measure what you fix: asset risk management done right
TRANSCRIPT
![Page 1: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/1.jpg)
Measure What You Fix:
!
Asset Management Is Broken
![Page 2: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/2.jpg)
Michael RoytmanData Scientist, Risk I/O
![Page 3: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/3.jpg)
It is far better to grasp the universe as it really is than to persist in delusion, however satisfying and reassuring.
- Carl Sagan
![Page 4: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/4.jpg)
Risk =More Can Happen
Than Will.
![Page 5: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/5.jpg)
2. CVSS Score Reduction
Bad Remediation Metrics
1. Vulnerability Density
![Page 6: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/6.jpg)
Part 1: !
Fix What Matters
![Page 7: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/7.jpg)
I Love It When You Call Me Big Data50,000,000 Live Vulnerabilities
1,500,000 Assets
2,000 Organizations
![Page 8: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/8.jpg)
I Love It When You Call Me Big Data
3,000,000 Breaches
![Page 9: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/9.jpg)
Probability A Vuln Having Property X Has Observed Breaches
RANDOM VULN
CVSS 10
CVSS 9
CVSS 8
CVSS 6
CVSS 7
CVSS 5
CVSS 4
Has Patch
0.000 0.010 0.020 0.030 0.040
![Page 10: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/10.jpg)
Probability A Vuln Having Property X Has Observed Breaches
Random Vuln
CVSS 10
Exploit DB
Metasploit
MSP+EDB
0.0 0.1 0.2 0.2 0.3
![Page 11: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/11.jpg)
Part 2: !
Measure What You Fix
![Page 12: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/12.jpg)
![Page 13: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/13.jpg)
#DoingItWrong
![Page 14: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/14.jpg)
Jet Engine x Peanut Butter SHINY!=
Current State of Remediation Performance Tracking
![Page 15: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/15.jpg)
Where We Want To Be
![Page 16: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/16.jpg)
![Page 17: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/17.jpg)
Data 1.Active Breaches !
2.Metasploit Module !
3. ExploitDB Entry !
4. Popular Target
![Page 18: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/18.jpg)
![Page 19: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/19.jpg)
Framework
Estimate likelihood of breach event for each vulnerability.
![Page 20: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/20.jpg)
Framework
An asset is only as safe as the riskiest vulnerability on that asset.
![Page 21: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/21.jpg)
![Page 22: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/22.jpg)
Model
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Breached In The Wild?
Metasploit Module Exists?
ExploitDB Entry?
Popular Target?
Less Risky
![Page 23: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/23.jpg)
Model Actively
BreachedMeta sploit
Exploit DB
Popular Target
Vuln
Actively Breached
Meta sploit
Exploit DB
Popular Target
Actively Breached
Meta sploit
Exploit DB
Popular Target
Actively Breached
Meta sploit
Exploit DB
Popular Target
Actively Breached
Meta sploit
Exploit DB
Popular Target …
![Page 24: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/24.jpg)
Better?
![Page 25: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/25.jpg)
Model
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Asset
![Page 26: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/26.jpg)
Model
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Asset
![Page 27: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/27.jpg)
Model
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Asset Asset Asset
![Page 28: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/28.jpg)
Model
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Actively Breached
Meta sploit
Exploit DB
Popular Target
Vuln
Asset = 5 Asset = 10 Asset = 4.375
![Page 29: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/29.jpg)
Where We’re Going, We Don’t Need Peanut Butter
![Page 30: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/30.jpg)
Where We’re Going, We Don’t Need Peanut Butter
![Page 31: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/31.jpg)
An Engine Not A Camera
![Page 32: Measure What You FIx: Asset Risk Management Done Right](https://reader033.vdocument.in/reader033/viewer/2022060107/554bec0cb4c90556328b505b/html5/thumbnails/32.jpg)
risk.io/jobs
@mroytman
WE HAVE JOBS