0

Despite the continuous effort in our company to resolve vulnerabilities, we are still reporting a significant number of vulnerabilities after each scan we perform.

We would like to understand if there are industry benchmarks or ratios, like number of vulnerabilities per asset out there that we can use to compare ourselves with.

Is any of you aware of any industry benchmark in this regard?

3 Answers 3

2

I think you are asking the wrong question. Consider the following:

  • If you fix fewer vulnerabilities than emerge between scans, then the number of vulnerabilities will only go up (10 vulns - 3 fixes + 4 new vulns = 11)
  • If you do not fix all vulnerabilities, you will never get to 0
  • Scans can have false positives that you need to verify
  • Some vulnerabilities you might never fix or choose not to fix

So, the relevant question is "why is the number not going down the way you like?"

"Industry averages for vulnerabilities per asset" is impossible and a little silly. Printers, Windows 10, Windows XP, and Linux, for example, are a vastly complex set of assets that you cannot compare to each other. Strictly speaking, if the scanner's results are not false positives, you should get the vulnerabilities down to 0.

BUT

Are the existing vulnerabilities a problem for you? Just because the scanner reports something does not mean that it needs to be fixed. The vulnerabilities might not apply to the asset in the context you have it in. That's why a risk-based approach to assessing the vulnerabilities is required.

For example, I have organisations that are running Windows XP on business-critical systems. We can't change them. Scanners light up like a Christmas tree when they scan them. But the vulnerabilities cannot be "fixed". We put in other mitigations to protect the organisation. The "vulnerability" metrics will never change for those systems, but we also have accepted that reality.

In short, don't look to "industry benchmarks". You need to set the benchmark that makes sense for your organisation, based on risk, context, and your ability to resolve vulnerabilities.

1

Despite the continuous effort in our company to resolve vulnerabilities, we are still report a significant number of vulnerabilities after each scan we perform.

"vulnerability report by some unspecified scan thing": that's not anything I would put any weight in, unless you actually know what that "scan" does, and can categorize the vulnerability.

For example, I can diagnose you, by running my (not yet patented) telepathic vulnerability scan, that your company has an IT vulnerability (IT susceptible to nuclear bomb).

Is that relevant? hopefully not. Will having more numbers of that quality make you any safer? I don't think so. Metrics are just metrics, and you have some tool whose job and selling point obviously is reporting vulnerabilities. The number of reported vulnerabilities says nothing about how secure your IT actually is.

It's what these vulnerabilities are, and how you can mitigate them, and how the measures put in place to avoid the consequences are, and, mostly, as always, what your threat model is, at all.

Quite frankly: The way you ask this ("industry benchmark for vulnerabilities") implies that you think about this as if it was something quantifiable by standards; it's not. Nothing standardized helps you – neither to assess your own security, nor, and that's far more important, to make sure you are secure.

Try not overemphasizing metrics. There's a wise saying (by someone, not me) that roughly goes:

The problem with metrics is that clever people try to game them, and stupid people try to maximize them

In this case (please don't take this personally): the vendor of the scan tool is "smart", as nothing would be worse for business than reporting that nothing was found.
You are the "stupid" part in here, because you read a number, and think there must be a better way to get a single number, where you actually should be looking how to qualitatively build a safer IT.

1
  • Well Said! My saying is: Simple metrics for complex problems provides simply wrong results. Commented May 13, 2020 at 17:11
0

You need to implement a way to map technical risk into business risk, so that you can take an informed decision.

Every vulnerability reported needs to be run against this process and the output would be something in between "vulnerability needs fixing now" and "risk accepted by business".

So what matters is not the number of vulnerabilities, is what those represent to your business in the form of risk.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .