IBM Report: Threat Scores Should Give Weight to the Economics of Cyber-crime

IBM’s X-Force is pushing for a reprioritization of security threats.

In its end-of-the-year Trend and Risks Report for 2008, released today, the X-Force contends that a key reason a number of critical vulnerabilities that caused alarm in the security community were not wildly exploited in 2008 was economics. Hackers focus first and foremost on threats they can monetize.

For this reason, the report states, the Common Vulnerability Scoring System (CVSS) needs to make economic considerations part of its scoring formula, instead of focusing just on the technical aspects of a vulnerability.

"The CVSS provides an essential base that the security industry desperately needs to measure security threats," said Kris Lamb, senior operations manager of X-Force Research and Development for IBM Internet Security Systems, in a statement. “But we also realize that cybercriminals are motivated by money, and we need to fully consider how attackers balance the economic opportunity of a vulnerability against the costs of exploitation.”

The report’s authors are quick to point out that IT departments should not ignore vulnerabilities just because they feel those vulnerabilities will not be widely popular with organized crime. However, a more careful consideration of the way that vulnerabilities fit into the business models of criminal organizations will help better prioritize IT protection and patching efforts, the report states.

“If the security industry can better understand the motivations of computer criminals, it can do a better job of determining when emergency patching is most needed in the face of immediate threats,” Lamb continued. “We can also be more precise about determining when widespread exploitation of a vulnerability will take a long time to emerge, and when it is unlikely to ever emerge. This analysis could result in more efficient use of time and resources."

A prime example of this is a remote code execution vulnerability in the Microsoft Snapshot Viewer ActiveX Control that received a CVSS base score of 7.5. This bug was widely targeted, the report contends, because it was relatively easy to monetize and exploit.

"Vulnerabilities are frequently reported in ActiveX controls and attackers are used to incorporating exploits into Web exploit toolkits and using them to propagate spyware that collects financial credentials," the report states. "So in this case, the exploitation cost was low and so was the monetization cost.

"The installed base was essentially infinite, since the attackers could push down the Microsoft-signed control to anyone that would allow it to be installed," the report continues. "The bottom line is that a large revenue opportunity combined with a low monetization cost led to a large amount of exploitation that still shows no sign of slowing down."