4 Analyst Perspective

5 Executive Summary

6 Common Obstacles

8 Risk-based approach to vulnerability management

16 Step 1.1: Vulnerability management defined

24 Step 1.2: Defining scope and roles

34 Step 1.3: Cloud considerations for vulnerability management

33 Step 1.4: Vulnerability detection

46 Step 2.1: Triage vulnerabilities

51 Step 2.2: Determine high-level business criticality

56 Step 2.3: Consider current security posture

61 Step 2.4: Risk assessment of vulnerabilities

71 Step 3.1: Assessing remediation options

80 Step 3.2: Scheduling and executing remediation

85 Step 3.3: Continuous improvement

89 Step 4.1: Metrics, KPIs, and CSFs

94 Step 4.2: Vulnerability management policy

97 Step 4.3: Select & implement a scanning tool

107 Step 4.4: Penetration testing

118 Summary of accomplishment

119 Additional Support

120 Bibliography

Vulnerability scanners, industry alerts, and penetration tests are revealing more and more vulnerabilities, and it is unclear how to manage them.

Organizations are struggling to prioritize the vulnerabilities for remediation, as there are many factors to consider, including the threat of the vulnerability and the potential remediation option.

Patches are often seen as the answer to vulnerabilities, but these are not always the most suitable solution.

Some systems deemed vulnerable simply cannot be patched or easily replaced.

Companies are unaware of the risk implications that come from leaving the vulnerability open and from the remediation option itself.

Design and implement a vulnerability management program that identifies, prioritizes, and remediates vulnerabilities.

Understand what needs to be considered when implementing remediation options, including patches, configuration changes, and defense-in-depth controls.

Build a process that is easy to understand and allows vulnerabilities to be remediated proactively, instead of in an ad hoc fashion.

• The value of vulnerability management is not well articulated in many organizations. As a result, investment in vulnerability scanning technology is often insufficient.
• Many organizations feel that a “patch everything” approach is the most effective path.
• Vulnerability management is commonly misunderstood as being a process that only supports patch management.
• There is often misalignment between SecOps and ITOps in remediation action and priority, affecting the timeliness of remediation.

Vulnerability Management

Reduce the risk surface to avoid cost to your business, everything else is table stakes

1

Identify

• scanning tool
• external threat intel
• internal threat intel

2

Analyze

Triage based on risk ›

Your organization's risk tolerance threshold

3

Assess

• risk tolerance
• compensating controls
• business impact

Key deliverable:

The Standard operating procedure (SOP) will comprise the end-to-end description of the program: roles & responsibilities, data flow, and expected outcomes of the program.

Template for your vulnerability management policy.

This tool offers a template to track vulnerabilities and how they are remedied.

Request for proposal template for the selection of a vulnerability scanning tool.

Methodology to assess vulnerability risk by determining impact and likelihood.

IT Benefits

• A standardized, consistent methodology to assess, prioritize, and remediate vulnerabilities.
• A risk-based approach that aligns with what’s important to the business.
• A way of dealing with the high volumes of vulnerabilities that your scanning tool is reporting.
• Identification of “where to start” in terms of vulnerability management.
• Ability to not lose yourself in the patch madness but rather take a sound approach to scheduling and prioritizing patches and updates.
• Knowledge of what to do when patching is simply not possible or feasible.

Business Benefits

• Alignment with IT in ensuring that business processes are only interrupted when absolutely necessary while maintaining a regular cadence of vulnerability remediation.
• A consistent program that the business can plan around and predict when interruptions will occur.
• IT’s new approach being integrated with existing IT operations processes, offering the most efficient yet expedient method of dealing with vulnerabilities.

Define the process, scope, roles, vulnerability sources, and current state
• Consultant at $100 an hour for 16 hours = $1,600

Establish triaging and vulnerability evaluation process
• Consultant at $100 an hour for 16 hours = $1,600
Determine high-level business criticality and data classifications
• Consultant at $100 an hour for 40 hours = $4,000
Assign urgencies to vulnerabilities
• Consultant at $100 an hour for 8 hours = $800

Prepare documentation for the vulnerability process
• Consultant at $100 an hour for 8 hours = $800
Establish defense-in-depth modelling
• Consultant at $100 an hour for 24 hours = $2,400
Identify remediation options and establish criteria for use
• Consultant at $100 an hour for 40 hours = $4,000
Formalize backup and testing procedures, including exceptions
• Consultant at $100 an hour for 8 hours = $800
Remediate vulnerabilities and verify
• Consultant at $100 an hour for 24 hours = $2,400

Establish a metrics program for vulnerability management
• Consultant at $100 an hour for 16 hours = $1,600
Update vulnerability management policy
• Consultant at $100 an hour for 8 hours = $800
Develop a vulnerability scanning tool RFP
• Consultant at $100 an hour for 40 hours = $4,000
Develop a penetration test RFP
• Consultant at $100 an hour for 40 hours = $4,000

Phase 1

Phase 2

Phase 3

Phase 4

Call #2: Discuss current state and vulnerability sources.

Call #4:Review current defense-in-depth and discuss risk assessment.

Call #6: Review release and change management and continuous improvement.

Call #8: Review vulnerability management policy.

Identify vulnerability sources

1.1 What is vulnerability management?

1.2 Define scope and roles

1.3 Cloud considerations for vulnerability management

1.4 Vulnerability detection

Triage and prioritize

2.1 Triage vulnerabilities

2.2 Determine high-level business criticality

2.3 Consider current security posture

2.4 Risk assessment of vulnerabilities

Remediate vulnerabilities

3.1 Assess remediation options

3.2 Schedule and execute remediation

3.3 Drive continuous improvement

Measure and formalize

4.1 Metrics, KPIs & CSFs

4.2 Vulnerability Management Policy

4.3 Select & implement a scanning tool

4.4 Penetration testing

Next Steps and Wrap-Up (offsite)

5.1 Complete in-progress deliverables from previous four days

5.2 Set up review time for workshop deliverables and to discuss next steps

1. Scope and boundary definition of vulnerability management program
2. Responsibility assignment for vulnerability identification and remediation
3. Monitoring and review process of third-party vulnerability sources
4. Incident management and vulnerability convergence

1. Methodology for evaluating identified vulnerabilities
2. Identification of high-level business criticality
3. Defined high-level data classifications
4. Documented defense-in-depth controls
5. Risk assessment criteria for impact and likelihood

1. Documented risk assessment methodology and remediation options

1. Defined metrics, key performance indicators (KPIs), and critical success factors (CSFs)
2. Initial draft of vulnerability management policy
3. Scanning tool selection criteria
4. Introduction to penetration testing

1. Completed vulnerability management standard operating procedure
2. Defined vulnerability management risk assessment criteria
3. Vulnerability management policy draft

Phase 1

1.1 What is vulnerability management?
1.2 Define scope and roles
1.3 Cloud considerations for vulnerability management
1.4 Vulnerability detection

Phase 2

2.1 Triage vulnerabilities
2.2 Determine high-level business criticality
2.3 Consider current security posture
2.4 Risk assessment of vulnerabilities

Phase 3

3.1 Assessing remediation options
3.2 Scheduling and executing remediation
3.3 Continuous improvement

Phase 4

4.1 Metrics, KPIs & CSFs
4.2 Vulnerability management policy
4.3 Select and implement a scanning tool
4.4 Penetration testing

• Vulnerability management is the regular and ongoing practice of scanning an operating environment to uncover vulnerabilities. These vulnerabilities can be outdated applications, unpatched operating systems and software, open ports, obsolete hardware, or any combination of these.
• The scanning and detection of vulnerabilities is the first step. Planning and executing of remediation is next, along with the approach, prioritized sequence of events, and timing.
• A vendor-supplied software patch or firmware update is often the easy answer, however, this is not always a viable solution. What if you can’t patch in a timely fashion? What if patching is not possible as it will break the application and bring down operations? What if no patch exists due to the age of the application or operating platform?

“Most organizations do not have a formal process for vulnerability management.” (Morey Haber, VP of Technology, BeyondTrust, 2016)

• Effective vulnerability management requires a formal process for organizations to follow; without one, vulnerabilities are dealt with in an ad hoc fashion.
• Patching isn’t the only solution, but it’s the one that often draws focus.
• Responsibilities for the different aspects of vulnerability management are often unclear, such as for testing, remediation, and implementation.
• Identifying new threats without proper vulnerability scanning tools can be a near-impossible task.
• Determining which vulnerabilities are most urgent can be an inconsistent process, increasing the organizational risk.
• Measuring the effectiveness of your vulnerability remediation activities can help you better manage resources in SecOps and ITOps. Your staff will be spending the appropriate effort on vulnerabilities that warrant that level of attention.

You’re not just doing this for yourself. It’s also for your auditors.

Many compliance and regulatory obligations require organizations to have thorough documentation of their vulnerability management practices.