Vulnerability management has been an integral part of security operations for decades. Many organizations recognize the importance of a risk management plan and supplement it with robust risk management cycles and minimum-security measures. However, many face challenges such as auditing failures, failing to report relevant metrics to senior management in a language they understand, feeling frustrated by the vulnerability of the bulk and, worse, fear breaking. Many organizations define their risk management plans as “scan, investigate and re-scan” processes. However, that is the main problem – making risk management a simple and ineffective task that only involves tool-assisted scanners, followed by packaging.
An effective risk management system requires consistent processes, business context, risk priorities, timely adjustment, mitigation, possible metrics, and all this without business disruption and intolerance to business outcomes. Even with all the components, managing a weakness is not always easy. Of course, just scanning and amending will not work. It requires complete planning at each step. Here are our recommendations for increasing efficiency and the impact of your vulnerability management efforts.
Analysis
Discover and Classify Assets
Many businesses have complex servers, cloud conditions, desktops, laptops, mobile devices, Internet of Things (IoT) and more. These assets are flexible, seem unlimited, and move and grow continuously. As this rise increases, so does the exposure of the organizational threat. Maintaining inventory is essential to any robust cybersecurity system and recognizing this inventory is essential to a risk management system.
Organizations should keep up-to-date inventory. Configuration control databases (CMDBs) are popular for this purpose. The business value of each asset should be defined, in order to direct the focus of safety procedures such as risk management. This criticalness should be based on the organisation’s segregation policy, as well as a sound understanding of the organization’s network topology and the reliance map and network visibility. The property website should also record the details of the property owners, in order to address the risk in a timely manner. The following actions can help organizations gain greater visibility in their infrastructure.
SRM leaders must be able to work with infrastructure and operations (I&O) teams to select acquisition and management tools. They also need to spend more time and effort updating and maintaining word lists to correct tool errors or correct lies.
Initiate a randomly scheduled sweep periodically, over a wide range, to detect system changes and any user-operated systems that may not be otherwise reported. Organizations should also integrate risk management into existing transformation management systems and IT service management tools (ITSM).
Scan for Vulnerabilities at the Optimal Frequency
One of the main purposes of scanning is to have an up-to-date view of the vulnerabilities in your environment, which then supports remediation activities for these vulnerabilities. When organizations try to fix the scanning frequency without considering the remediation cycle, they’re bound to get the same set of vulnerabilities on a daily, weekly, or even a quarterly scan. The focus should be on having a timely remediation process.
Critical assets should be scanned continuously, less critical should be scanned weekly, monthly, or quarterly, depending on the organization’s risk management policy. Overall, the rate of scanning should be marginally higher than the rate of remediation, which is imperative, because the process includes validation scans, emergency scans, ad hoc scans, reruns, and I&O teams’ service-level agreements (SLAs), etc.
The remediation cycle is often tightly bound to scanning frequency; however, little analysis of resources is done before narrowing down scanning schedules. The below steps can help organizations achieve better scanning and remediation cycles:
- Designate ownership and promote collaboration among vulnerability and I&O teams to close the vulnerability detection, remediation loop. Conduct review meetings with other business units in the organization to check the status of active vulnerabilities and provide guidance to the team in case of roadblocks, always emphasizing timely closure.
- Don’t treat all IT assets the same. Where possible, segregate environments based on criticality and compliance or at a minimum have vulnerability management policies that account for the difference.
- Reduce remediation exhaustion by leveraging automated patch management solutions and the vulnerability scanning tool’s built-in integration with patch management solutions.
- Create remediation run books to assist team members to take corrective action promptly and with little or no effort.
Prioritize Vulnerability Remediation
Organizations should use a mix of internal and external intelligence sources to prioritize vulnerabilities. These should be correlated with internal sources, such as business criticality, security posture, risk registers, change management systems, CMDBs, Pen Test data, network accessibility and data from network controls. The idea is to use multiple factors and still focus on business context.
SRM leaders should prefer vulnerability assessment solutions that have vulnerability prioritization capabilities or look to supplement them with solutions that can help with more-effective vulnerability prioritization. At the beginning of the prioritization phase, security leaders are painfully aware of the constraints on both time and resources at hand. It gets tedious and error-prone with the volume of data flowing in, and Excel tabs building up. Pragmatic prioritization will help organizations achieve maximum coverage with optimal effort.
Manage Exceptions
Patching and remediation go hand in hand to an extent that, when we first think of fixing a vulnerability, we think of its patch. Adding diverse security layers to your environment will help in the early identification of vulnerabilities and will also aid prioritization. Using these principles, organizations can design and deploy mitigating controls to handle vulnerability exceptions. Application control is a good way to start. Some exceptions can also be handled by making configuration changes to your tools, such as firewalls, intrusion detection prevention system (IDPSs) and host intrusion prevention systems (HIPSs). Another good compensating control is web application firewalls (WAFs), because many vendors provide virtual patching features, which can act as a first-level response to a threat. Network segmentation or isolation can be used to save systems that cannot be remediated from exploitation and to contain the spread.
Implement Actionable Metrics
Metrics are an important, yet often neglected, part of a vulnerability management program. This is because it’s hard. The right metrics help in making better decisions, because they can justify and quantify your actions, decisions and resource utilization. When meaningful and quantitative, metrics help you find your program shortcomings. Focus on operational and executive metrics that measure performance, prompt actions, and convey the value delivered by the vulnerability management capability.
Kanoo Elite, with its years of experience in providing Vulnerability Management Frameworks and assisting organizations to secure their environments, we are the industry leader to help you formally define your vulnerability management program to better anticipate and manage vulnerabilities facing your organization. Collectively, with our integrated capabilities, we help your Information Security functions prioritize controls that address actual vulnerabilities, detect incidents faster, and make vulnerability intelligence more actionable to your organization. Our vulnerability management solutions also inform a range of security activities such as strategic planning, employee awareness, and board reporting.
