Farsight
Introduction
The Farsight feature is a powerful tool that helps organizations address potential vulnerabilities in a more effective manner, regardless of the CVSS score or the existence of an exploit. With this feature, organizations can focus on mitigating vulnerabilities that are most relevant and potentially impactful, based on the prediction of an increased risk as determined by Farsight's advanced algorithm.
The traditional approach to vulnerability management involves focusing on the CVSS score, which provides a numerical representation of the severity of a vulnerability. However, this method has several limitations, including the fact that it does not take into account the likelihood of a vulnerability being exploited. The Farsight feature considers threat actors, their tools and campaigns as well as the historical record of exploitation including usage of malware to provide a more comprehensive assessment of the risk associated with a vulnerability.
By using Farsight, organizations can prioritize their efforts to address the vulnerabilities that are most likely to cause harm. This not only saves time and resources, but also helps organizations stay ahead of potential threats and maintain a secure environment for their critical assets. Moreover, the model that powers the Farsight feature is constantly adapting to new information, ensuring that organizations are always getting the most up-to-date and accurate risk assessments.
Risk classification of assets and services serves a purpose and should be conducted to further distinguish where to focus most efforts. This task can be time-consuming and may not produce viable results in the first couple of iterations. Farsight enables you to filter out some unlikely vulnerabilities with little to no prior knowledge about the vulnerabilities or assets, getting you on track with your vulnerability program faster.
Farsight score
Farsight score is a risk indicator that shows how likely a vulnerability is to be exploited compared to average, where approximately 95% of all vulnerabilities are never exploited. The score ranges from 1 to 100, with a score of 100 indicating that the vulnerability is highly likely to be exploited in the wild within the next 12 months. The benefit to the customer is the ability to drive more aggressive risk-based remediation, focusing on even fewer vulnerabilities that reach a particular likelihood. Any vulnerability that has already been exploited in the wild will get a risk value of 100.
Since risk score is constantly adapting to new information, the risk rating can decrease as well as increase based on activity in the wild.
Prerequisites
To use Farsight you need the function enabled in your subscription. Contact support for more information on how you can enable the Farsight function.
Farsight in CORE
In the CORE, Farsight is a key component in the risk grade of Findings, Assets, Asset Groups, and AppStaks where it is represented by an A-to-F scale. In addition to the letter grade, the numerical representation of the Farsight score is displayed as a Farsight score in the Findings view, providing a more detailed and specific understanding of the level of risk.
Clicking the Findings tab takes you to the findings view, where the findings are listed.
Selecting a finding displays a more detailed view in the panel to the right.
| Option | Description |
|---|---|
| Age * | Shows how old the vulnerability is. |
| Asset UUID | The unique identifier of the Asset the Finding belongs to. |
| CVSS V3 | CVSS V3 score range.
|
| CVSS V3 severity | CVSS V3 severity in qualitative ratings.
|
| Last Scan | The date of the last scan. |
| Farsight score * | Risk indicator that shows how much more likely a vulnerability is to be exploited compared to average. The risk indicator present the likelihood values in an 1-100 format. |
| First Seen | Date and time when the finding has been seen for the first time. |
| Grade * | Risk level on a scale from A to F where F represents the most critical risks. The following metrics are used and evaluated when calculating the risk level in the following order:
This order works as a funnel in a falling order. |
| Last Seen * | Last time date when threat activity has been detected by the scanner. |
| Name * | Vulnerability name |
| Port | The IP communication port. |
| Protocol | TCP, UDP, ICMP, IGMP or GENERIC |
| Status * | Indicates the different statuses for a finding. Can be marked as:
|
| UUID | The unique identifier of the finding. |
*) Columns shown by default
| Option | Description |
|---|---|
| Status | Indicates the different statuses for a finding. Can be marked as:
|
| Farsight score | Risk indicator that shows how much more likely a vulnerability is to be exploited compared to average. The risk indicator present the likelihood values in an 1-100 format. |
Delta | Is the difference between the current and the former likelihood values. |
| Aging | Days since first discovered. |
| Threat activity | Last time date when threat activity has been detected by the watcher community. |
| Last Seen | Last time date when threat activity has been detected by the scanner. |
| CVSS v3 | CVSS V3 score range.
|
| CVE Link | Further information about the vulnerability from the National Vulnerability Database. |
Only findings that has the status PRESENT are included when calculating the grades for Assets, Asset Groups, and AppStaks.
Related Articles
Copyright
© 2024 Outpost24® All rights reserved. This document may only be redistributed unedited and unaltered. This document may be cited and referenced only if clearly crediting Outpost24® and this document as the source. Any other reproduction and redistribution in print or electronically is strictly prohibited without explicit permission.
Trademark
Outpost24® and OUTSCAN™ are trademarks of Outpost24® and its affiliated companies. All other brand names, product names or trademarks belong to their respective owners.