Vulnerability Management

What a vulnerability is

A comprehensive cyber security program is going to be actively looking for vulnerabilities within their infrastructure.

A vulnerability is a weakness. Here's an example where we have an asset, and there's some sort of threat and threat actor that wants to get to that asset, and we put up walls and some sort of security gate to guard this asset right here. Well, here we have some sort of break in our system, there's a weakness, so that's a vulnerability.

Data is an asset, and that data could be stored on a SQL database, so let's look at a SQL database as an example. SQL databases can be susceptible to SQL injection attacks, or they could be misconfigured, which would open it up for some sort of threat. We could have weak passwords on there, or we could have it overly accessible, our permissions are not set correctly. We could have poor encryption, and any kind of resource like this could be open for some sort of denial of service attack. So these are the vulnerabilities, just a few examples of the vulnerabilities of a SQL Server.

Vulnerability management versus risk management

There may be some confusion between vulnerability management and risk management, so I just wanted to clear up what the difference is between the two. Vulnerability management is weaknesses in technology or the infrastructure, versus risk management is threats to a business. With vulnerability management, it's more technical in nature, so a SQL injection attack is an example of that. Versus risk management, it's all business threat, so an example of that could be a competitor launches a similar product which takes away some of the company's competitive advantage.

The life cycle of a vulnerability

Vulnerabilities have a life cycle. Let's say we have software that gets launched, but that software has a bug in it, which opens it up to some threats. So this is a vulnerability of that software. At this point in time we call this zero day, because the developers of the software have zero days to be able to combat this. They probably don't even know that this threat exists. At some point in time they're going to discover that this is an issue, and then it will be released, so now we have a common vulnerability and exposure. It goes on a list, or a database, as a vulnerability, and then a patch comes out for it, and that patch will then fix that issue in that software.

Here's a site that tracks and reports common vulnerabilities and exposure, and we can see that at the time of this recording there's 24,840 common vulnerabilities and exposures as part of this database. We could either download this list, or we could search the list for these different common vulnerabilities and exposures.

Identifying vulnerabilities

As part of vulnerability management, we want to identify what vulnerabilities we have on our network. We would do some sort of an analysis on the vulnerabilities we identified, we report them, we would remediate those, and verify that it's been fixed.

So how do we identify vulnerabilities within our network and infrastructure?

• Number one is that the applications, software and services that we utilize just self-report a lot of times these different vulnerabilities that they have. In fact, they come out with patches, so we can patch them.
• Another thing we could do is just vulnerability scans, do vulnerability scans within our network to ensure that there are no active vulnerabilities on our network.
• We can take a look at forums and feeds, for instance that site I just showed you.
• We can do some sort of pen testing, and have a third party come in and do pen testing, or do some internal pen testing to search out for those vulnerabilities.
• Perhaps we have some sort of disclosure program, where we entice people to come and test out our systems and look for vulnerabilities, and perhaps we have some sort of recognition for that, like we give them a reward, maybe it's a gift card or some sort of monetary reward for finding vulnerabilities on our network.

There is a lot of vulnerability scanning software that's out there. This is just a short list, just an example of a few that are out there, but there is a lot more that's out there, so it's recommended that you get some sort of vulnerability scanning software that can scan your network for vulnerabilities.

Risk levels and responses

The vulnerability scanning software would then categorize the vulnerabilities into some sort of risk levels, and then you as a company or organization would then decide what risk levels you would want to tackle, and possibly how long you have to tackle them. For instance, you probably would say, we want to tackle the critical and high levels right away and maybe we have 30 days to reply to that, versus the medium ones, maybe we have a 60-day window or a 90-day window. And the low levels here, maybe you don't necessarily need to address, or you look into them individually and decide whether you need to address it or not.

There's typically two different responses you do as an organization. Either you eliminate the issue — that is, whatever this vulnerability is, you go and fix the vulnerability, for instance maybe it's a patch that needs to be applied — or you go in and recategorize the vulnerability. For instance, let's say it's a medium category vulnerability, but then you decide that the risk level to the company is not actually medium, that it needs to be recategorized as low.

The final step in this process is really to verify that we have eliminated the vulnerability. However we discovered the vulnerability, we'd want to go through the same process to make sure.