Today’s digital workplaces are constantly changing, transforming and becoming increasingly difficult to secure. In 2020 alone, 17002 known vulnerabilities were identified and published with an average severity rating of 7.1 out of 10. At the same time, cybersecurity threats continue to increase, with global attacks increasing by almost 30% in the third quarter of 2022 compared to the same period in 2021. With these constant rates of change, discovering and proactively addressing vulnerabilities within an organization before they are utilized for a cyberattack becomes an integral part of securing a business.
Vulnerability management is identifying, prioritizing and resolving vulnerabilities in systems and software that runs on them. Security vulnerabilities refer to technological weaknesses that could allow attackers to compromise a product and the information it holds. They can often be remedied with patching or proper configuration of security settings. To minimize the attack surface, vulnerability management needs to be implemented with other security tactics to keep up with changes to networks and systems over time.
Vulnerability management consists of 5 main steps:
The first step in vulnerability management is identifying vulnerabilities. This can be done with a vulnerability scan that identifies network systems, such as devices, servers, firewalls, switches, and databases. These systems are analyzed for different attributes, including their OS, open ports, installed software, accounts, file system structure, configurations and more. Using this information, the vulnerability scan can associate publicly known vulnerabilities to the scanned systems.
Vulnerability scans can disrupt everyday workflows, so they should be scheduled and managed accordingly. Some systems on a network may become unstable or erratic while scanned and may need to be excluded or fine-tuned to be less disruptive. A security-managed service provider can provide adaptive scanning to automate and streamline vulnerability scans when changes are made on a network. Whenever a new system connects to a network for the first time, an automated vulnerability scan can scan the system as soon as possible rather than waiting weeks or months to scan the network.
The next step in vulnerability management is evaluating and prioritizing vulnerabilities so that the risks they pose are appropriately dealt with according to the company’s risk management strategy. Several factors must be considered when evaluating the threat posed by vulnerabilities. Companies can build their own definitions for vulnerabilities, but many pre-existing standards are created to categorize and define vulnerabilities. For example, the security content automation protocol (SCAP) developed by the National Institute of Standards and Technology (NIST) includes a Common vulnerability scoring system (CVSS). This scoring system assigns severity scores to each defined vulnerability and prioritizes remediation efforts and resources according to the threat. Scores range from 0 to 10, with ten being the most severe. Companies can use the CVSS scoring system to evaluate the severity of vulnerabilities and prioritize dealing with them accordingly.
After evaluating and prioritizing vulnerabilities, the next step is to resolve them. Vulnerabilities can be treated in several ways, including remediation, mitigation, or acceptance. Remediation means fully fixing or patching a vulnerability so it cannot be exploited. This is typically the best-case scenario for organizations. Mitigation is lessening the impact that the vulnerability would have from being exploited. Mitigation may be the best option for organizations if a configuration or patch has not yet been made available to treat an identified vulnerability. Lastly, acceptance would be taking no action to fix or reduce the likelihood a vulnerability would be exploited. Acceptance may be justified when a vulnerability is considered low-risk or the cost of repairing a vulnerability is significantly greater than the cost incurred if the vulnerability were exploited. Once actions have been taken to resolve vulnerabilities, another vulnerability scan should be completed to confirm that issues have been resolved.
Finally, the IT team and executives all need to understand the state of risk around vulnerabilities after they have been resolved. Performing regular vulnerability assessments allows organizations to understand their vulnerability management over time better. IT teams need tactical reporting on vulnerabilities identified and remediated so that they can track compare scans. This will allow the team to understand the best future remediation techniques for similar vulnerabilities quickly. Executives and higher-level roles would need a higher-level report on the current vulnerabilities and risk scores across parts of the business. Reporting can also support compliance and regulatory requirements.
The last step in the vulnerability management steps is to reassess and improve for the future. As vulnerability management is a continuous process and not just a one-time scan, organizations must continually assess and reassess the state of their software and services. After identifying, prioritizing, remediating and reporting on vulnerabilities, businesses must look towards the issues that may have led to the vulnerabilities in the first place and make changes to prevent them in the future. This will allow weaknesses to be discovered more quickly, preventing future vulnerabilities from being overlooked.
Vulnerabilities are constantly being identified and exploited, and the potential damage of a cybersecurity attack can be devastating to companies not only financially but also to customer trust and brand reputation. An effective vulnerability management solution can significantly reduce the threat of a breach on an ongoing basis.
