Threat Tags in the Vulcan Platform
The Vulnerability threat tags in the Vulcan Platform provide a breakdown of the attack vector and threat intelligence. They can be used to prioritize remediation actions on vulnerabilities and impact the overall risk score of a vulnerability.
Intelligence Threat Tags
Vulcan attaches dedicated Threat Tags to vulnerabilities and CVEs. Although the names of the tags are similar or identical to the publicly used terminology in the Cyber world, the meaning of the tag in the Vulcan Platform is based on the findings, identifications, and meticulous research of the Vulcan Cyber Research team.
Threat Tag by Vulcan | When is this Threat tag attached to a vulnerability on the Vulcan Platform? |
EXPLOITABLE | Attached to a vulnerability when Vulcan finds the exploit code of the CVE. Read more about exploitable maturity. |
WEAPONIZED | Attached to a vulnerability when Vulcan finds an indication of a CVE-exploit practice in the wild. |
MALWARE | Attached to a vulnerability when Vulcan finds an indication of the CVE used in a malware attack. |
OWASP Top Ten 2021 Threat Tags
The OWASP Top 10 is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to web applications.
Rank | Threat Tag | Description and comparison to previous OWASP Top 10 edition (2017) |
| OWASPTop10 |
|
#1 | Moves up from the fifth position; 94% of applications were tested for some form of broken access control. The 34 Common Weakness Enumerations (CWEs) mapped to Broken Access Control had more occurrences in applications than any other category. | |
#2 | Shifts up one position to #2, previously known as Sensitive Data Exposure, which was broad symptom rather than a root cause. The renewed focus here is on failures related to cryptography which often leads to sensitive data exposure or system compromise. | |
#3 | Slides down to the third position. 94% of the applications were tested for some form of injection, and the 33 CWEs mapped into this category have the second most occurrences in applications. Cross-site Scripting is now part of this category in this edition. | |
#4 | Is a new category for 2021, with a focus on risks related to design flaws. If we genuinely want to “move left” as an industry, it calls for more use of threat modeling, secure design patterns and principles, and reference architectures. | |
#5 | Moves up from #6 in the previous edition; 90% of applications were tested for some form of misconfiguration. With more shifts into highly configurable software, it’s not surprising to see this category move up. The former category for XML External Entities (XXE) is now part of this category. | |
#6 | Moves up from #6 in the previous edition; 90% of applications were tested for some form of misconfiguration. With more shifts into highly configurable software, it’s not surprising to see this category move up. The former category for XML External Entities (XXE) is now part of this category. | |
#7 | Was previously Broken Authentication and is sliding down from the second position, and now includes CWEs that are more related to identification failures. This category is still an integral part of the Top 10, but the increased availability of standardized frameworks seems to be helping. | |
#8 | Is a new category for 2021, focusing on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity. One of the highest weighted impacts from Common Vulnerability and Exposures/Common Vulnerability Scoring System (CVE/CVSS) data mapped to the 10 CWEs in this category. Insecure Deserialization from 2017 is now a part of this larger category. | |
#9 | Was previously Insufficient Logging & Monitoring and is added from the industry survey (#3), moving up from #10 previously. This category is expanded to include more types of failures, is challenging to test for, and isn’t well represented in the CVE/CVSS data. However, failures in this category can directly impact visibility, incident alerting, and forensics. | |
#10 | Is added from the Top 10 community survey (#1). The data shows a relatively low incidence rate with above average testing coverage, along with above-average ratings for Exploit and Impact potential. This category represents the scenario where the security community members are telling us this is important, even though it’s not illustrated in the data at this time. |
CVSS Attack Vector Threat Tags
Attack Vector | Description |
Remote | The vulnerability can be exploited through remote access. |
Local | Vulnerability can be exploited through local access. |
Unauthenticated | Authentication or user interaction is not required to exploit the vulnerability. |
HOT CVE Threat Tag
Vulnerabilities with a HOT CVE threat tag attached are vulnerabilities discovered during the last 30 days and have a CVSS score higher than 9.
Additional Threat Tags
PrivilegeEscalation
DenialOfService
InformationLeakage
Spoofing
RemoteCodeExecution
SecurityFeatureBypass
Tampering
XML Injection
SQL Injection
Session Management
Related Topics