Vulnerability Management

Comprehensive Guide to Vulnerability Management

Over the years, vulnerability management has evolved from an elite cybersecurity measure into a standard part of protecting IT. Once rare outside the largest companies and biggest security teams, vulnerability management is now common anywhere and everywhere.

Why? Because of technology sprawl adding complexity, challenges, and risks. Businesses rely on ever-increasing amounts of information technology and digital data for just about everything—and that’s true for businesses of any size in any industry. Yet, with more technology comes more opportunities for cyber attackers to find and exploit vulnerabilities.

Cyber attacks have become more frequent and costly in recent years, targeting small and mid-sized businesses just as often as major corporations. They’re now considered the single biggest risk facing today’s businesses. Avoiding these attacks must be a priority for everyone, and this starts by managing the vulnerabilities that enable these attacks in the first place.

Without vulnerability management, the attackers have the advantage.

In This Guide

• What is Vulnerability Management?
• What is Vulnerability Scanning?
• What is Vulnerability Management as a Service (VMaaS)?
• What to Look for in a VMaaS Provider?
• How should my business approach vulnerability management?
• What tools are commonly used for VM
• What’s a Vulnerability Assessment?
• What is the NIST Vulnerability Management Lifecycle?
• How does ISO 27001 address Vulnerability Management?
• Vulnerability Management vs Penetration Testing?
• Best Practices for VM
• Conclusion – Solving Vulnerability Management

What is Vulnerability Management?

Vulnerabilities are software code or architecture weaknesses that attackers could exploit to launch attacks on systems and data. Vulnerability management is the process of finding, understanding, and resolving those vulnerabilities before security threats find them. By fixing those vulnerabilities, companies eliminate opportunities for cyber attacks, causing both known and unknown attacks to fail at the perimeter when they can’t find the vulnerabilities they planned to exploit.

Vulnerability management has tremendous value for cybersecurity since it prevents attacks before they cause damage rather than responding to them after the damage occurs. But that comes at a price: vulnerability management must be a continual effort to find issues and errors soon after they appear, and it must be applied across the entire attack surface and IT infrastructure, which are constantly expanding. As such, vulnerability management takes significant amounts of time, energy, and expertise.

What is Vulnerability Scanning?

Vulnerabilities are like the proverbial needle in the haystack. Finding them isn’t possible by any manual process. Instead, teams rely on vulnerability scanning to provide the speed and scale they need to pinpoint tiny anomalies in massive (and growing) IT infrastructure.

It works by scanning networks, software, and other assets and comparing the results to a lengthy list of known vulnerabilities, exploits, and weak points. The security team gets flagged anytime the scans find a flaw, at which point the remediation process starts.

Finding the maximum number of vulnerabilities through scanning depends on two factors. First, scanning the entire IT infrastructure, including all new assets or shadow IT, on a consistent or continual basis. Second, maintaining a complete and up-to-date list of all known vulnerabilities, including any that have emerged since the last scan.

Companies that do not have the time or tools for vulnerability scanning or that may need some help ranking and remediating those vulnerabilities should consider enlisting a VMaaS provider rather than trying to manage everything in-house.

What is Vulnerability Management as a Service (VMaaS)?

Mitigation and remediation of vulnerabilities is a universal requirement—one that almost everyone struggles with. Service providers have stepped in to help.

Vulnerability management as a service (VMaaS) outsources responsibility for finding and fixing vulnerabilities to a provider with the time, team, and tools to handle it effectively as well as assessing risk. Some providers find and prioritize vulnerabilities for clients to fix, while others extend their service to help remediate vulnerabilities. In either case, the provider handles much of what makes vulnerability management difficult, thereby ensuring that clients “get it right” while also freeing up time and energy they can apply elsewhere.

What to Look for in a VMaaS Provider?

VMaaS providers serve as vital cybersecurity partners, helping companies both stop more attacks and take the pressure off their security teams. Look for these qualities in any potential provider:

• Scope: Vulnerabilities can exist in networks, clouds, databases, and more. Choose a provider that offers comprehensive vulnerability management across the entire IT infrastructure.
• Risk Assessment: Defenders must know what vulnerabilities are most likely and most destructive. Look for providers that can accurately assess the risk of each vulnerability.
• Automation: Automation minimizes the time between the discovery and remediation of vulnerabilities. Consider how much a provider automates the VM process from beginning to end.
• Reporting: Vulnerability management over the long-term takes visibility and tracking. Look for providers who deliver detailed reports and dashboards to keep clients always aware.
• Compliance: An increasing number of regulations require vulnerability management in some form, as do many business contracts. Find a provider that can help with specific compliance requirements.

How should my business approach vulnerability management?

As practically as possible. Ask these questions upfront:

• How much could you lose in a cyber attack?
• How many vulnerabilities are out there?
• How much risk do your vulnerabilities create?
• How do these risks affect the business?
• How many resources do you have for VM?

The best approach comes down to a simple equation: if the risk of vulnerabilities exceeds the ability to manage it—comprehensively, continually, at scale—look outside the business for assistance with vulnerability scans and management. Otherwise, the risk will only keep rising.

What tools are commonly used for VM

These tools typically fall into two categories. Vulnerability scanners will locate vulnerabilities. Vulnerability managers do the same but have extra tools to prioritize findings based on risk, generate remediation instructions, and/or integrate with other security tools to automate response. While some tools search for vulnerabilities across most or all the IT infrastructure, others focus on specific assets:

• Applications: These tools find application vulnerabilities such as SQL injections, buffer overflows, cross-site scripting, and others.
• Networks: These tools search network assets like servers and hosts for vulnerabilities like weak passwords, misconfigurations, and outdated firmware.
• Databases: These tools look into database management systems for known weaknesses and misconfigurations that could compromise data security.
• Endpoints: These tools analyze if laptops, mobile devices and other endpoints are missing patches, running outdated software, or showing other vulnerabilities.

What’s a Vulnerability Assessment?

A vulnerability assessment is a process of systematically searching for vulnerabilities within a system or product, and then analyzing each finding to assess the potential risk and required fix. Vulnerability assessments can happen once or continuously, but in either case they are only half the equation in vulnerability management.

A vulnerability assessment will find vulnerabilities, but it will not fix them, leaving them exposed to attack. Without the other half of the equation, remediation and mitigation of threats, vulnerability management does not reduce cyber risk nor make cybersecurity stronger—it uncovers flaws but leaves them untouched. Vulnerability assessments are valuable exercises and essential for building a stronger security posture, but they’re only part of the process, and they’re incomplete on their own.

What is the NIST Vulnerability Management Lifecycle?

The NIST produces widely followed best practices for cybersecurity, including the vulnerability management lifecycle, which breaks the process down into five distinct phases. The lifecycle—and all vulnerability management efforts—includes all these phases, in order, running continually:

• Discovery: Searching for new vulnerabilities in existing IT while searching new additions to the environment for any vulnerabilities.
• Prioritization: Choosing which vulnerabilities are the highest priority based on their likelihood to get exploited, resist remediation, cause material damage, and other factors.
• Resolution: Deciding whether to remediate the vulnerability by installing a patch, fixing a misconfiguration, or putting stronger access controls or incident response plans in place. Acceptance is also an option for vulnerabilities that pose minimal risk.
• Verification: Confirm that the resolution worked as planned and didn’t introduce any new vulnerabilities in the process.
• Improvement: Reporting on the performance of the latest lifecycle while identifying areas for improvement such as reducing mean time to detect (MTTD) mean time to respond (MTTR) and vulnerability reoccurrence rates.

Following the NIST vulnerability management lifecycle keeps the process running efficiently while ensuring it checks all the boxes.

How does ISO 27001 address Vulnerability Management?

Companies that want to demonstrate their commitment to cybersecurity will often voluntarily follow the cybersecurity standards outlined in ISO 27001, which experts agree are robust and comprehensive. The standards advocate for a risk-management approach based on identifying risk faster and focusing efforts on the highest risks. As such, vulnerability management plays an important role.

The ISO 27001 standards approach vulnerability management in much the same way as the NIST, separating it into five phases that follow one another to systematically address each vulnerability. However, those striving for ISO 27001 certification will want to follow a plan built around that specific goal rather than using the NIST vulnerability management lifecycle for guidance.

Vulnerability Management vs Penetration Testing?

What is the difference between vulnerability management and penetration testing? Very little.

Penetration testing, where automation, experts, or both systematically probe systems looking for weak points, plays an important role in vulnerability management, and any serious search for vulnerabilities will include penetration testing on some scale.

However, penetration testing alone isn’t enough to effectively manage vulnerabilities. There may be risks and exposures that fall outside the purview of penetration testing. More importantly, penetration testing, just like vulnerability assessments, does not resolve vulnerabilities but only locates them.

Best Practices for VM

Get better results from vulnerability management while pouring fewer resources into the process by following these best practices:

• Mandate Updates: Put a policy in place requiring software updates to be installed as soon as they’re released, and make provisions to quickly install patches as well.
• Be Continuous: Keep the hunt for vulnerabilities happening continuously by putting adequate resources in place, either in-house or through outsourcing.
• Identify Assets: Create an inventory of all IT, including shadow IT, to ensure that vulnerability management doesn’t overlook or exclude anything.
• Own Risks: Decide what not to remediate in the context of wider organizational risk, and designate someone to make that call and own the consequences.
• Prioritize Improvement: Treat vulnerability management as something the company can, should, and must improve on to stay secure, compliant, and competitive.

Conclusion – Solving Vulnerability Management

Vulnerability management can start to feel like a risk in its own right given how much time and attention it can consume, distracting teams from other obligations without reliably resolving every vulnerability. As a result, many companies try to manage vulnerabilities but most still suffer from dangerous and damaging exposures.

The exceptions are the companies that acknowledge their limitations in terms of vulnerability management and bring in partners who can make up the gaps, put an exceptional process in place, and run it continually. When you’re ready to explore the same strategy, contact ISOutsource.