Risk-Based Vulnerability Management (RBVM): What is it & how to implement

Security and development teams who work with a complex software supply chain need more than just a vulnerability count to manage risk. Even though businesses traditionally relied on a vulnerability’s CVSS score (critical, high, etc.) to determine its risk level, this score doesn’t account for overall risk to the organization. 

Instead, today’s enterprises must manage vulnerabilities in context. Rather than seeing each vulnerability as an isolated issue, teams must view it in the context of broader business risks. This shift in perspective requires an asset-first approach to software supply chain security: the ability to understand which assets matter most and securing these business-critical services first. 

Risk-based vulnerability management (RBVM) is a relatively new AppSec practice that empowers organizations to see their risk in context and prioritize the most critical fixes. In this article, we'll provide an overview of RBVM, including:

• What it is

• The benefits of risk-based vulnerability management

• How to assess vulnerability risks

• Risk score assessment methodologies

• How to successfully implement a risk-based vulnerability management program

• How Snyk helps organizations reach risk-based vulnerability management maturity

What is risk-based vulnerability management (RBVM)?

RBVM enables organizations to identify, prioritize, and remediate issues based on several industry-wide and context-specific factors. This approach looks very different from traditional security strategies. Vulnerability-focused security — the conventional approach to vulnerability and risk management — focuses on finding and grouping issues by a generic risk score, such as Common Vulnerability Scoring System (CVSS). From there, fixes get prioritized solely based on this general score. 

In comparison, RBVM assesses vulnerabilities based on several characteristics, such as relationship to business-critical services, reachability, and runtime context.

Benefits of risk-based vulnerability management

To successfully secure applications and reduce overall risk, enterprises must prioritize their vulnerabilities accurately. If they fail to prioritize correctly, development and security teams could focus their efforts in the wrong places, for example fixing a critical-level vulnerability in an internal-facing application instead of a medium-level vulnerability in a crucial service. These misplaced efforts can put critical applications at risk and waste resources on non-essential security activities. 

But gaining the proper contextual insights in today’s complex, fast-paced software development lifecycles is much easier said than done. RBVM focuses on making this process easier for security and development teams, empowering them to understand each vulnerability in context and prioritize them accurately. As a result, businesses see the following benefits:

Reduced risk for the organization 

According to Gartner, risk-based vulnerability management is one of the top ways to reduce time to remediation. The contextual insights from RBVM lead to more targeted security activities and less overwhelmed security and development teams, making it easier for them to reduce overall business risk. 

Enhanced productivity for development and security teams

Development and security teams both benefit from an RBVM approach. Security teams can use this contextual, asset-based approach to gain better visibility, prioritize the vulnerabilities that matter most to the business, and better manage software supply chain security.

In addition, RBVM enables development teams to understand where each vulnerability exists in a complex pipeline, how it affects essential services, and where it falls on the list of remediation priorities. It empowers developers to fix the most pressing vulnerabilities quickly and effectively.

Improved collaboration

RBVM also improves team collaboration by reducing noisy security backlogs and shedding light on the business’s most high-risk threats. It minimizes the number of vulnerability alerts, making it easier for developers and security teams to work together as they tackle security issues.

How to assess vulnerability risks 

RBVM uses several factors to measure each vulnerability’s probability of exploitation and its expected impact. A few of these factors include:

• business criticality 

• reachability

• exploit maturity

• runtime context

RBVM also leverages traditional risk score assessment methodologies such as CVSS and Exploit Prediction Scoring System (EPSS).

Snyk’s application security solutions employ a Risk Score based on two vectors: the vulnerability’s likelihood of exploitation and its user impact. Within these vectors, we consider both the objective risks (relevant for any environment) and the contextual risks (threats specific to the vulnerable application’s environment). 

How to successfully implement a risk-based vulnerability management program

While several organizations leverage some type of risk management strategy, they often triage issues differently. Some businesses focus on fixing issues based on compliance requirements or security SLAs, while others only tackle issues with available fixes.

However, organizations often have the most risk management success when they gain comprehensive visibility into their business context and then use this multi-faceted data to drive an end-to-end AppSec program. To put this contextual approach into practice, follow these best practices:

1. Creating an asset inventory. Security teams must understand what they are responsible for securing. Tools like application security posture management (ASPM) or software bill of materials (SBOM) management technology can help teams build a complete inventory of services and their architecture. 

2. Identifying security gaps. Next, businesses need to understand their existing security controls and pinpoint coverage gaps. An application security assessment can help with this process.

3. Assessing risk. Then, security teams should use holistic risk assessment models that report the objective and contextual risks within each asset.  

4. Using automated workflows. By using automation to manage risk assessment and kick off remediation, security teams save lots of time and resources.

How Snyk can help you reach risk-based vulnerability management maturity

Snyk’s asset-based approach to application security can support teams as they work toward risk-based vulnerability management maturity. Our tools leverage developer-first application security scanning for first- and third-party code, alongside risk scoring based on each vulnerability’s likelihood and possible impact. We also offer automation for enforcing security policies, kicking off remediation workflows, and interfacing with third-party tools. 

Snyk’s application security posture management (APSM) solution will provide end-to-end visibility into all these technologies. Our platform leverages Snyk Insights for code-to-cloud application intelligence and technology from the Enso acquisition for application security orchestration. Dive deeper into Snyk’s approach to ASPM to learn more about implementing risk-based vulnerability management at your organization. 

FAQs