Hirofumi Kawauchi
Dr. Hirofumi Kawauchi is SOC manager at NTT-ME. In his 10+ years’ background in cyber security, he previously led incident response, vulnerability management, and Security by Design at NTT East, the largest telecom carrier in Japan. He also experienced SOC analyst, threat intelligence development, SIEM and security device management for Managed Security Service (MSS) at NTT Security US. After coming back to Japan, he newly launched NTT East’s MSS as a tech-lead and developed SOC infrastructure. He contributes to Japan’s telecom industry and educational field in cyber security by sharing his knowledge and experience at ICT-ISAC JAPAN, university classes, several events, etc. He holds CISSP, GPEN, GCFA, AWS-SAP/SCS. He is also NTT Group Certified Security Principal and PhD Engineering.
Session
The number of published vulnerabilities continues to increase year by year. We provide the fixed telecommunication services to our 13 million+ customers as the largest telecom carrier in Japan. It has been always challenging to deal with huge number of vulnerabilities on the large-scale IT infrastructure.
We created our practical criteria for Stakeholder-Specific Vulnerability Categorization (SSVC) instead of CVSS in order to prioritize and efficiently respond to each vulnerability. Additionally, to evaluate our method, we applied our SSVC method to over 50,000 relevant vulnerabilities published over the past few years based on the software components information from our actual hundreds of services.
In the evaluation result, the total number of “Immediate” vulnerabilities is 8% which is much more realistic than responding to all. The results also show that the method effectively prioritize the vulnerabilities considering attack possibility, open/closed network, business impact, etc.
In this presentation, we will describe what issues we faced, the problem of CVSS and how we decided to adopt SSVC. We will share about our SSVC method, its benefits, evaluation results, and how to use the method. We hope this presentation will help you with your practical vulnerability management.