Navigating the Vulnerability Landscape: A Beginners Guide to Tracking Software Flaws

Navigating the Vulnerability Landscape: A Beginners Guide to Tracking Software Flaws

Speakers: Gerrit Gerritsen, Application Security Engineer, Midsize Tech Company

Conference: SAINTCON

YouTube: https://www.youtube.com/watch?v=4yfxld4wro

Overview

In his SAINTCON presentation, "Navigating the Vulnerability Landscape: A Beginners Guide to Tracking Software Flaws," Gerrit Gerritsen, an Application Security Engineer, addresses a pervasive challenge in modern cybersecurity: the overwhelming and often disorganized process of vulnerability management. Gerritsen, known by his handle "Irish," frames this complex topic through an engaging analogy of managing a leaky dam – "Big Old Damco" – highlighting the common dilemma faced by organizations: how to effectively identify, prioritize, and remediate a multitude of software flaws.

The talk serves as a crucial guide for those new to the field, as well as a valuable refresher for seasoned professionals, by demystifying the "alphabet soup" of acronyms prevalent in vulnerability management. Gerritsen systematically breaks down key industry standards and open-source tools, including CVE, CVSS, EPSS, CPE, CWE, and CISA's KEV catalog. His objective is to equip attendees with the knowledge to move beyond aimless remediation, fostering a more structured, proactive, and risk-informed approach to securing their digital assets and software products.

This presentation is highly relevant in today's threat landscape, where the volume and sophistication of cyber threats continue to escalate. By providing a clear framework for understanding and integrating these essential tools, Gerritsen empowers security teams to make informed decisions, focus resources where they are most needed, and ultimately enhance their organization's overall security posture. The emphasis on standardized methods and enriched reporting underscores the importance of efficiency and context in combating an ever-growing array of software vulnerabilities.

Background

▶ Watch: Welcome to Damco: The vulnerability analogy (1:00)

The genesis of this problem, as Gerrit Gerritsen vividly illustrates with his "Big Old Damco" analogy, is the common organizational struggle with technical debt and legacy systems. Many companies operate with infrastructure "built 10 years ago using technology that was already 20 years out of date," leading to a myriad of "leaks" – software vulnerabilities – that have been ignored for too long. This neglect results in a critical juncture where the sheer volume of flaws becomes unmanageable, and organizations are left questioning where to begin: "Are we going to go after the huge cracks first or do we go after the small ones? How are we going to know what cracks there are in the dam?"

This chaotic state often leads to aimless remediation efforts, fixing issues as they are discovered without a strategic plan. The core problem is the lack of standardized, industry-accepted methods for identifying, assessing, and prioritizing vulnerabilities. Without such a framework, security teams lack a common language, consistent metrics, and reliable intelligence to guide their efforts. This is where the "alphabet soup of acronyms" comes into play. The talk positions these acronyms not as intimidating jargon, but as essential, open-source mediums that, when understood and integrated, can transform a reactive, ad-hoc vulnerability response into a proactive, data-driven management process. Gerritsen's goal is to bridge this knowledge gap, enabling even beginners to leverage these powerful tools to improve their threat and vulnerability management strategies.

Key Findings

▶ Watch: Introducing CVE: The reigning kingpin of vulnerabilities (2:55)

The central "finding" of Gerritsen’s talk is not a novel discovery, but rather a compelling articulation and demonstration of an integrated methodology for effective vulnerability management. He asserts that navigating the complex vulnerability landscape requires moving beyond isolated data points and embracing a cohesive system built upon industry standards. The key insights presented are:

1. CVEs as Foundational Identifiers: The Common Vulnerabilities and Exposures (CVE) identifier is the indispensable starting point for any vulnerability management program. It provides a unique, standardized tag for known cybersecurity vulnerabilities, ensuring everyone refers to the same issue. However, Gerritsen emphasizes that a CVE alone is merely an identifier and offers no information on severity, exploitability, or remediation.

1. Severity and Likelihood are Distinct but Complementary: The talk highlights the critical distinction between vulnerability severity and the likelihood of exploitation. Common Vulnerability Scoring System (CVSS) provides a vendor-agnostic measure of a vulnerability's potential impact (severity), ranging from 0.0 to 10.0. Complementing this, the Exploit Prediction Scoring System (EPSS) offers a probabilistic score (0-100%) indicating how likely a vulnerability is to be exploited in the wild within 30 days. The key finding here is that both scores are essential for intelligent prioritization; a high CVSS score with a low EPSS score might warrant less immediate attention than a moderate CVSS score with a high EPSS.

1. CPEs for Asset Inventory and Scanning: Common Platform Enumerations (CPEs) are presented as the "map" that guides defenders to vulnerable assets within their environment. By providing a structured naming convention for hardware, operating systems, and applications, CPEs enable automated scanning tools to precisely identify where a specific vulnerable product or version is deployed, streamlining the remediation process.

1. CWEs for Proactive Prevention: For software development organizations, Common Weakness Enumerations (CWEs) are identified as a powerful tool for shifting left in the security lifecycle. CWEs categorize common software weaknesses, allowing developers to understand why vulnerabilities occur. This enables proactive training and process improvements, reducing the introduction of flaws into new code rather than merely reacting to them post-deployment.

1. KEV for Immediate, Real-World Threats: The Known Exploited Vulnerabilities (KEV) Catalog from CISA is underscored as the ultimate prioritization mechanism. This government-managed catalog lists vulnerabilities actively being exploited in the wild. Gerritsen stresses that KEV issues demand immediate resolution, as they represent proven, ongoing threats, cutting through the "noise" of theoretical risks.

1. Enriched Reports for Actionable Intelligence: The overarching finding is the necessity of enriched reports. No single tool provides a complete picture. Integrating data from CVE, CVSS, EPSS, CPE, CWE, and KEV into a consolidated view — as offered by platforms like NIST's National Vulnerability Database (NVD), vendor management solutions, or Cyber Threat Intelligence (CTI) tools — is critical for saving time, providing context, and effectively prioritizing remediation efforts. This integration transforms raw data into actionable intelligence, moving organizations from a reactive stance to a proactive, risk-managed one.

Technical Deep Dive

▶ Watch: Deciphering CVE format and primary sources (4:00)

Gerrit Gerritsen meticulously unpacks a suite of standardized tools and frameworks, demonstrating how each contributes a unique piece to the vulnerability management puzzle. The efficacy of these tools lies in their collective application, providing a comprehensive strategy for identifying, assessing, and mitigating software flaws.

The journey begins with Common Vulnerabilities and Exposures (CVE), the foundational identifier for known cybersecurity vulnerabilities. A CVE entry is a unique alphanumeric string, typically formatted as CVE-year-serial number (e.g., CVE-2023-12345). The year denotes when the CVE was issued, and the serial number is systematically assigned. Historically, MITRE was the primary publishing authority, but now numerous CVE Numbering Authorities (CNAs), including large corporations like Microsoft and public vulnerability platforms like phone checker, can issue CVEs. All CVEs are ultimately referenced and stored on cve.org. Gerritsen highlights that a CVE report from MITRE, at minimum, includes the vulnerability's name, a description (often from the vendor or researcher), and references to external bulletins or acknowledgments. Crucially, a CVE is not a complete solution or a security bulletin; it merely tags a specific issue, offering no inherent information about its severity or how to fix it.

To address severity, Gerritsen introduces the Common Vulnerability Scoring System (CVSS). CVSS provides a vendor-agnostic numerical score ranging from 0.0 to 10.0, indicating the potential impact of a breach. This score is derived from three metric groups:

1. Base Metrics: These are inherent to the vulnerability and include factors like Attack Vector (e.g., physical access, local network, adjacent network, network), Attack Complexity, Privileges Required, User Interaction, and the Impact on Confidentiality, Integrity, and Availability.
2. Temporal Metrics: These metrics change over time. For example, the availability of a patch or widely accessible exploit code can increase a vulnerability's temporal score, reflecting an increased immediate risk.
3. Environmental Metrics: These are specific to an organization's deployment context. Security engineers can adjust these scores based on the sensitivity of data protected by the vulnerable system or the specific security controls in place, allowing for a tailored risk assessment.

CVSS is managed by FIRST (Forum of Incident Response and Security Teams) and NIST (National Institute of Standards and Technology), with NIST providing a widely used online calculator.

While CVSS quantifies severity, it doesn't predict the likelihood of exploitation. This gap is filled by the Exploit Prediction Scoring System (EPSS). Also managed by FIRST, EPSS provides a probability score from 0 to 100% (expressed as decimals, e.g., 0.95 for a 95% chance) that a vulnerability will be exploited in the wild within the next 30 days. Gerritsen emphasizes the synergy between CVSS and EPSS: a vulnerability with a high CVSS score (e.g., 9.8, critical) but a low EPSS score (e.g., 0.25) might be less urgent than one with a slightly lower CVSS but a very high EPSS (e.g., 0.95), because the latter is far more likely to be actively attacked. This combination allows for more intelligent prioritization of remediation efforts.

Next, Gerritsen discusses Common Platform Enumerations (CPEs), which are crucial for asset inventory and automated scanning. CPEs provide a standardized, machine-readable naming scheme for hardware, operating systems, and applications. A CPE string follows a specific format: cpe:/part:vendor:product:version:update:edition:language. The part field specifies whether it's an A for application, H for hardware, or O for operating system. For example, cpe:/o:apple:mac_os:15.4.1 clearly identifies Apple's macOS version 15.4.1 as an operating system. CPEs allow vulnerability scanners to precisely identify where vulnerable software or hardware exists within an environment, acting as a "map" to guide patching efforts.

For organizations involved in software development, Gerritsen introduces Common Weakness Enumerations (CWEs). Managed by MITRE and accessible at cwe.mitre.org, CWEs are a comprehensive dictionary of common software weaknesses and vulnerabilities. Unlike CVEs, which identify specific instances of vulnerabilities, CWEs describe types of flaws (e.g., CWE-20: Improper Input Validation). Each CWE entry includes an ID, description, and examples of how the weakness manifests. Gerritsen highlights their utility for "shifting left" in the Software Development Life Cycle (SDLC). By understanding CWEs, developers can proactively prevent common vulnerabilities through training and improved coding practices, reducing the number of flaws introduced into products.

Finally, the talk elevates the Known Exploited Vulnerabilities (KEV) Catalog, managed by the Cybersecurity and Infrastructure Security Agency (CISA), as a paramount prioritization tool. The KEV catalog is a definitive, government-managed list of vulnerabilities that are known to be actively exploited in the wild. For many federal and state governments, immediate resolution of KEV-listed issues within a specified timeline is mandated. Gerritsen stresses that KEV entries cut through the "noise" of potential vulnerabilities, signaling issues that pose an immediate and proven risk. A vulnerability with a high CVSS, high EPSS, and inclusion in the KEV catalog should be the absolute top priority for remediation.

The culmination of these individual tools is the concept of enriched reports. Gerritsen emphasizes that no one wants to juggle multiple spreadsheets or consult six different sources daily. Enriched reports, often provided by platforms like the NIST National Vulnerability Database (NVD), commercial vendor management solutions, or Cyber Threat Intelligence (CTI) tools, integrate data from CVEs, CVSS, EPSS, CPEs, and CWEs into a single, comprehensive view. These reports provide context, prioritize key issues, and drastically save time, transforming disparate data points into actionable intelligence for security teams.

Demo / Proof of Concept

▶ Watch: Understanding the structure of a CVE report (5:30)

Gerrit Gerritsen's presentation, while highly technical in its content, did not feature a live coding demonstration or a traditional proof-of-concept exploit. Instead, the "demo" aspect of the talk involved a guided tour through the official web interfaces of the various tools and databases he discussed.

He visually presented examples of:

• A CVE report from MITRE, illustrating the minimum required information: the CVE name, a brief description, and references to external security bulletins. This showed attendees the fundamental structure of a CVE entry on cve.org.
• The NIST CVSS calculator, demonstrating how the wizardry behind the scoring system works and how different metrics contribute to the final numerical score. This provided a concrete understanding of how CVSS scores are derived and can be customized.
• A CWE page from MITRE (cwe.mitre.org), specifically showing an entry like CWE-20: Improper Input Validation. This highlighted the detailed descriptions, abstraction levels, and examples provided for each common weakness, illustrating their utility for developers.
• An example of an enriched report from NIST NVD, showcasing how it integrates CVSS scores, weakness enumerations (CWEs), and platform enumerations (CPEs) into a single, more digestible format. This served to underscore the value proposition of consolidated vulnerability intelligence.

These visual aids served as practical examples, allowing the audience to see what these tools and reports look like in practice, reinforcing the theoretical explanations with concrete, real-world interfaces. While not a "demo" in the exploit sense, it was a highly effective walkthrough of the resources available to security professionals.

Defensive Implications

▶ Watch: Important limitations of the CVE program (6:10)

The comprehensive framework presented by Gerrit Gerritsen offers several critical defensive implications for organizations aiming to strengthen their security posture and manage vulnerabilities more effectively.

Firstly, the most significant implication is the necessity of adopting standardized frameworks rather than relying on ad-hoc, reactive measures. Security teams should integrate the "alphabet soup" of CVE, CVSS, EPSS, CPE, CWE, and KEV into their daily operations. This move from "wandering around aimlessly" to a structured approach ensures consistency, clarity, and efficiency in vulnerability management.

Secondly, prioritization must be data-driven and risk-informed. Defenders should move beyond simply reacting to high CVSS scores. The combination of CVSS (severity) and EPSS (likelihood of exploitation) provides a more nuanced risk assessment. A vulnerability with a lower CVSS but a high EPSS score might present a more immediate threat due to its higher probability of active exploitation. Furthermore, vulnerabilities listed in CISA's KEV Catalog should be treated with the highest urgency. Gerritsen explicitly states that KEV issues represent proven, actively exploited threats in the wild, often with mandated remediation timelines for federal systems, making them top priority for any organization.

Thirdly, leveraging enriched reports is paramount for operational efficiency. Instead of manually correlating information from disparate sources, security teams should utilize tools like the NIST National Vulnerability Database (NVD), commercial Cyber Threat Intelligence (CTI) platforms, or vendor management solutions that consolidate CVEs, CVSS, EPSS, CPEs, and CWEs into a single pane of glass. This saves significant time, provides crucial context, and facilitates quicker, more informed decision-making regarding remediation.

Fourthly, for organizations that develop software, a strong emphasis must be placed on shifting left in the Software Development Life Cycle (SDLC) using Common Weakness Enumerations (CWEs). By understanding and training developers on common weaknesses like CWE-20: Improper Input Validation, organizations can prevent vulnerabilities from being introduced into code in the first place. This proactive approach drastically reduces the cost and effort of fixing vulnerabilities downstream and moves security from a gatekeeping function to an integral part of the development process.

Finally, effective asset inventory and management are greatly enhanced by Common Platform Enumerations (CPEs). By using CPEs to identify specific versions of applications, operating systems, and hardware, organizations can accurately map their digital assets and efficiently target vulnerability scanning and patching efforts. Knowing precisely where a vulnerable component resides (e.g., Adobe Aqua Reader version 1.1 on a specific server) allows for precise and rapid remediation, rather than broad, untargeted efforts.

In essence, Gerritsen's talk equips defenders with the knowledge to establish a robust, proactive vulnerability management program that prioritizes real-world threats, streamlines operations through integration, and fosters a culture of security throughout the organization.

Key Takeaways

• Embrace Enriched Reports: Consolidate vulnerability intelligence from various sources (CVE, CVSS, EPSS, CPE, CWE, KEV) into a single, enriched report format, such as those provided by NVD or CTI tools, to save time and gain comprehensive context.
• Prioritize KEV Issues First: Treat vulnerabilities listed in CISA's Known Exploited Vulnerabilities (KEV) Catalog as the absolute highest priority for immediate remediation, as these are actively being exploited in the wild.
• Combine CVSS and EPSS for Risk-Based Prioritization: Utilize Common Vulnerability Scoring System (CVSS) for assessing the severity of a vulnerability and Exploit Prediction Scoring System (EPSS) for determining the likelihood of its exploitation to make informed, risk-based decisions on where to focus remediation efforts.
• Shift Left with CWEs in Software Development: For development teams, leverage Common Weakness Enumerations (CWEs) to identify recurring software flaws, train engineers, and proactively prevent vulnerabilities from being introduced into code during the design and development phases.
• Utilize CPEs for Accurate Asset Inventory: Implement Common Platform Enumerations (CPEs) to accurately identify and inventory all software, hardware, and operating systems within your environment, enabling precise vulnerability scanning and targeted patching.
• Adopt a Standardized, Integrated Approach: Move away from aimless, reactive vulnerability management by integrating these standardized tools and frameworks into a cohesive strategy, fostering a proactive and efficient security posture.

About the Speaker(s)

Gerrit Gerritsen, who goes by the handle "Irish," is an Application Security Engineer for a midsize tech company based out of St. George. Beyond his professional dedication to cybersecurity, Gerritsen expresses a deep love for his family and a passion for baking, humorously noting that his favorite cookie is indeed "HTTP only." He presented this talk based on his practical experience, including a lighthearted reference to his "recently acquired expertise as leading head manager of all things technical for Big Old Damco," an analogy he used throughout his presentation to illustrate the challenges and solutions in vulnerability management. His background combines technical expertise in application security with a clear ability to communicate complex topics in an engaging and accessible manner.