Black Duck continues to expand vulnerability prioritization methods

Black Duck has always recognized the importance of prioritizing open source security tasks by providing several key data points to help customers focus on what’s most critical. After all, with over 40 new software vulnerabilities being uncovered every day, it’s easy to become overwhelmed. In addition to offering detailed descriptions, expanded severity scoring, exploit information, and remediation guidance, today’s release of Black Duck adds vulnerability impact analysis, which indicates whether your application executes vulnerable code. Let’s look at how this addition further augments your prioritization efforts.

Are you calling vulnerable code?

A large part of determining which security flaws present the most risk is understanding how they affect your operations. Regardless of severity or remediation requirements, vulnerability impact varies across different applications. When determining how a vulnerability affects your applications, one important consideration should be whether the vulnerable code is being executed.

One of the characteristics of open source is that nothing is customized for your specific use. This makes the components more modular and reusable, but it also means that unused code is included in your applications. After all, just because you pull in an entire Java library doesn’t mean you’re going to utilize every method in it.

Understanding whether a vulnerability is in your call path is another important factor in prioritizing remediation efforts, and Black Duck now provides that information. When customers scan projects with Black Duck, in addition to detailed Black Duck Security Advisories (BDSAs), they also receive a vulnerability impact analysis.

Focusing first on Java components used most commonly by our customers, the Black Duck Cybersecurity Research Center (CyRC) indicates whether a particular vulnerability is executed by an application. Should the flaw be in the execution path, it is tagged as “reachable” and a call graph is created that reveals both the method in which the vulnerability exists and the method that calls it, down to the line number. With this information in hand, you can gain visibility into where and how a vulnerability is being executed by the application, making your prioritization efforts simple and pointing you directly to the code that needs to be addressed.

How severe is the vulnerability?

The severity of a vulnerability is an important factor in understanding the risk that it exposes your organization to. In order to keep the vulnerability determination as objective as possible, and to keep everyone speaking the same language, most organizations recognize the Common Vulnerability Scoring System (CVSS) as the industry standard.

The experts at the CyRC utilize this framework to rank the severity based on metrics like exploitability, impact, and temporal factors. The severity is often a key data point in determining which vulnerabilities demand the most attention.

In addition to providing scores consistent with multiple CVSS versions, Black Duck also allows organizations to set policies based on CVSS scores and exploitability. This enables teams to automatically fail builds that contain unpatched vulnerabilities that exceed a certain severity threshold, or that contain an existing exploit.