-: Remediation priority.
So in previous lessons we've mentioned CVSS scores
and critical, high, medium and low and you may think that,
hey, if it's a critical, it's gotta be done right away.
Or if it's a high it should be done before a low and things
like that but that's not always necessarily the case.
So we'll talk about remediation priority in this lesson
because really what it comes down to is man-hours, money,
equipment and other items and they're just limited resource.
You only have so many hours in the day,
you only have so much money to remediate things
and so as a vulnerability manager we have to decide and make
recommendations on where is the priority to fix things.
We can't fix everything right away so we've got to figure
out where should we be placing our organizational efforts?
Now depending on your organization, that me be left up to
the vulnerability manager or it may be at a higher level
and you're just going to be making recommendations
but either way you need to understand prioritization so you
can make those recommendations or make those hard choices.
How critical is the system and information it contains?
This is the first question you really want to ask yourself.
You need to take into account the confidentiality, integrity
and availability of the vulnerability if it was exposed.
So if I have a system that holds a bunch of PII
or personal identifying information like
people's social security numbers, their birth dates,
their mother's maiden name, their street addresses
that's pretty critical because if that gets out
that can cause a lot of damage to our business.
And so we have to think about all of that and how bad it is
from a confidentiality standpoint, an integrity standpoint
and an availability standpoint.
If all that data is encrypted and it's not able to be read,
so it's still going to be confidential even if it gets out,
that's less critical to us than if it was being stored
in plain text that anyone can read if it got out.
So these are the kind of things you have
to think about as you're going through.
How critical is the system and how critical
is the information it contains.
The next thing you have to think about is
how difficult is it to fix the vulnerability?
So how much time and money will it cost for you to fix it?
So if I have two vulnerabilities that I need to fix,
or let's say I have five vulnerabilities,
one through five we'll name them,
and I can spend a million dollars to fix vulnerability one
or I could spend that same million dollars
and fix vulnerabilities two, three, four and five,
I can get four things fixed for the price of one.
I might want to weigh that and decide that those
four vulnerabilities getting fixed is more important
than fixing the top vulnerability, right?
And so this is why prioritization really is a balancing act.
It's not always just about this is the most critical
because you may have five critical vulnerabilities
but now you have to figure out inside those
critical vulnerabilities, which one is your top priority?
Which one is your second priority?
And which ones you're going to fix in which order.
The next thing we want to consider is how severe is
the vulnerability and this is where the CVSS score really
comes into play and helps you out.
Each vulnerability gets a criticality value
like we talked about with CVSS and different
vulnerabilities are more severe than others.
For example, if you have a known exploit against a software
that has a software bug out there
that allows remote-code execution,
this is a very severe thing whereas
a cross-site scripting vulnerability might be less severe
if it's only happening on your intranet server
because for someone to be able to get to it
they have to be inside your network already.
Whereas a remote-code vulnerability like the first one
we talked about, they can do it from the outside
and so that's more severe.
And so you've got to weigh those things, right?
Now, how is the exposed...
How exposed is your server to the vulnerability?
This goes back to that intranet, DMZ
and extranet thing, right?
So, if we have an external-facing server
it's going to be more exposed than our intranet servers
because anyone can touch it.
Often you should fix lower external vulnerabilities
before fixing critical internal ones because again,
a high vulnerability on a web server
might actually be attacked more frequently
than a critical one in your internal environment
because external people can't get there.
And so again, this becomes part of that balancing act
that you've really got to figure out, where is the priority?
And this is more art than science when it comes down to it.
A lot of people try to create algorithms to weigh it
and decide based on money and exposure and CVSS scores
but some of it is really just figuring out what you think is
going to be most likely to be attacked
based on the threats that are out there.