Systems without non-patchable exploitable OS vulnerabilities

Description

The percentage of systems that were active in the last 30 days that have addressed non-patchable, exploitable operating system vulnerabilities, providing critical insight into the organisation's "Emergency Mitigations" capability requiring compensating controls NOW.

How we measure it

Find all active hosts per your vulnerability management system. Join the hosts with the vulnerability database, and filter the vulnerabilities on the criteria as defined in the metric definition (non-patchable + exploitable + OS).

Meta Data

Attribute	Value
Metric id	vm_posture_non_patchable_exploitable_os
Category	Vulnerability Management
SLO	90.00% - 98.00%
Weight	0.9
Type

References

Framework	Ref	Domain	Control
ISO 27001:2022	A.8.8	8 Technological controls	Management of technical vulnerabilities
CIS 8.1	7.5	Continuous Vulnerability Management	Perform Automated Vulnerability Scans of Internal Enterprise Assets
CIS 8.1	7.6	Continuous Vulnerability Management	Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets
NIST CSF v2.0	ID.RA-01	Risk Assessment (ID.RA)	ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded

Code

SELECT
  host.hostname AS resource,
  'host' as resource_type,
  CASE
    WHEN count(cve.agent_id) = 0 THEN 1
    ELSE 0
  END AS compliance,
  CAST(count(cve.agent_id) AS text) AS detail
FROM
  {{ ref('crowdstrike_hosts') }} AS host
LEFT JOIN
  {{ ref('crowdstrike_vulnerabilities') }} AS cve
ON
  host.device_id = cve.agent_id
  AND cve.status IN ('open', 'reopen')
  AND coalesce(cve.remediation_level != 'O', true)
  AND coalesce(cve.exploit_status > 0, false)
  AND cve.severity IN ('HIGH', 'CRITICAL')
  AND cve.cve_id IN (SELECT cve_id FROM {{ ref('cve_db_cve_summary') }} WHERE is_os = 1)
WHERE
  CURRENT_DATE - CAST(host.last_seen AS DATE) < 30
GROUP BY
  host.hostname

SELECT
  asset.hostname AS resource,
  'host' AS resource_type,
  CASE
    WHEN count(cve.plugin_id) = 0 THEN 1
    ELSE 0
  END AS compliance,
  CAST(count(cve.plugin_id) AS text) AS detail
FROM
  {{ ref('tenableio_assets') }} AS asset
LEFT JOIN
  {{ ref('tenableio_vulnerabilities') }} AS cve
ON
  asset.asset_id = cve.asset_uuid
  AND cve.state IN ('OPEN', 'REOPENED')
  AND cve.exploit_available IS TRUE
  AND cve.has_patch IS FALSE
  AND cve.severity IN ('high', 'critical')
  AND EXISTS (SELECT 1 FROM {{ ref('cve_db_cve_summary') }} AS summary WHERE summary.is_os = 1 AND list_contains(from_json(cve.cve, '["VARCHAR"]'), summary.cve_id))
WHERE
  CURRENT_DATE - CAST(asset.last_seen AS DATE) < 30
GROUP BY
  asset.hostname