Traditional vulnerability assessment falls short on third-party risks
As organizations increasingly rely on third-party vendors, open-source components, and cloud services to bolster efficiency and scalability, they also open themselves to risks.
Historically they've relied on CVSS scores to measure the severity of risks, but a new report from Black Kite suggests that this method alone is not enough.
"Focusing solely on Common Vulnerability Scoring System (CVSS) scores is insufficient for risk management," says Ferhat Dikbiyik, chief research and intelligence officer at Black Kite. "CVSS is not a prioritization tool and cannot inform security teams whether a vulnerability is being exploited or the likelihood it will be weaponized. Further exacerbating the challenges, security teams are overwhelmed by the sheer number of vulnerabilities to address and track, while most exploited vulnerabilities slip past traditional risk assessments as they fall in the medium or low range. In today's environment, organizations need to understand how vulnerabilities can propagate through the ecosystem. They must rethink their vulnerability management strategy to include exploitability, vendor exposure, and supply chain risk."
The report finds that many of 2024's most exploited vulnerabilities were present in widely used third-party software rather than internally developed applications, with high-profile vulnerabilities in MOVEit, Fortra GoAnywhere, and Ivanti products demonstrating how supply chain risks can spread.
A significant portion of vulnerabilities have been weaponized within days of their disclosure, reinforcing the need for rapid risk assessment and response. Additionally, ransomware groups increasingly leverage known exploited vulnerabilities (KEVs) to maximize impact.
Vulnerabilities affecting major software vendors such as Microsoft, Cisco, and VMware have far-reaching consequences too, as they are embedded in countless enterprise environments. The interconnected nature of digital supply chains magnifies the potential damage.
You can get the full report on the Black Kite site.
Image credit: Weerapat Wattanapichayakul/dreamstime.com