaker 2: Right?
Speaker 1: Yeah, what you can actually like do with this knowledge.
Speaker 1: We've got excerpts.
Speaker 3: From our Modern vulnerability managern Vulnerability Management Predictive Cybersecurity.
Speaker 2: By Michael Reutman and Ed Bellis.
Speaker 1: Hey, yeah, Rutman and Bellis. They really get into the
Speaker 1: nitty gritty of how organizations are shifting from just like
Speaker 1: counting vulnerability understanding risk. Yeah, understanding the risks they pose
Speaker 1: crucial change. Yeah. Instead of just trying to patch every
Speaker 1: single software weakness, you're you're focusing on the ones that
Speaker 1: that could really hurt your organization.
Speaker 2: That's it.
Speaker 1: That makes a lot of sense. Okay, so let's set
Speaker 1: the stage here.
Speaker 2: Remember the Echo fax breach.
Speaker 1: Yeah, the Equofax breach back in twenty seventeen, millions of
Speaker 1: people had their credit.
Speaker 2: Reports compromise, a major wake up call, huge And the
Speaker 2: thing is they knew about the vulnerability, oh wow, but
Speaker 2: they didn't fit it in time. They were drowning in vulnerabilities.
Speaker 2: Makes sense, no effective way to prioritize.
Speaker 1: That's where RBVM comes in, right, it's about having a
Speaker 1: system to figure out which ones are the most critical
Speaker 1: to fix first. But before we get into the how,
Speaker 1: let's define some key terms here. What exactly is a
Speaker 1: vulnerability and how's that like different from a threat or
Speaker 1: a risk?
Speaker 2: Okay? Think of a vulnerability as a weakness in a system,
Speaker 2: like a loose brick in a wall. That loose brick
Speaker 2: is the vulnerability, got it the potential for someone to
Speaker 2: exploit it, That's the threat, okay. And the overall likelihood
Speaker 2: of someone pushing on that brick giving way damage and
Speaker 2: the damage that would cause that's the risk.
Speaker 1: Okay. So the vulnerability is the weakness itself, threat is
Speaker 1: the possibility of someone exploiting it, and risk is the
Speaker 1: combination of like, how likely that is and how bad
Speaker 1: the consequences would be.
Speaker 2: That's it.
Speaker 1: So with RBVM, we're not just fixing every loose brick.
Speaker 1: We're figuring out which ones need a media attention. And
Speaker 1: this concept of assessing and managing risk.
Speaker 2: Has been around for centuries.
Speaker 1: It has been around forever.
Speaker 2: The book talks about ancient Babylonian merchants.
Speaker 1: Wow, really, they.
Speaker 2: Used to take out bottomery loans.
Speaker 1: What's up?
Speaker 2: They'd bet on their ships making it back safely.
Speaker 1: Okay.
Speaker 2: If the ship sank, the loan was void.
Speaker 1: Interesting.
Speaker 2: If it arrived, they paid back the loan with interest.
Speaker 1: Fascinating. So even back then people were thinking about risk.
Speaker 1: That's just in a different context.
Speaker 2: Different context.
Speaker 1: Yeah, it's it makes you realize that this isn't some
Speaker 1: new fangled idea, right, we're just applying it to the
Speaker 1: digital world now, that's it. Another great example.
Speaker 2: Abraham Wald, mathematician, World War Two. Okay, figuring out where
Speaker 2: to reinforce armour on planes.
Speaker 1: So you'd think they would just look at where the
Speaker 1: bullet holes were, right, you would think that seems logical, But.
Speaker 2: Wald realized the planes were turning with damage to certain
Speaker 2: areas were actually the lucky ones. The planes that didn't
Speaker 2: make it back likely shot down because of damage to
Speaker 2: the areas where they weren't seeing bullet holes.
Speaker 3: Oh, so the data was misleading exactly the truly critical spot.
Speaker 1: So the data they were looking at was telling like
Speaker 1: an incomplete story.
Speaker 2: Absolutely.
Speaker 1: That's a great example of how important it is to
Speaker 1: look beyond the obvious, right, use data to uncover those
Speaker 1: hidden risks.
Speaker 2: That's right.
Speaker 1: Okay, so we've established that risk management has you know,
Speaker 1: a long history, long history, and we've got our key
Speaker 1: terms kind of you know, sort of, But how do
Speaker 1: we actually measure and manage.
Speaker 2: Risk in the world of cybersecurity?
Speaker 3: In the world of cybersecurity, data data, data data RBVM
Speaker 3: needs a lot of it.
Speaker 2: Okay, we're talking vulnerability databases like the National Vulnerability Database MVD.
Speaker 2: Oh yeah, the MVD encyclopedia of known software weaknesses.
Speaker 1: I can imagine. That's a pretty hefty encyclopedia is constantly
Speaker 1: getting updated constantly. So that's one piece of the puzzle,
Speaker 1: knowing what vulnerabilities are out there, right, what else do
Speaker 1: we need?
Speaker 2: We need to know who the attackers are, their tactics,
Speaker 2: and what they're after.
Speaker 1: So threat intelligence, threat intelligence exactly like having intel on
Speaker 1: your adversaries.
Speaker 2: That's it.
Speaker 1: Okay, we're keeping tabs on the bad guys.
Speaker 2: And lastly, we need to know what we have to protect.
Speaker 1: Okay, so asset inventory, ACID inventory, what devices, software systems
Speaker 1: are in our organization? That right makes sense. If you
Speaker 1: don't know what you have, how can you protect it?
Speaker 2: It can't.
Speaker 1: It's like taking inventory before you install a security system in.
Speaker 2: Your home, precisely.
Speaker 1: But here's where it gets tricky MESSI all this data
Speaker 1: is coming from different places. It can be messy, it
Speaker 1: can we need a way to make sense of it all.
Speaker 1: We do turn it into actionable insights.
Speaker 2: Actionable insights, and.
Speaker 1: I bet that's where machine learning comes in.
Speaker 2: You got it.
Speaker 1: It's it's all the rage these days.
Speaker 2: It is.
Speaker 1: It's like having a superpowered analyst.
Speaker 2: Crunching through mountains of data.
Speaker 1: Yeah, to help us see the patterns, prioritize vulnerabilities.
Speaker 2: That need our attention first.
Speaker 1: Okay, I'm intrigued. So I've got the data and we're
Speaker 1: using machine learning to kind of, you know, make sense
Speaker 1: of it. Right, But how do we know if RBVM
Speaker 1: strategy is actually working?
Speaker 2: Metrics? Metrics Okay, coverage and efficiency Oka. Coverage means we're
Speaker 2: fixing the right vulnerability.
Speaker 1: So ones that actually pose a real threat.
Speaker 2: That's it. Efficiency is about how effectively we're doing.
Speaker 1: That, making sure we're not wasting resources.
Speaker 2: Chasing after minor issues. Right, It's like triage in an
Speaker 2: emergency room. Okay, you focus on the most critical cases first,
Speaker 2: makes sense. And speaking of critical vulnerability.
Speaker 1: Debt, oh yeah, that's a that's a good one.
Speaker 2: Every vulnerability we choose not to fix immediately adds to
Speaker 2: this debt, and just like financial debt, it can accrue
Speaker 2: interest over time.
Speaker 1: That sounds like a recipe for trouble.
Speaker 2: It can be down the line, it can be.
Speaker 1: So how do we balance tackling the urgent vulnerabilities with
Speaker 1: like managing this this growing.
Speaker 2: Debt prioritization, good understanding of the potential consequence consequences. Right,
Speaker 2: But let's get back to that machine learning magic. Okay, yeah,
Speaker 2: we were talking about.
Speaker 1: Yeah, I'm curious about that.
Speaker 2: How exactly does it help us prioritize? Yeah, well, different
Speaker 2: types of machine learning, okay, supervised learning.
Speaker 1: Supervised learning like.
Speaker 2: Showing a detective a bunch of examples of criminals and saying,
Speaker 2: go find more that look like this.
Speaker 1: Okay.
Speaker 2: We feed the algorithm information about past exploits, right, it
Speaker 2: learns to predict which new vulnerabilities are most likely to
Speaker 2: be targeted.
Speaker 1: So it's all about pattern recognition, spotting the red flags
Speaker 1: that say, hey, this vulnerability is ripe for exploitation.
Speaker 2: Right. And then we have unsupervised learning. Unsupervised more like
Speaker 2: giving the detective a pile of evidence okay, saying see
Speaker 2: what you can find?
Speaker 1: Okay, So it's more exploratory, right, potentially uncovering connections that
Speaker 1: we that we might have missed otherwise.
Speaker 2: And there's specific algorithms can use algorithms okay, like logistic regression.
Speaker 3: Logistic regression neural network Logistic regression is great for answering yes,
Speaker 3: no questions like is.
Speaker 1: This vulnerability likely to be exploited?
Speaker 2: Exactly?
Speaker 1: Okay, So it's giving us a simple, straightforward prediction. What about.
Speaker 2: Neural networks more complex okay, able to make more nuanced
Speaker 2: predictions based on a wider range of factors. It it's
Speaker 2: like asking, on a scale of one to ten, okay,
Speaker 2: how likely is this vulnerability to be exploited?
Speaker 1: And what are the contributing factors?
Speaker 2: Exactly?
Speaker 1: Okay, So it's giving us a more detailed risk assessment.
Speaker 2: It is.
Speaker 1: This is all starting to make sense, but it still
Speaker 1: seems pretty technical. We've got all this data, these fancy
Speaker 1: algorithms we do, but who's actually doing the work of
Speaker 1: fixing these vulnerabilities.
Speaker 2: That's where we get into the human side of our
Speaker 2: BVM just as important as the technical side.
Speaker 1: Okay.
Speaker 2: Strong collaboration between security and IT, security and IT teams.
Speaker 1: Yeah, yeah, I can see how that could get tricky.
Speaker 1: Because security is focused on identifying the risks right, it
Speaker 1: is tasked with.
Speaker 2: Patching them exactly.
Speaker 1: It seems like there's potential for miscommunication and delays absolutely
Speaker 1: and things like.
Speaker 2: Additionally, there's been a silo mentality between these teams.
Speaker 1: Yeah, I've seen that.
Speaker 2: But for OURBVM to work effectively.
Speaker 1: They need to be on the same page.
Speaker 2: Security and it.
Speaker 1: Yeah, working together seamlessly, seamlessly, So how do we break
Speaker 1: down those silos?
Speaker 2: Clear communication is key, okay, regular meetings, share dashboards, integrated
Speaker 2: ticketing systems okay, anything that keeps everyone in the loop right,
Speaker 2: ensures smooth handoffs, handoffs. Yeah, we also need share goals
Speaker 2: and metrics.
Speaker 1: Shared goals and metrics, okay.
Speaker 2: Both teams should be working towards the same KPIs.
Speaker 1: Like reducing vulnerability DEBT.
Speaker 2: Reducing vulnerability debt okay, Improving remediation velocity.
Speaker 1: Mediation velocity.
Speaker 2: It's a measure of how quickly an organization can fix vulnerabilities.
Speaker 1: Got it once they're identical, let's are identified, okay.
Speaker 2: And then there's remediation capacity. Remediation capacity, Wow, how many
Speaker 2: vulnerabilities a team can.
Speaker 3: Handle within a certain time, within a given time Okay,
Speaker 3: So speed and efficiency, speed inefficiency.
Speaker 1: Got it. But let's be realistic. Okay, not every organization
Speaker 1: has a massive security team with unlimited resources, right, what
Speaker 1: about smaller companies? Smaller companies, Yeah, with limited budgets.
Speaker 2: That's where the concept of self service security comes in.
Speaker 1: Sell service security.
Speaker 2: Imagine empowering IT teams okay, to identify and fix vulnerabilities
Speaker 2: on their own, on their own, with waiting for instructions
Speaker 2: from security.
Speaker 1: So giving them the tools and.
Speaker 2: The knowledge to manage their own risk.
Speaker 1: That sounds pretty revolutionary.
Speaker 2: It is, It's becoming more and more common. The book
Speaker 2: talks about a shipping company that used their CMDB.
Speaker 1: Hold on, remind me what a CMDB is.
Speaker 2: Again, Configuration management database.
Speaker 1: Oh yeah, okay.
Speaker 2: Think of it like a detailed inventory all the hardware
Speaker 2: and software in your organism.
Speaker 1: Okay, got it.
Speaker 2: So the shipping company use their CMDB to.
Speaker 1: Give their IT teams a way to manage their own
Speaker 1: vulnerabilities exactly.
Speaker 2: They could see which assets they were responsible for, okay,
Speaker 2: the associated risks, the deadlines for remediation, got it. It
Speaker 2: freed up the security.
Speaker 1: Team to focus on more strategic things.
Speaker 2: To focus on more strategic initiatives, okay, while it became
Speaker 2: more proactive, no active.
Speaker 1: And efficient and efficient win win for every reason.
Speaker 2: Win.
Speaker 1: But even with the best tools and systems in place,
Speaker 1: I imagine it can still be tough to keep up
Speaker 1: with the ever changing threat landscape it is, So how
Speaker 1: do we make sure our RBVM program stays like effective
Speaker 1: over time.
Speaker 2: That's where automation comes in. Organizations mature in their RBVM journey,
Speaker 2: they often look to automate tasks what like vulnerability scanning,
Speaker 2: risk scoring, even remediation.
Speaker 1: So we're taking the manual workout of the equation, taking
Speaker 1: the manual workout, making things smoother, more efficient. But automation
Speaker 1: can only take us so far. Right, true, we also
Speaker 1: need those well defined processes, well defined processes that are
Speaker 1: consistently followed.
Speaker 2: Consistently follow This includes regular reviews, our data sources, risk models,
Speaker 2: and remediation strategies.
Speaker 1: So it's about building a sustainable system sustainable systems then
Speaker 1: that can adapt.
Speaker 2: As the threat landscape of all the exactly.
Speaker 1: And that brings us to another.
Speaker 2: Important point business context. Business context, it's not enough to
Speaker 2: just look at vulnerabilities in isolation. We need to understand
Speaker 2: how they might impact the business as a whole.
Speaker 1: So asking questions like, if this vulnerability is exploited, what
Speaker 1: systems would be affected, what data would be at risk?
Speaker 1: How would it impact our operations exactly?
Speaker 2: Our customers, our customers precisely, So connecting the dots between
Speaker 2: technical vulnerability.
Speaker 1: Between technical vulnerabilities and business impact and business impact, and
Speaker 1: this allows us to make more informed decisions, more formed
Speaker 1: decisions about prioritization and resource allocation. It sounds like we're
Speaker 1: breaking down those silos.
Speaker 2: Again, breaking down silos.
Speaker 1: Bringing security IT and the business side together together to
Speaker 1: make smarter decisions.
Speaker 2: Are decisions now.
Speaker 1: The authors they they dive deep into some specific remediation metrics,
Speaker 1: remediation metrics that go beyond just looking at you know,
Speaker 1: those CVSS.
Speaker 2: Scores CBSS scores.
Speaker 1: So what are some of the things we should be
Speaker 1: measuring besides those CVSS scores.
Speaker 2: We've already talked about remediation velocity and capacity, okay, but
Speaker 2: we should also consider time to remediation.
Speaker 1: Time to remediation okay.
Speaker 2: Which measures how long it takes to fix a vulnerability.
Speaker 1: From the moment it's discovered.
Speaker 2: From the moment it's discovered okay. And then there's meantime.
Speaker 1: To remediation meantime to remediation okay.
Speaker 2: Gives us an average across all vulnerabilities.
Speaker 1: Got it.
Speaker 2: Tracking these metrics helps us identify bottlenecks, bottlenecks okay, areas
Speaker 2: for improvement in our processes.
Speaker 1: So we're really trying to like optimize the entire remediation.
Speaker 2: Workflow, the entire workflow.
Speaker 1: Right, and as we mentioned earlier, that often involves automating
Speaker 1: certain tasks.
Speaker 2: With automating tasks, but we.
Speaker 1: Can also look at things like streamlining communication between.
Speaker 2: Teams, streamlining communication.
Speaker 1: Improving the accuracy of our vulnerability assessments, vulnerability providing better training,
Speaker 1: better training and resources to our IT staff.
Speaker 2: To the IT staff.
Speaker 1: So it's a it's a holistic approach, holistic approach addressing
Speaker 1: both the technical and the human.
Speaker 3: Aspects, both the technical and the human vulnerability managed vulnerability management.
Speaker 1: And that's why it's so important to have clear roles
Speaker 1: and responsibilities.
Speaker 2: Clear roles and responsibilities.
Speaker 1: Regular community, regular communication between teams, and shared metrics.
Speaker 2: And goals, shared metrics and goals.
Speaker 1: When everyone is on the same page, on the same page, yeah,
Speaker 1: and working together effectively, I can see how that makes
Speaker 1: a huge.
Speaker 2: Difference, huge difference.
Speaker 1: Now, the authors paint this fascinating picture of the future
Speaker 1: of the future of vulnerability and management.
Speaker 3: The future of vulnerability management, They talk about the potential
Speaker 3: for predicting vulnerability exploitation.
Speaker 1: With the same accuracy, with the same accuracy as weber
Speaker 1: forecasting weather forecasting. Yes, that's a that's a pretty mind
Speaker 1: blowing concept. It is imagine being able to anticipate which
Speaker 1: vulnerabilities are most likely to be.
Speaker 2: Exploited when allowing you to proactively allocate resources, mitigate risks
Speaker 2: before they can even be exploited or where they can
Speaker 2: be exploited.
Speaker 1: That would be a game changer. It would be a
Speaker 1: game changer for security teams.
Speaker 2: The security teams.
Speaker 1: And while we're not quite there yet, not quite there yet,
Speaker 1: the progress being made is remarkable in this areas is
Speaker 1: pretty remarkable. It is so what can our listeners do.
Speaker 2: To start applying these principles, to start applying these principles.
Speaker 1: And their own organization in their own organist stations. I
Speaker 1: would say the first step assess your current vulnerability management program.
Speaker 2: Assess your program.
Speaker 1: Are we just reacting to vulnerabilities as they pop up
Speaker 1: as they pop up, or are we taking a more proactive.
Speaker 2: And strategic approach proactive and strategic. Right then start thinking
Speaker 2: about how you can incorporate data and analytics.
Speaker 1: Into your decision making and your decision making, so things
Speaker 1: like like vulnerability.
Speaker 2: Databases, vulnerability databases.
Speaker 1: Ret intelligence, threat intelligence, asset inventory, asset inventory. And don't
Speaker 1: underestimate the importance of collaboration. Collaboration's key breaking down those silos.
Speaker 2: Breaking down silos.
Speaker 1: Between security IT and the business side to business side
Speaker 1: RBVM is it's a team effort.
Speaker 2: Team effort.
Speaker 1: It requires a shared understand shared understanding of the of
Speaker 1: the risks and a commitment to working together can together
Speaker 1: to mitigate them.
Speaker 2: Mitigate those risks, and don't be.
Speaker 1: Afraid to experiment with new tools and technologies.
Speaker 2: Do tools to technologies.
Speaker 1: There are so many innovative solutions.
Speaker 3: Out there, innovative solutions that can help you automate tasks,
Speaker 3: automate tasks, gain insights, gain insights.
Speaker 1: Improve your overall security posture. Security posture it's about embracing continuous.
Speaker 2: Improvement, continuous improvements, and always.
Speaker 1: Looking for ways to do things better. To do things better,
Speaker 1: and remember security is a journey. Security is a journey,
Speaker 1: not a destination.
Speaker 2: Not a destination.
Speaker 1: It feels like we've only just scratched the surface here,
Speaker 1: we have.
Speaker 2: But hopefully you've gained a better understanding of how RBVM
Speaker 2: works and why it's so important. Definitely, it's a crucial change,
Speaker 2: you know.
Speaker 1: From reactive to proactive.
Speaker 2: Yeah, that's the key takeaway here.
Speaker 1: Embracing data, automation and collaboration.
Speaker 2: Absolutely, leveraging technology to gain.
Speaker 1: Insights, empowering those teams.
Speaker 2: Yeah, fostering communication across the organization.
Speaker 1: And it seems like the field is rapidly evolving.
Speaker 2: It is.
Speaker 1: All these new technologies and approaches are emerging.
Speaker 2: Yeah, we're seeing a convergence with you know, data science
Speaker 2: and AI leading to some really innovative solutions.
Speaker 1: The book mentioned predicting vulnerability exploitation with the accuracy of
Speaker 1: like weather forecasting. That's right, that's that's a pretty mind
Speaker 1: blowing concept.
Speaker 2: Mind bling Imagine being.
Speaker 1: Able to anticipate which vulnerabilities are most likely to be
Speaker 1: exploited and when that's it, you know, so you can
Speaker 1: proactively allocate those resources.
Speaker 2: And mitigate risks before they can even be exploited.
Speaker 1: That would be a game changer, it would.
Speaker 2: It would, And while we're not quite there yet.
Speaker 1: Not quite there yet, but the progress is remarkable.
Speaker 2: It is remarkable.
Speaker 1: So what can our listeners do to like, start applying
Speaker 1: these principles in their own organizations.
Speaker 2: Assess your current vulnerability management program, take a look at it. Yeah,
Speaker 2: are we just reacting or are we taking a more
Speaker 2: proactive and strategic approach? Right? Start thinking about how you
Speaker 2: can incorporate that data and analytics into your decision making.
Speaker 1: Things like vulnerability databases.
Speaker 2: Bred intelligence, asset inventory.
Speaker 1: Don't underestimate that collaboration.
Speaker 2: Collaboration is key.
Speaker 1: Break down those silos.
Speaker 2: Between security IT and the business side RBVM.
Speaker 1: It's a team effort, absolutely shared understanding of the risks,
Speaker 1: a commitment to working together to mitigate them.
Speaker 2: Working together, don't be afraid.
Speaker 1: To experiment with those new tools and technologies.
Speaker 2: There are so many innovative solutions out there.
Speaker 1: Automate tasks, gain insights, improve security posture.
Speaker 2: It's about embracing continuous improvement right, always looking for ways
Speaker 2: to do things.
Speaker 3: Better, and remember security is a journey, a journey, not
Speaker 3: a destination.
Speaker 1: Not a destination. Well said, A huge thank you to
Speaker 1: you for sharing your expertise with us.
Speaker 2: It's been my pleasure.
Speaker 1: And to our listeners, we hope you found this deep
Speaker 1: dive into RBVM informative and insightful, I hope. So remember
Speaker 1: knowledge is power.
Speaker 2: Knowledge is power, and in the world.
Speaker 1: Of cybersecurity, that power can help you build a more
Speaker 1: resilient and secure future for your organization. That's right, So
Speaker 1: stay curious, stay informed, and stay secure.
Speaker 2: Stay secure until next time.
Speaker 1: This has been the deep Dive