Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Prioritizing Vulnerability Assessment and Remediation Steps: A New Users Guide to Getting Started – Part 1

Posted January 31, 2011    Morey Haber

New users to vulnerability assessment often ask the same question: “How do I get started”? While this may sound incredibly generic for a security engineer, many companies have never had a vulnerability management process in place and are trying to comprehend the problems of missing patches, remediation prioritization, and risk acceptance. As a basic recommendation, I put together these three examples for a conservative vulnerability assessment rollout that should help anyone with the potential challenges of a new process. The methodology takes into consideration the sensitivity of vulnerability information and the cautiousness of performing network scans on targets that may be susceptible to faults.

The examples in this blog outline three approaches to a deployment that can be cross implemented to discover the health of the environment in phases.

Example One – Critical Vulnerabilities Only

eEye Digital Security’s Retina Solution allows for the customization of scanning by Smart Groups and Report Templates. By managing Smart Groups and Templates, scan targets can be limited to testing of only critical vulnerabilities that can adversely affect the environment. This will reveal areas where sensitive data and system compromises could negatively affect the infrastructure.  This essentially looks for the “low hanging fruit” of critical vulnerabilities that should be remediated first.

Figure 1, Audit Groups Sorted by High Severity

This approach has several advantages over full audit scanning:

  • Vulnerabilities that could be exploited with little to no user intervention will be accurately identified
  • The volume of potential compliance data and information messages will be reduced
  • Business units and security teams can focus on the highest priority items that could interrupt normal business operations

This approach allows for targeted scanning of devices with only the highest severity items to identify:

  • How well patch management processes are functioning to meet regulatory requirements
  • Which devices with sensitive data can be comprised with minimal to no intervention
  • Devices that contain severe vulnerabilities and are potentially end of life can be identified for replacement

This approach has a few disadvantages:

  • Low severity compliance related audits will be missed
  • Basic audits for usernames, groups, rogue services and process will not be identified
  • Web application and database based vulnerabilities may be excluded

Example Two – Statistical Sampling

Many regulatory compliance initiatives including the PCI DSS allow for statistical sampling of assets to perform an effective vulnerability management strategy. In order for this approach to be successful, a sample of all types of devices must be represented in a group of approximately 10% of the environment. In addition, proof of image standardization for hosts like desktops is required to validate the statistical sampling approach.  Deviations in the standard build are not acceptable and must be locked down.

Please consider the following:

  • All operating systems in the environment
  • All applications in the infrastructure
  • All hardware and network devices and printers
  • The scope of the devices in the assessment sample

All of the devices type above must be included in the target group. No version or platform can be excluded. The sample can be scanned with all audits or targeted vulnerabilities to report on the trends within the environment.

Figure 2, Sample Set of Scanned Assets for Statistical Sampling, Desktops Only

Statistical Sampling has several advantages:

  • Limited targets and risk to production devices
  • Validation of compliance management initiatives and image standardization
  • Rapid scan times compared to evaluating the entire infrastructure
  • Consolidated reports based on samples

In contrast, the disadvantages to this approach:

  • No rogue asset identification
  • Bottom “n” vulnerabilities and “one offs” are not identified, but are still susceptible to an attack
  • If deviations do occur in the images, they will be missed and invalidate the premise for this type of assessment

Example Three – Targeted Scanning Based On Business Function

Many devices in an environment provide supporting functions to a business, but have no direct connectivity to critical information. Consider a web application. Only the web server and supporting infrastructure should have access to any middleware and databases. A web application vulnerability assessment scan will reveal any flaws and any users can only penetrate the target through this single entry point. Therefore, assessing every workstation that only interfaces with critical data via the web is overkill. A better approach follows the “where is the gold approach”.  The business must identify where all of the critical business systems are and group them accordingly. Scans of these devices will target all possible entry points and should only occur during a predefined and acceptable scan window.

This approach informs all parties that a network scan is going to occur (in case of a fault or outage) and that all critical systems are free from high rated risks.

Figure 3. Hosts Grouped by Domain and Displayed in a Topology View

Advantages to this approach:

  • Scans occur only at acceptable times
  • Systems housing sensitive data (in scope) are validated to be risk free

Disadvantages for targeted scanning:

  • Non critical systems are not assessed and could be used as a beach head to infiltrate an organization
  • The manual process of identifying hosts may lead to missing systems for targeted scans
  • No rogue asset detection

The examples in this blog  can be cross implemented to discover the health  and vulnerability status of the environment in phases and ensure that the information collected is actionable and manageable for any organization beginning a new vulnerability management process.

eEye Professional Services are available to assess the risk and compliance objectives with any of these processes, and can provide a phased rollout approach to meet your business requirements. Based on our experience with clients of a similar size, and the overall security and business goals of your organization, eEye is confident that our solutions and services can meet your needs.

>> To learn more about what the new Retina CS can do for you, please visit us

>> If you are interested in upgrading to the new Retina CS, please contact your sales rep or email us at

, , ,

Leave a Reply

Additional articles


6 things I like about Gartner’s Cyber Resiliency Strategy

Posted August 27, 2015    Nigel Hedges

There were 6 key principles, or recommendations, that Gartner suggested were important drivers towards a great cyber resiliency posture. I commented more than once during the conference that many of these things were not new. They are all important recommendations that are best when placed together and given to senior management and the board – a critical element of organisations that desperately need to “get it”.


Why Customers Choose PowerBroker: Flexible Deployment Options

Posted August 26, 2015    Scott Lang

BeyondTrust commissioned a study of our customer base in early 2015 to determine how we are different from other alternatives in the market. What we learned was that there were six key differentiators that separate BeyondTrust from other solution providers in the market. We call it the PowerBroker difference,

, ,

On Demand Webinar: Security Risk of Mac OS X in the Enterprise

Posted August 20, 2015    BeyondTrust Software

In the last several years, Mac administrators have come to realize that they may be just as vulnerable to exploits and malware as most other operating systems. New malware and adware is released all the time, and there have been serious vulnerabilities patched by Apple in the past several years, some of which may afford attackers full control of your systems.

, ,