1

Today while reviewing vulnerability scan results with a colleague, we had a debate about what vulnerabilities can be considered "true or legitimate" and hence worthwhile to spend resources in monitoring. We had a differing opinion on whether vulnerabilities without a relevant attack vector can be considered "true" vulnerabilities for our company

My opinion was that even if a vulnerability discovered today has no applicable attack vectors because conditions needed to exploit it does not exist, the vulnerability is still worthy of monitoring as its future behavior may evolve. As more information is known about it, more attack vectors may become known. In addition, our company is moving in the direction of the Cloud, where I see faster detection and stronger monitoring of vulnerabilities in becoming more important, due to there being more "distance" between a company and its digital assets. I.e: Assets become less physically tangible.

However, I also understand my college's point of monitoring and researching having a opportunity cost. If the probability of successful exploit is unlikely, then the time spent researching, monitoring, and reporting results may be better spent on another activity, similar to not how all security risks have equal criticality.

Given our company's direction, that we work with highly sensitive customer data such as health information (HIPPA), and we are in the regulated financial services industry, I tend to feel more comfortable by taking the more conservative approach of my own viewpoint.

In general, are vulnerabilities with non applicable attack vectors considered "true" vulnerabilities?

How should the degree of monitoring and resource commitment to remediation be determined general speaking at a high level, particularly for regulated industries?

  • 1
    It would probably help a lot if you gave a specific example of the vulnerability, the attack vectors you think are not relevant, how you would monitor for that vulnerability, etc. – jcaron Jun 20 at 12:36
1

In general, are vulnerabilities with non applicable attack vectors considered "true" vulnerabilities?

If a vulnerability cannot be exploited on your system, then you typically don't need to take it into account. If you might be vulnerable in the future in the event that you change your configuration in a way that would make you exploitable, then it's good to take note, but generally, a vulnerability that is not applicable to your setup does not count as a vulnerability in your situation. You can safely ignore them in that case.

Every time you make non-trivial changes to your system, you should re-do your threat modeling process to ensure that no new issues have slipped in with the changes. This should always be done and should catch any known vulnerabilities that you might have dismissed in the past. The only reason to take note of a vulnerability that you isn't currently relevant to you is to speed up this threat modeling process later. After all, it's faster if your impact analysis for that vulnerability is already half-done when the time comes.

Sometimes, a new vulnerability is considered a non-issue because it would require bypassing existing mitigations exploit. In that case, you still shouldn't ignore it. If at all possible, you should treat it as a very real vulnerability and work on mitigating it as a form of defense in depth. This may not be possible if the mitigation is complex or involves serious tradeoffs. In that case, keeping it in mind can still be useful as you may come up with a mitigation in the future. At the very least, it's good to understand your situation.

How should the degree of monitoring and resource commitment to remediation be determined general speaking at a high level, particularly for regulated industries?

Answering this requires you perform genuine risk analysis. It's always better to be conservative in your approach to taking security risks, both for legal reasons (in the case of heavily-regulated industries) and ethical ones. However, nothing is free, and if the cost to consider a vulnerability real and take appropriate action is higher than the cost to deal with more serious, extant issues, then the priority is low.

In risk analysis, you have to take into account both how serious a risk is, how likely it is to actually impact you, and how difficult or costly it is to mitigate or deal with. Once you know this, you can compare it with other risks so you can properly allocate your resources to best protect yourself and your users. This should be used to create a priority list for issues that need fixing. Once all issues of higher priority have been dealt with, then you can start to work on mitigating a vulnerability that is unlikely to be relevant.

1

more attack vectors may become known

It seems premature to react to vulnerabilities before this happens. It is probably better to just subscribe to security advisories and get alert, when this happens.

vulnerabilities without a relevant attack vector

How do you determine, if they are relevant? Even if the attack vector is unreachable on its own, combining multiple exploits have been the way to break high security systems for quite some time. Also, can you be sure a future change in your system will not make it relevant?

IMO if you are sure there is no vector for your system, even if combined with other exploits (even hypotetical ones not discovered yet) and after future updates, then it is not necessary to spend the resources on it. If you are not sure, or can't determine without extensive research, it is better to just do it to be safe.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.