Security In Context

Bringing you news and commentary on solutions and strategies for protecting your critical IT infrastructure.

Prioritizing Vulnerability Assessment and Remediation Steps: A New Users Guide to Getting Started – Part 1

Post by Morey Haber January 31, 2011

New users to vulnerability assessment often ask the same question: “How do I get started”? While this may sound incredibly generic for a security engineer, many companies have never had a vulnerability management process in place and are trying to comprehend the problems of missing patches, remediation prioritization, and risk acceptance. As a basic recommendation, I put together these three examples for a conservative vulnerability assessment rollout that should help anyone with the potential challenges of a new process. The methodology takes into consideration the sensitivity of vulnerability information and the cautiousness of performing network scans on targets that may be susceptible to faults.

The examples in this blog outline three approaches to a deployment that can be cross implemented to discover the health of the environment in phases.

Example One – Critical Vulnerabilities Only

eEye Digital Security’s Retina Solution allows for the customization of scanning by Smart Groups and Report Templates. By managing Smart Groups and Templates, scan targets can be limited to testing of only critical vulnerabilities that can adversely affect the environment. This will reveal areas where sensitive data and system compromises could negatively affect the infrastructure.  This essentially looks for the “low hanging fruit” of critical vulnerabilities that should be remediated first.

Figure 1, Audit Groups Sorted by High Severity

This approach has several advantages over full audit scanning:

  • Vulnerabilities that could be exploited with little to no user intervention will be accurately identified
  • The volume of potential compliance data and information messages will be reduced
  • Business units and security teams can focus on the highest priority items that could interrupt normal business operations

This approach allows for targeted scanning of devices with only the highest severity items to identify:

  • How well patch management processes are functioning to meet regulatory requirements
  • Which devices with sensitive data can be comprised with minimal to no intervention
  • Devices that contain severe vulnerabilities and are potentially end of life can be identified for replacement

This approach has a few disadvantages:

  • Low severity compliance related audits will be missed
  • Basic audits for usernames, groups, rogue services and process will not be identified
  • Web application and database based vulnerabilities may be excluded

Example Two – Statistical Sampling

Many regulatory compliance initiatives including the PCI DSS allow for statistical sampling of assets to perform an effective vulnerability management strategy. In order for this approach to be successful, a sample of all types of devices must be represented in a group of approximately 10% of the environment. In addition, proof of image standardization for hosts like desktops is required to validate the statistical sampling approach.  Deviations in the standard build are not acceptable and must be locked down.

Please consider the following:

  • All operating systems in the environment
  • All applications in the infrastructure
  • All hardware and network devices and printers
  • The scope of the devices in the assessment sample

All of the devices type above must be included in the target group. No version or platform can be excluded. The sample can be scanned with all audits or targeted vulnerabilities to report on the trends within the environment.

Figure 2, Sample Set of Scanned Assets for Statistical Sampling, Desktops Only

Statistical Sampling has several advantages:

  • Limited targets and risk to production devices
  • Validation of compliance management initiatives and image standardization
  • Rapid scan times compared to evaluating the entire infrastructure
  • Consolidated reports based on samples

In contrast, the disadvantages to this approach:

  • No rogue asset identification
  • Bottom “n” vulnerabilities and “one offs” are not identified, but are still susceptible to an attack
  • If deviations do occur in the images, they will be missed and invalidate the premise for this type of assessment

Example Three – Targeted Scanning Based On Business Function

Many devices in an environment provide supporting functions to a business, but have no direct connectivity to critical information. Consider a web application. Only the web server and supporting infrastructure should have access to any middleware and databases. A web application vulnerability assessment scan will reveal any flaws and any users can only penetrate the target through this single entry point. Therefore, assessing every workstation that only interfaces with critical data via the web is overkill. A better approach follows the “where is the gold approach”.  The business must identify where all of the critical business systems are and group them accordingly. Scans of these devices will target all possible entry points and should only occur during a predefined and acceptable scan window.

This approach informs all parties that a network scan is going to occur (in case of a fault or outage) and that all critical systems are free from high rated risks.

Figure 3. Hosts Grouped by Domain and Displayed in a Topology View

Advantages to this approach:

  • Scans occur only at acceptable times
  • Systems housing sensitive data (in scope) are validated to be risk free

Disadvantages for targeted scanning:

  • Non critical systems are not assessed and could be used as a beach head to infiltrate an organization
  • The manual process of identifying hosts may lead to missing systems for targeted scans
  • No rogue asset detection

The examples in this blog  can be cross implemented to discover the health  and vulnerability status of the environment in phases and ensure that the information collected is actionable and manageable for any organization beginning a new vulnerability management process.

eEye Professional Services are available to assess the risk and compliance objectives with any of these processes, and can provide a phased rollout approach to meet your business requirements. Based on our experience with clients of a similar size, and the overall security and business goals of your organization, eEye is confident that our solutions and services can meet your needs.

>> To learn more about what the new Retina CS can do for you, please visit us

>> If you are interested in upgrading to the new Retina CS, please contact your sales rep or email us at

, , ,

Leave a Reply

Additional articles

Are you a Target? Investigating Security Breaches with Kevin Johnson

Last week, over 1,000 IT security professionals watched as Kevin Johnson, CEO of Secure Ideas, presented his expert opinion on lessons learned from recent, high-profile retail breaches. Here’s a summary of key takeaways from the webcast plus an on-demand recording of the full, 60-minute presentation. Understanding the “why” behind attacks According to Kevin, the primary…

Post by Chris Burd April 17, 2014
, , , , ,

Vulnerability Expert Forum Highlights: April 2014

We had a great turnout for last week’s April 2014 Vulnerability Expert Forum (VEF) webcast. BeyondTrust Research experts, Carter and DJ, provided in-depth knowledge about the latest vulnerabilities and their potential impacts on network environments. Below are highlights from the Forum, plus an on-demand video of the presentation. Latest critical vulnerabilities, vendor patches, and zero-day…

Post by Chris Burd April 16, 2014
, , , , ,

Understanding Who Has Access to What with BeyondInsight v5.1

Today, it’s my pleasure to introduce you to BeyondInsight version 5.1, the latest release of our IT Risk Management platform, which unifies several of our solutions for Privileged Account Management and Vulnerability Management. BeyondInsight v5.1 embodies BeyondTrust’s mission to give our customers the visibility they need to make smart decisions and reduce risk to their…

Post by Morey Haber April 15, 2014
, , , , , , , , , , , ,