With the number of Web-based threats and vulnerabilities growing, IBM X-Force is recommending that the security industry rethink how it ranks vulnerability threats--how easily an attack can be monetized and to what degree should be components of vulnerability scoring.
IBM's X-Force is pushing for a reprioritization
of security threats.
In its end-of-the-year Trend
and Risks Report for 2008
, released today, the X-Force contends that a
key reason a number of critical vulnerabilities that caused alarm in the
security community were not wildly exploited in 2008 was economics. Hackers
and foremost on threats they can monetize.
For this reason, the report states, the Common Vulnerability Scoring System
(CVSS) needs to make economic considerations part of its scoring formula,
instead of focusing just on the technical aspects of a vulnerability.
"The CVSS provides an essential base that the security industry
desperately needs to measure security threats," said Kris Lamb, senior
operations manager of X-Force Research and Development for IBM
Internet Security Systems, in a statement. "But we also realize that
cybercriminals are motivated by money, and we need to fully consider how
attackers balance the economic opportunity of a vulnerability against the costs
The report's authors are quick to point out that IT departments should not
ignore vulnerabilities just because they feel those vulnerabilities will not be
widely popular with organized crime. However, a more careful consideration of
the way that vulnerabilities fit into the business models of criminal
organizations will help better prioritize IT protection and patching efforts,
the report states.
"If the security industry can better understand the motivations of computer
criminals, it can do a better job of determining when emergency patching is
most needed in the face of immediate threats," Lamb continued. "We can also be
more precise about determining when widespread exploitation of a vulnerability
will take a long time to emerge, and when it is unlikely to ever emerge. This
analysis could result in more efficient use of time and resources."
A prime example of this is a remote code execution vulnerability in the
Microsoft Snapshot Viewer ActiveX Control that received a CVSS base score
of 7.5. This bug was widely targeted, the report contends, because it
was relatively easy to monetize and exploit.
"Vulnerabilities are frequently reported in ActiveX controls and
attackers are used to incorporating exploits into Web exploit toolkits and
using them to propagate spyware that collects financial
credentials," the report states. "So in this case, the
exploitation cost was low and so was the monetization cost.
"The installed base was essentially infinite, since the attackers could
push down the Microsoft-signed control to anyone that would allow it to be
installed," the report continues. "The bottom line is that a large
revenue opportunity combined with a low monetization cost led to a large amount
of exploitation that still shows no sign of slowing down."