Understanding the Vulnerability Lifecycle for Risk Assessment and Defense Against Sophisticated Cyber Attacks

Abstract

The security of deployed and actively used systems is a moving target, influenced by factors that are not captured in the existing security models and metrics. For example, estimating the number of vulnerabilities in source code does not account for the fact that cyber attackers never exploit some of the discovered vulnerabilities, in the presence of reduced attack surfaces and of technologies that render exploits less likely to succeed. Conversely, some vulnerabilities are exploited stealthily before their public disclosure, in zero-day attacks, and old vulnerabilities continue to impact security in the wild until all vulnerable hosts are patched. As such,we currently do not know how to assess the security of systems in active use. In this chapter, we report on empirical studies of security in the real world, using field data collected on 10+ million real hosts that are targeted by cyber attacks (rather than on honeypots or in small-scale lab settings). Our empirical findings and the novel metrics we evaluate on this field data will enable a more accurate assessment of the risk of cyber attacks, by taking into account the vulnerabilities and attacks that matter most in practice.