Qualys, Inc. · NASDAQ:QLYS
Qualys — Conference Presentation (February 2006)
40 slides from Qualys's conference presentation, Feb 15, 2006
Slide 1: The Laws of Vulnerabilities
The Laws of Vulnerabilities Terry Ramos Qualys 02/15/06 - HT1-202
Slide 2: Are We Getting Better or Worse?
Are We Getting Better or Worse ? What is a vulnerability? How significant is this vulnerability? How prevalent is this vulnerability? How easy is this vulnerability to exploit? Are any of my systems affected by this vulnerability? How quickly should I patch this vulnerability?
Slide 3: Security Trend Indicators
Security Trend Indicators • Malicious Code (↑) • Vulnerabilities (↑) • Spam and Spyware (↑) • Phishing and Identity Theft (↑) ….and • Time to Exploitation (↓)
Slide 4: First Generation Threats
First Generation Threats • Spreading mostly via email, file-sharing • Human Action Required • Virus-type spreading / No vulnerabilities • Examples: Melissa Macro Virus, LoveLetter VBScript Worm • Replicates to other recipients • Discovery/Removal: Antivirus
Slide 5: Second Generation Threats
Second Generation Threats • Active worms • Leveraging known vulnerabilities • Low level of sophistication in spreading strategy (i.e. randomly) • Non Destructive Payloads • Remedy: Identify and Fix Vulnerabilities
Slide 6: Third Generation Threats
Third Generation Threats • Automated Attacks Leveraging Known and Unknown Vulnerabilities • Collaboration of Social Engineering and Automated Attacks • Multiple Attack Vectors — Email, Web, IM, Vulnerabilities,… • Active Payloads • Remedy: Security Enforcement / NAC / NAM
Slide 7: The Laws of Vulnerabilities: Studying Vulnerabilities and Patching
The Laws of Vulnerabilities: Studying Vulnerabilities and Patching • Objective: Understanding prevalence of critical vulnerabilities over time in real world • Timeframe: 2002 - Ongoing • Data Source: — 70% Global Enterprise networks — 30 % Random trials • Methodology: Automatic Data collection with
Slide 8: Analyzing 32,000,000 Vulnerability Scans
Analyzing 32,000,000 Vulnerability Scans Millions 8 Zotob 7 Worm Internal/Intranet Scans 6 External/Perimeter Scans 5 4 3 Sasser Worm 2 Witty Blaster Worm Slammer 1 Worm Worm 0 Q402 Q103 Q203 Q303 Q403 Q104 Q204 Q304 Q404 Q105 Q205 Q305
Slide 9: Raw Results
Raw Results • Largest collection of global real-world vulnerability data: —32,147,000 IP-Scans from Q3/2002 to Q3/2005 —21,347,000 critical vulnerabilities identified • Scope of Vulnerabilities included —1,060 out of 1,556 unique critical* vulnerabilities * Providing an attacker the ability to gain
Slide 10: The Changing Vulnerability Landscape
The Changing Vulnerability Landscape • From server to client applications • Before: Vulnerabilities in server applications: — Webserver, Mailserver, Operating System services, • Now: More than 60% of new critical vulnerabilities in client applications: — Web Browser, Backup Software, Media Player, A
Slide 11: Microsoft WebDAV Vulnerability
Microsoft WebDAV Vulnerability 120% 100% Microsoft WebDAV Buffer Overflow MicrosoftWindows Windows2000 2000 IIS IISWebDAV WebDAVBuffer Buffer Overflow 80% OverflowVulnerability Vulnerability CAN-2003-0109 CAN-2003-0109 60% Qualys QualysID ID86479 86479 40% Released: Released:March March2003 2003 20%
Slide 12: Buffer Overflow in Microsoft LSASS
Buffer Overflow in Microsoft Local Security Authority Subsystem Service (LSASS) 120% Buffer 100% Microsoft LSASS Bufferoverflow overflowininMicrosoft Microsoft Local Security Authority Local Security Authority Subsystem SubsystemService Service 80% (LSASS) (LSASS) 60% CAN-2003-0533 CAN-2003-0533 Qua
Slide 13: Vulnerability Half-Life
Vulnerability Half-Life 100% For Foraacritical criticalvulnerability vulnerability 75% every every19 19days daysthe thenumber number of ofvulnerable vulnerablesystems systems isisreduced reducedby by50% 50%on onexternal externalsystems systems 50% 25% 19 days 38 days 57 days 76 days 95 days 114 days
Slide 14: Microsoft Exchange Server Buffer Overflow Vulnerability
Microsoft Exchange Server Buffer Overflow Vulnerability 120.00% 100.00% Microsoft MicrosoftExchange ExchangeServer Exchange Server Buffer Overflow Server Buffer 80.00% BufferOverflow OverflowVulnerability Vulnerability 60.00% CAN-2003-0714 CAN-2003-0714 Qualys QualysID ID74143 74143 40.00% Released:
Slide 15: Adobe Acrobat Reader Format String Vulnerability
Adobe Acrobat Reader Format String Vulnerability 120% 100% Adobe AdobeAcrobat AcrobatReader Reader Format 80% FormatString StringVulnerability Vulnerability Adobe Acrobat Format String Vulnerability 60% CAN-2004-1153 CAN-2004-1153 Qualys QualysID ID38385 38385 40% Released: Released:December Decembe
Slide 16: Microsoft Server Message Block Remote Execution (MS05-011)
Microsoft Server Message Block Remote Execution (MS05-011) 120% Remote 100% RemoteCode CodeExecution Execution Vulnerability in Microsoft Vulnerability in Microsoft SMB Remote Execution Vulnerability Server ServerMessage MessageBlock Block 80% (SMB) (SMB) 60% CAN-2005-0045 CAN-2005-0045 Qualys Qualy
Slide 17: External vs. Internal Half-life
External vs. Internal Half-life For Foraacritical criticalvulnerability vulnerabilityevery every 100% 19 19days days(48 (48days daysononinternal internalnetworks) networks) 50 50% %ofofvulnerable vulnerablesystems systems 75% are arebeing beingfixed fixed 50% 25% 19 days 38 days 57 days 76 days 95 d
Slide 18: The Changing Half-life
The Changing Half-life 2003 2004 2005 2006 External 30 21 19 ? Half-life days days days Internal 62 48 - ? Half-life days days
Slide 19: Predefined vs. Irregular Vulnerability Releases
Predefined vs. Irregular Vulnerability Releases Vulnerabilities Vulnerabilitiesreleased released 120% on onaapredefined predefinedknown known 100% Predefined Release schedule scheduleshow show18%18% 80% faster fasterpatch patchresponse response 60% 120% 40% 100% 20% 80% 0% 60% Irregular Release 7/30
Slide 20: SSL Server Allows Cleartext Communication
SSL Server Allows Cleartext Communication 3500 3000 SSL Server allows Cleartext SSL SSLServer ServerAllows Allows 2500 Cleartext Communication Cleartext Communication 2000 1500 Qualys QualysID ID38143 38143 1000 500 0 3/1/2003 5/1/2003 7/1/2003 9/1/2003 11/1/2003 1/1/2004 3/1/2004 5/1/2004 7/1/2004
Slide 21: SQL Slammer Vulnerability
SQL Slammer Vulnerability 120% 100% SQL Slammer Vulnerability MS-SQL MS-SQL8.0 8.0UDP UDP 80% Slammer SlammerWorm WormBuffer Buffer Overflow Vulnerability Overflow Vulnerability 60% CAN-2002-0649 CAN-2002-0649 Qualys QualysID ID19070 19070 40% Released: Released:July July2002 2002 20% 0% 2/8/2003 4/
Slide 22: Lingering Vulnerabilities: SNMP Writable
120% 0% 20% 40% 60% 80% 100% 10/5/2002 1/5/2003 4/5/2003 7/5/2003 10/5/2003 1/5/2004 4/5/2004 7/5/2004 10/5/2004 1/5/2005 Lingering Vulnerabilities: SNMP Writable 4/5/2005 SNMP Writeable 7/5/2005
Slide 23: Vulnerability Lifespan
Vulnerability Lifespan 100% 4% 4%of ofcritical criticalvulnerabilities vulnerabilities 75% remain remainpersistent persistentand and their theirlifespan lifespanisisunlimited unlimited 50% 25% 19 days 38 days 57 days 76 days 95 days 114 days
Slide 24: Window of Exposure
Window of Exposure 100% 80% 80%ofofexploits exploitsare are available availablewithin withinthe thefirst firsthalf-life half-life 75% period periodofofcritical criticalvulnerabilities vulnerabilities 50% 25% 19 days 38 days 57 days 76 days 95 days 114 days
Slide 25: A Continuous Cycle of Infection
A Continuous Cycle of Infection 180 160 Codered Slapper 140 Blaster 120 Nachi 100 Automated Automated attacks create 85% Zotobattacks create 85% Sasser 80 of oftheir theirdamage damagewithin withinthethe 60 first firstfifteen fifteendays daysfrom fromoutbreak outbreak 40 and andhavehaveunlimited unl
Slide 26: Mapping Vulnerability Prevalence
Mapping Vulnerability Prevalence 400000 350000 Vulnerability Prevalence 10% Most Prevalent Vulnerabilities 90% Remaining Vulnerabilities 300000 250000 90% 90%of ofvulnerability vulnerabilityexposure exposure isiscaused causedby by10% 10%of 200000 of 150000 critical criticalvulnerabilities vulnerabil
Slide 27: The Changing Top of the Most Prevalent
The Changing Top of the Most Prevalent 400000 Vulnerability Prevalence 2004 350000 Vulnerability Prevalence 2005 300000 50% 50%of ofthe themost mostprevalent prevalent 250000 and andcritical criticalvulnerabilities vulnerabilities 200000 are arebeing beingreplaced replacedby bynew new 150000 vulnera
Slide 28: Top 10 External Vulnerabilities as of November 15, 2005
Top 10 External (Most Prevalent and Critical Vulnerabilities) as of November 15, 2005 Title Qualys ID CVE Reference External Reference CAN-2003-0533 MS04-011 Buffer overflow in Microsoft Local Security Authority Subsystem Service (LSASS) 90108 CAN-2003-0693 CA-2003-24 Buffer Management Vulnerability
Slide 29: Top 10 Internal Vulnerabilities as of November 15, 2005
Top 10 Internal (Most Prevalent and Critical Vulnerabilities) as of November 15, 2005 Title Qualys ID CVE Reference External Reference CAN-2003-0717 MS03-043 Microsoft Messenger Service Buffer Overrun Vulnerability 70032 CAN-2003-0813 MS04-012 Microsoft Windows RPC Runtime Library Vulnerability 6852
Slide 30: The Record Breakers
The Record Breakers • Fastest fixed Vulnerability — Windows Plug and Play vulnerability - MS05-039 • Longest lingering critical vulnerability — SNMP Writeable • Most Prevalent critical vulnerability — Microsoft Windows DCOM RPC • Most active Worm: — Blaster
Slide 31: Myth About Wireless Security
Myth About Wireless Security Emerging technologies, such as wireless networks are a significant security vulnerability in enterprise environments
Slide 32: The Real World: Configuration Issues in Wireless Access Points
The Real World: Configuration Issues in Wireless Access Points 200 Open AP / No WEP 180 AP with default password 160 140 120 100 80 60 40 20 0 Q402 Q103 Q203 Q303 Q403 Q104 Q204 Q304 Q404 Q105 Q205 Q305
Slide 33: Conclusion: Wireless Security Vulnerability
Conclusion: Wireless Security Vulnerability The issue of security vulnerabilities in Wireless devices is significantly overrated – only 1 in nearly 20,000 critical vulnerabilities is caused by a wireless device.
Slide 34: The Laws of Vulnerabilities
The Laws of Vulnerabilities #1. Half-Life The half-life of critical vulnerabilities is 19 days on external systems and 48 days on internal systems, and doubles with lowering degrees of severity #2. Prevalence 50% of the most prevalent and critical vulnerabilities are replaced by new vulnerabilities
Slide 35: The Laws of Vulnerabilities
The Laws of Vulnerabilities #4. Focus 90% of vulnerability exposure is caused by 10% of critical vulnerabilities #5. Window of Exposure The time-to-exploit cycle is shrinking faster than the remediation cycle. 80% of exploits are available within the first half-life period of critical vulnerabilitie
Slide 36: Goal for 2006: Shortening the Half-Life of Critical Vulnerabilities by 20%
Goal for 2006: Shortening the Half-Life of Critical Vulnerabilities by 20% •Awareness •Awareness 100% •Prioritization •Prioritization •Security-Enforcement •Security-Enforcement 75% 2005 50% 25% 2006 48 days 96 days 144 days 192 days 240 days 288 days
Slide 37: Common Vulnerability Scoring System (CVSS)
Common Vulnerability Scoring System (CVSS) • Industry Standard for common vulnerability scoring supported by CERT, Mitre, Cisco, Symantec, Microsoft, and Qualys • CVSS provides an industry standard vulnerability scoring that allows corporations to take into consideration their own security metrics •
Slide 38: Proposed Solutions
Proposed Solutions • Establish enterprise vulnerability management program • Network Admission Control (NAC) is a new trend to stop threats before they affect the enterprise • Enforce best practices for configuration and policy management • New standard for prioritization of remediation – CVSS
Slide 39: Summary and Actions We Can Take
Summary and Actions We Can Take • Significant progress on improving the remediation cycle • Predefined vulnerability release schedules are shortening the patch cycle • Need to counter the shrinking time-to-exploit cycle • Goal: Shortening the Half-Life of vulnerabilities by 20% within one year • Req
Slide 40: Thank You
Thank You • References: — http://www.qualys.com/laws This presentation and any future updates — http://www.qualys.com/top10 Continuously updated Top Ten Index of most prevalent and critical external and internal vulnerabilities — http://www.qualys.com/top10scan Free Top Ten Assessment Tool — http://