What Is Vulnerability Intelligence and How Does it Work?

Digital transformation has pushed businesses to increase their reliance on technology and digital tools. Unfortunately, these technologies and digital tools share common vulnerabilities that bad actors locate and exploit, leaving businesses and people at risk of major digital disruption. The sheer number of common vulnerabilities makes it incredibly difficult to address them all, let alone know which are most relevant. In fact, there may be over 24,000 common vulnerabilities and exposures in 2022 alone, according to recent data.

In this post, we will discuss what common vulnerabilities and exposures are and how to protect your business against them with vulnerability intelligence. 

What are Common Vulnerabilities and Exposures?

To start, let’s break down the definition of common vulnerabilities and exposures (CVE). 

In 1999, MITRE, a nonprofit operating federally funded research and development in the U.S., launched CVEs to identify and categorize vulnerabilities in software and firmware. MITRE created the CVE database, which was a list of publicly disclosed computer security flaws. This provides a reference-method for publicly known information-security vulnerabilities and exposures.

Outside of the MITRE database, common vulnerabilities and exposures are aspects of a software or program where organizations are at risk of attacks or exploits. 

In essence, CVEs tell cybersecurity professionals where their the weaknesses in their tech stack lie. Unfortunately, it also tells bad actors how they can access networks and businesses through these vulnerabilities. An inherent risk also lies in the CVEs that were previously unknown, which are called zero-day vulnerabilities. CVEs are assigned an identifier, for example “CVE-2018-13379”. 

Common Vulnerabilities and Exposures (CVEs) and previously-unknown software vulnerabilities (zero-days) are on the rise, and according to the ZeroFox Quarterly Threat Landscape Report, likely increased in Q2 2022. The report found that:

• The severity and pace of vulnerability disclosure continued on an upward trajectory, averaging almost 70 CVEs disclosed per day. 
• Nearly 17% of vulnerabilities disclosed received a Common Vulnerability Scoring System (CVSS) 3.X Critical rating. 
• The frequency of zero-day disclosures also remained high, affecting end users in almost all industries.

These vulnerabilities can’t be ignored. Depending on the type, they may lead to network intrusions, further device issues, and hijacked systems. 

What exactly is "Vulnerability Intelligence"?

Vulnerability intelligence is a specific form of threat intelligence focused on the aggregation or dissemination of information about computer vulnerabilities that helps security professionals and systems administrators make better, more complete decisions about treating vulnerability risks. 

In other words, vulnerability intelligence is cyber threat intelligence that deals with software vulnerabilities, bugs, and exploits that may be used by digital adversaries to infiltrate target organizations. 

For example, in June 2022, ZeroFox Intelligence observed the Follina Vulnerability in Microsoft, which allowed bad actors to access and weaponize Microsoft Word documents.  

This type of intelligence is crucial in shifting to a proactive approach to cybersecurity. Vulnerability intelligence is collected through a variety of channels, from analyzing chatter about known software bugs via social media to keeping a pulse on the security community, or a DarkOps team monitoring threat actor chatter about vulnerability. 

This type of intelligence will also provide some context and insight into which vulnerabilities should be prioritized. No two vulnerabilities are alike, and you’ll need to consider a variety of factors including which vulnerability would have the largest impact to your business if exploited. This can be done through a managed intelligence service. 

Vulnerability Intelligence vs. Threat Intelligence

Vulnerability intelligence and threat intelligence are often mistakenly interchanged. However, vulnerability intelligence is a subset of threat intelligence. 

You can think of vulnerability intelligence as the part of threat intelligence that would have found the unsecured vent in the Death Star. It searches for the weak part that could take down an entire enterprise. Although your organization may not need to mitigate every single weak point, vulnerability intelligence will help you prioritize the best way to keep your assets safe. 

What is Threat Intelligence?

Threat intelligence is the more broad term that encompasses several types of intelligence. 

Threat intelligence, also called Cyber Threat Intelligence (CTI) is information about existing or emerging cyber threats and digital threat actors, processed or analyzed by cybersecurity experts, that helps organizations understand, identify, prevent, and respond to risks in the digital space.

Forrester defines threat intelligence as “Assessments of the intent, capabilities, and opportunities of threat actors in response to stakeholder requirements. Threat intelligence is used to inform business decisions and reduce risk from physical and cyberthreats.”

Intelligence is a unique kind of information and cyber threat intelligence involves more than just gathering information. Threat intelligence is the output of a strategically-driven process of collecting and analyzing information that pertains to the activities of digital threat actors and can be used to understand and mitigate against harmful cyber threats.

How does vulnerability intelligence work?

Vulnerability intelligence works by collecting thousands, or even millions, of data points looking for correlating problems. It also works by analyzing patches and new releases to detect potential points of entry for bad actors. 

For example, vulnerability intelligence will look for patterns of issues in the cloud and network perimeter infrastructure—including routers, firewalls, and commonly-used software modules— which might enable remote attackers to compromise enterprise networks of organizations of all sizes and locations. 

As mentioned, vulnerability intelligence teams will also look at available patches and provide advice on which should be prioritized. The importance of efficient patching programs is magnified by widespread reporting of vulnerabilities in commonly-used software, enabling threat actors to rapidly target vulnerable systems. 

Vulnerability intelligence is done through a mix of human and artificial intelligence and automation. Together with automation, analysts can comb through large swaths of data and find vulnerabilities more quickly. Then, they’re able to provide recommendations to security teams. Additionally, vulnerability intelligence red teams may perform tests to attempt to hack into a software to test for vulnerabilities.

How to use vulnerability intelligence to combat security threats

Like most other types of threat intelligence, vulnerability intelligence can be used to combat security threats by providing key recommendations to security teams on a risk-based approach. This intelligence can be given on a case-by-case basis, or can be part of a broader threat intelligence feed. 

For example, a vulnerability intelligence flash brief can be made available through your external cybersecurity solution. This brief will likely have key background information on the vulnerability, information on who is most likely affected, and next steps. Reports like the ZeroFox Quarterly Threat Landscape Report are also excellent places to gather information on the most relevant CVEs. 

Once your team is aware of the most relevant CVEs and critical vulnerabilities, you can recommend the proper patches or system updates to users. For example, if a CVE is known in iOS systems, your security and IT teams can push a system update to the rest of the organization who uses the system. 

Additionally, IOCs and IOAs will be alerted of IP addresses and malware hashes indicating your organization’s network assets have been compromised due to a CVE.  

Benefits of vulnerability intelligence

Vulnerability intelligence allows security teams to leverage the knowledge of experts to stay one step ahead of the adversary. Additional benefits include: 

• Better ROI on external cybersecurity software and efforts.
• A more proactive approach to cybersecurity 
• Better prioritization of mitigation efforts

How to safeguard your data from vulnerabilities 

Aside from monitoring for vulnerabilities, you can protect your data from CVEs with a few simple steps. 

• Step 1: Use vulnerability intelligence to prioritize remediation and reduce the risk of vulnerability exploitation. 
• Step 2: Use modern endpoint detection and response tools on all assets.
• Step 3: Encrypt data whenever possible.
• Step 4: Use software penetration testing to detect unknown or possible vulnerabilities.

This is not an exhaustive list, but these steps will better position your team to be ready if a vulnerability should arise. 

How does ZeroFox deal with vulnerability threats?

Your business can’t be waiting for attacks, instead it must be proactive. ZeroFox helps by providing vulnerability intelligence feeds. ZeroFox’s Network and Vulnerability Intelligence Feeds provide IOCs and IOAs such as IP addresses and malware hashes indicating your organization’s network assets have been compromised. This information helps you keep your infrastructure security controls up to date and understand how to prioritize the mitigation of vulnerabilities and what your greatest digital risks are.

To learn more about how ZeroFox can enhance your intelligence team’s strategy, download our Buyer’s Guide to Threat Intelligence. 

Tags: Cybersecurity, Digital Risk Protection, Threat Intelligence