Patrick Garrity, Security Researcher at Nucleus Security, discusses the rise of vulnerabilities exploitation and threat intelligence in the field of vulnerability management. He highlights the history of vulnerability management, the increase in vulnerabilities and exploitation, the limitations of the common vulnerability scoring system (CVSS), and the emergence of vulnerability threat intelligence. Patrick also emphasizes the importance of open-source intelligence, such as CISA's Known Exploited Vulnerabilities (KEV) List and the Exploit Prediction Scoring System (EPSS), as well as the value of commercial threat intelligence.

Key Takeaways:

• Vulnerability management has historically been a low priority in organizations, but the rise in vulnerabilities and exploitation has made it a critical area of focus.
• The common vulnerability scoring system (CVSS) has limitations and is not an effective way to prioritize vulnerabilities.
• Open-source intelligence, such as the CISA Known Exploited Vulnerabilities (KEV) List and the Exploit Prediction Scoring System (EPSS), provide valuable information for prioritizing vulnerabilities.
• Commercial threat intelligence offers additional context and analysis, helping organizations take quicker and more informed actions.
• The field of vulnerability management has evolved rapidly in recent years, with the emergence of new standards and tools.

Learn more about Nucleus Security - The Only Risk-Based Vulnerability Management Platform purpose-built for the world’s most complex enterprises: https://nucleussec.com/

Chapters

00:00 Introduction to the rise of vulnerability exploitation and threat intelligence

00:25 History of vulnerability management and the use of CVSS

01:37 Rise in vulnerabilities and the shift from credential compromise to exploitation

04:56 Challenges with the common vulnerability scoring system (CVSS)

07:06 Rise in vulnerability threat intelligence and available sources

09:30 Open source threat intelligence: Kev, CISA, Google Project Zero

12:02 Comparison of coverage between EPSs and CVSS

12:58 Value of commercial threat intelligence and its additional context

14:11 Analysis and mitigations provided by commercial threat intelligence

14:48 Evolution and history of vulnerability management and open standards