Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Prioritizing Vulnerability Assessment and Remediation Steps: A New Users Guide to Getting Started – Part 1

Posted January 31, 2011    Morey Haber

New users to vulnerability assessment often ask the same question: “How do I get started”? While this may sound incredibly generic for a security engineer, many companies have never had a vulnerability management process in place and are trying to comprehend the problems of missing patches, remediation prioritization, and risk acceptance. As a basic recommendation, I put together these three examples for a conservative vulnerability assessment rollout that should help anyone with the potential challenges of a new process. The methodology takes into consideration the sensitivity of vulnerability information and the cautiousness of performing network scans on targets that may be susceptible to faults.

The examples in this blog outline three approaches to a deployment that can be cross implemented to discover the health of the environment in phases.

Example One – Critical Vulnerabilities Only

eEye Digital Security’s Retina Solution allows for the customization of scanning by Smart Groups and Report Templates. By managing Smart Groups and Templates, scan targets can be limited to testing of only critical vulnerabilities that can adversely affect the environment. This will reveal areas where sensitive data and system compromises could negatively affect the infrastructure.  This essentially looks for the “low hanging fruit” of critical vulnerabilities that should be remediated first.

Figure 1, Audit Groups Sorted by High Severity

This approach has several advantages over full audit scanning:

  • Vulnerabilities that could be exploited with little to no user intervention will be accurately identified
  • The volume of potential compliance data and information messages will be reduced
  • Business units and security teams can focus on the highest priority items that could interrupt normal business operations

This approach allows for targeted scanning of devices with only the highest severity items to identify:

  • How well patch management processes are functioning to meet regulatory requirements
  • Which devices with sensitive data can be comprised with minimal to no intervention
  • Devices that contain severe vulnerabilities and are potentially end of life can be identified for replacement

This approach has a few disadvantages:

  • Low severity compliance related audits will be missed
  • Basic audits for usernames, groups, rogue services and process will not be identified
  • Web application and database based vulnerabilities may be excluded

Example Two – Statistical Sampling

Many regulatory compliance initiatives including the PCI DSS allow for statistical sampling of assets to perform an effective vulnerability management strategy. In order for this approach to be successful, a sample of all types of devices must be represented in a group of approximately 10% of the environment. In addition, proof of image standardization for hosts like desktops is required to validate the statistical sampling approach.  Deviations in the standard build are not acceptable and must be locked down.

Please consider the following:

  • All operating systems in the environment
  • All applications in the infrastructure
  • All hardware and network devices and printers
  • The scope of the devices in the assessment sample

All of the devices type above must be included in the target group. No version or platform can be excluded. The sample can be scanned with all audits or targeted vulnerabilities to report on the trends within the environment.

Figure 2, Sample Set of Scanned Assets for Statistical Sampling, Desktops Only

Statistical Sampling has several advantages:

  • Limited targets and risk to production devices
  • Validation of compliance management initiatives and image standardization
  • Rapid scan times compared to evaluating the entire infrastructure
  • Consolidated reports based on samples

In contrast, the disadvantages to this approach:

  • No rogue asset identification
  • Bottom “n” vulnerabilities and “one offs” are not identified, but are still susceptible to an attack
  • If deviations do occur in the images, they will be missed and invalidate the premise for this type of assessment

Example Three – Targeted Scanning Based On Business Function

Many devices in an environment provide supporting functions to a business, but have no direct connectivity to critical information. Consider a web application. Only the web server and supporting infrastructure should have access to any middleware and databases. A web application vulnerability assessment scan will reveal any flaws and any users can only penetrate the target through this single entry point. Therefore, assessing every workstation that only interfaces with critical data via the web is overkill. A better approach follows the “where is the gold approach”.  The business must identify where all of the critical business systems are and group them accordingly. Scans of these devices will target all possible entry points and should only occur during a predefined and acceptable scan window.

This approach informs all parties that a network scan is going to occur (in case of a fault or outage) and that all critical systems are free from high rated risks.

Figure 3. Hosts Grouped by Domain and Displayed in a Topology View

Advantages to this approach:

  • Scans occur only at acceptable times
  • Systems housing sensitive data (in scope) are validated to be risk free

Disadvantages for targeted scanning:

  • Non critical systems are not assessed and could be used as a beach head to infiltrate an organization
  • The manual process of identifying hosts may lead to missing systems for targeted scans
  • No rogue asset detection

The examples in this blog  can be cross implemented to discover the health  and vulnerability status of the environment in phases and ensure that the information collected is actionable and manageable for any organization beginning a new vulnerability management process.

eEye Professional Services are available to assess the risk and compliance objectives with any of these processes, and can provide a phased rollout approach to meet your business requirements. Based on our experience with clients of a similar size, and the overall security and business goals of your organization, eEye is confident that our solutions and services can meet your needs.

>> To learn more about what the new Retina CS can do for you, please visit us

>> If you are interested in upgrading to the new Retina CS, please contact your sales rep or email us at

, , ,

Leave a Reply

Additional articles

Dark Reading

2014: The Year of Privilege Vulnerabilities

Posted December 18, 2014    Chris Burd

Of the 30 critical-rated Microsoft Security Bulletins this year, 24 involved vulnerabilities where the age-old best practice of “least privilege” could limit the impact of malware and raise the bar of difficulty for attackers.

, , , , ,

Looking back on information security in 2014

Posted December 16, 2014    Dave Shackleford

Dave Shackleford is a SANS Instructor and founder of Voodoo Security. Join Dave for a closer look at the year in security, and learn what you can do to prepare for 2015, with this upcoming webinar. 2014 has been one heck of an insane year for information security professionals. To start with, we’ve been forced…

, ,

December 2014 Patch Tuesday

Posted December 9, 2014    BeyondTrust Research Team

This month marks the final Patch Tuesday of 2014. Most of what is being patched this month includes Internet Explorer, Exchange, Office, etc… and continues a trend of the greatest hits collection of commonly attacked Microsoft software. Probably the one thing that broke the mold this month is that for once there is not some…