08/28/2024 | News release | Distributed by Public on 08/28/2024 06:02
Common Vulnerabilities and Exposures (CVEs) are publicly disclosed security flaws that threat actors can exploit to gain unauthorized access to applications, systems or networks. In cloud environments, they're particularly concerning due to the complex and dynamic nature of cloud infrastructure. CVEs can persist in cloud-based applications, containers and operating systems until an organization actively identifies and remediates them.
For many organizations, a critical first step in securing cloud and containerized environments is to discover and patch CVEs before bad actors can exploit them.
Establishing a reliable cloud vulnerability management program is essential for timely risk identification and mitigation. But managing vulnerabilities at scale is an uphill battle. (That's why a few weeks ago we laid out some vulnerability management best practices!)
A good metric to determine the accuracy of a vulnerability scan is to count the number of false positives and false negatives. Fewer false positives and false negatives indicate a more accurate scan.
The Prisma Cloud Intelligence Stream is a real-time feed that aggregates vulnerability data and threat intelligence from certified sources like vulnerability databases, vendor feeds and commercial providers. It includes both official feed data and additional insights from a dedicated research team that tracks and identifies new and quietly patched vulnerabilities. The stream automatically updates multiple times daily.
Aggregating data from more than 30 upstream providers, the Intelligence Stream combines open-source feeds, private threat intelligence and commercial sources to deliver the most accurate and comprehensive CVE data. By incorporating diverse data sources, further refining vulnerability accuracy, it significantly reduces the occurrence of false positives and negatives. This approach enables organizations to maintain a secure cloud environment with greater confidence.
The National Vulnerability Database (NVD) provides a comprehensive repository of standardized vulnerability information, including detailed descriptions and severity ratings. It offers a searchable database of known vulnerabilities and associated security metrics, helping organizations assess and manage risks. The NVD supports the cybersecurity community by providing up-to-date information for threat analysis and vulnerability management.
Many vendors use the NVD as their source data for detecting vulnerabilities. As discussed, this can generate many false positives and false negatives because the data lacks context into other risk factors associated with the application's vulnerabilities. Because vulnerabilities don't always affect operating systems similarly, what may be a critical vulnerability for Ubuntu may not affect Debian, for example.
To determine if a vulnerability is a false positive or false negative using Prisma Cloud:
Example
1. Navigate to Monitor -> Vulnerabilities -> Vulnerability Explorer
2. Search for a CVE and click on the displayed result.
3. Select the image.
4. Navigate to the Package Info tab and search for library, libssh2.
5. Ensure that Prisma Cloud's CVE Viewer shows the same vulnerable versions as the vendor.
6. Navigate to Monitor -> Vulnerabilities -> CVE Viewer
7. Search for the CVE ID. In this case, the CVE is associated with an Amazon package (Ref: CVE-2020-22218).
8. Compare the OS and package information with the vendor CVE. Everything should match on established CVEs. New CVEs not fully characterized may show a mismatch, as the vendor research is incomplete.
For detailed guidance on optimizing vulnerability detection and management with Prisma Cloud, explore the Intelligence Stream Documentation. If you'd like to learn more about what Prisma Cloud can do, book a personalized demo.