Page 155 - Cyber Defense eMagazine Annual RSA Edition for 2024

Exploring the Limitations of Traditional Scanners and the Opaque Nature of Third-Party Code

The problem of blind spots when it comes to third-party software vulnerabilities stems from two main root
causes: limitations of traditional vulnerability scanners and the opaque nature of third-party code.

1. Limited Scanning Capabilities:

Imagine a security guard tasked with patrolling a building. They have a master key that grants access to
most areas, but some rooms require special access cards. This scenario parallels the limitations of
vulnerability scanners.

• Credential Dependence: Some vulnerabilities within third-party components can only be
unearthed by accessing specific functionalities within the software. Traditional scanners might
lack the capability to do this without proper credentials. Think of the special access cards needed
for specific rooms in our analogy. Without the right credentials, the guard (scanner) can't enter
and assess the security of those areas (functionalities).
• Misconfigurations: Just like a security guard can miss a room due to a faulty keycard reader,
scanner misconfigurations can lead them to overlook vulnerabilities. For instance, the scanner
might not be programmed to scan specific ports or directories where the third-party component
resides. This creates a blind spot, like a malfunctioning keycard reader preventing the guard from
accessing a particular room.

2. Opaque Third-Party Code:

Unlike your own building with transparent windows, the inner workings of third-party components are like
a black box. You can't see the code itself, making it difficult to directly scan for vulnerabilities.

These limitations create a significant challenge. Traditional scanners might miss vulnerabilities due to
credential needs or misconfigurations, and you can't directly scan the code itself. This leaves you relying
on the vendor to identify and address security flaws within their software, potentially exposing your
systems until a patch is available.

A Multi-Layered Approach to Third-Party Software Vulnerability

The challenge of tracking vulnerabilities in third-party software demands a multi-faceted solution. Here's
how a layered approach combining automated systems and human vigilance can empower you to stay
informed and take timely action:

Layer 1: Leveraging Automation for Efficiency

• Vulnerability Databases: National resources like the National Vulnerability Database (NVD) serve
as a central hub for known vulnerabilities. By regularly querying these databases for specific
software versions you use (e.g., Cisco Firewall version X.Y.Z), you can identify potential threats.
• Subscription Services: Signing up for security mailing lists offered by vendors allows you to
receive automated notifications directly from the source. Whenever a new vulnerability is
discovered and a patch becomes available, you'll be alerted, allowing for a quicker response.

155