BeyondTrust

Security In Context

Bringing you news and commentary on solutions and strategies for protecting your critical IT infrastructure.

Prioritizing Vulnerability Assessment and Remediation Steps: A New Users Guide to Getting Started – Part 2

Post by Morey Haber February 22, 2011

The odd part about writing weekly blogs is the amount of discussions that start internally, with clients directly, and sometimes through straight blog comments. After writing “A New Users Guide to Getting Started” article, my team indicated several really good ideas for a Part II follow-up blog. Simply, just getting started with vulnerability management is not enough. Assessing vulnerabilities, remediating them, and doing it again week-after-week, month-after-month, is not enough for good security practices. Taking that data and representing it in meaningful ways to security professionals and management is a fundamental component of assessment in a unified vulnerability management lifecycle.

To begin the second step in the process, I would like to demonstrate the value of historical trending and analytics using key reports to help prioritize effort. This would require a month or more of scan activities and could be used to validate historical efforts and help optimize allocation of resources moving forward.  First, look at the example below of a vulnerability summary report filtered by severity for critical vulnerabilities:

This highlights the vulnerability summary by severity month-over-month, the number of open critical vulnerabilities, their average age open (identified), and most importantly the average time in days that it took to remediate them (the vulnerability has been verified fixed). This same data can be plotted to illustrate that the internal processes for vulnerability management  are (or in this sample case, “are not”) working correctly:

A second example of how a new user needs to address vulnerability management problems is by showing the change in vulnerabilities month-after-month. This is shown below in a vulnerability delta report:

As you can see from this sample, a new program was implemented in July, but remediation efforts did not start until November. The peak number of vulnerabilities found in the organization occurred in December 2010 and only after refining the process and performing more remediation activities in January 2011, did the total number of vulnerabilities actually decrease. This data also highlights the ability to drill into monthly VA data to see which vulnerabilities have been added or removed.

Vulnerability management for the new user is not only about scanning for vulnerabilities and reporting them, it is also about establishing a repeatable and reliable process for assessing and remediation of vulnerabilities month-after-month. The business needs to measure the results from this process and these reports (from Retina Insight) enable more than just unified vulnerability management, they enable the business to prove a return on investment for mitigating the risk and manage compliance. All new users should consider how their new processes are actually working and being measured.

Tags:
, , ,

Leave a Reply

Additional articles

insider-threat-fed

Mitigating Inside Threats to U.S. Federal IT Environments

Recent high-profile cases have increased the perceived risks that go along with disclosure and usage of confidential information. One of the most difficult security threats to mitigate is an attack from the inside. When an over-privileged user, such as an unhappy current or former employee, contractor, or consultant, begins navigating your network, how will you…

Post by BeyondTrust Software April 17, 2014
Tags:
, , , , ,

Are you a Target? Investigating Security Breaches with Kevin Johnson

Last week, over 1,000 IT security professionals watched as Kevin Johnson, CEO of Secure Ideas, presented his expert opinion on lessons learned from recent, high-profile retail breaches. Here’s a summary of key takeaways from the webcast plus an on-demand recording of the full, 60-minute presentation. Understanding the “why” behind attacks According to Kevin, the primary…

Post by Chris Burd April 17, 2014
Tags:
, , , , ,

Vulnerability Expert Forum Highlights: April 2014

We had a great turnout for last week’s April 2014 Vulnerability Expert Forum (VEF) webcast. BeyondTrust Research experts, Carter and DJ, provided in-depth knowledge about the latest vulnerabilities and their potential impacts on network environments. Below are highlights from the Forum, plus an on-demand video of the presentation. Latest critical vulnerabilities, vendor patches, and zero-day…

Post by Chris Burd April 16, 2014
Tags:
, , , , ,