WEBINAR Exterminate Your Bugs With Vulnerability Management Rick Holland, Principal Analyst Kelley Mak, Researcher June 11, 2015. Call in at 10:55 a.m. Eastern time

Image source: Flickr (https://www.flickr.com/)

Image source: Flickr (https://www.flickr.com/)

Agenda The struggle is real. The threat landscape doesn’t help. Re-evaluate vulnerability management. You need continuous monitoring. Exploring the vulnerability management market

All aboard the struggle bus

But compliance . . .

Too many vulnerabilities, not enough time

Get your priorities straight! Image source: YouTube (https://www.youtube.com/)

CVSS only? SMH Results from the study: 94% to 95% of vulnerability should be skipped. Patching high/medium with exploits in exploit kits (Metasploit) improves efforts by 62.81%. Patching high/medium with proof-of-concept exploits from white hats improves efforts by 19.64%. Patching just high/medium improves efforts by 3.2%.

Image source: National Vulnerability Database (https://nvd.nist.gov/)

We are supposed to be a unit Image source: Flickr (https://www.flickr.com/)

But what should we be worried about?

The age of the customer A 20-year business cycle in which the most successful enterprises will reinvent themselves to systematically understand and serve increasingly powerful customers

The age of the customer Source: October 10, 2013, “Competitive Strategy In The Age Of The Customer” Forrester report

Breach costs continue to rise 23% Increase in the total cost of a data breach $3.7 million Average total cost of a data breach Source: “2015 Cost of Data Breach Study: Global Analysis,” Ponemon Institute, May 2015

Targeted attacks outpace broad attacks Image source: CyberFactors (http://cyberfactors.com/)

There’s a bug in your pocket Employees work outside of the corporate at least a few times a month. 61% 43% 31% Source: Forrester’s Global Business Technographics® Telecommunications And Mobility Workforce Survey, 2015

Don’t let your cloud drift away Configuration management Governance

Hyperconnected IoT increases risks 1011101010011110101001100001011101 Thin g Thing 3 1 2

The vulnerability management life cycle

Traditional vulnerability scanning Tactical and little value Vulnerability counting Infrastructure focus Checkbox security Image source: Flickr (https://www.flickr.com/)

Discover What should I scan? How often? How about credentialed scans?

It’s all about the data! Do you know what your high-risk data (and assets) are? If you cannot triage based off data value, you will have a garbage-in/garbage-out scenario.

Data security and control framework Source: June 5, 2014, “The Future Of Data Security: A Zero Trust Approach” Forrester report

No more scanning in silos Complete picture Infrastructure Database Web application

Assess How do I make sense of this information? How do I prioritize? How does this relate to my organization?

Forrester’s Prioritized Patching Process (P3) Source: November 11, 2013, “Introducing Forrester’s Prioritized Patching Process (P3)” Forrester report

Report How do I communicate these results? How do I work with my counterparts in the organization?

Reduce the friction Communication Automated workflow Ticketing systems Validation scanning Collaboration tools

Image source: Flickr (https://www.flickr.com/)

Remediate What are the target metrics for remediation? What constitutes a successful VM program?

Track what matters You can’t manage what you don’t measure. Track effort required for the operation of the VM solution as well as operational remediation. During post incident after action reviews, reconcile the VM program policies associated with compromised assets. Base metrics upon priority of asset. Tie it back to the business.

Validate What’s next? Am I done?

Adopt continuous monitoring Don’t think of CM as a requirement for federal agencies. CM is real-time visibility into the risks of your company’s assets. Move beyond snapshot/periodic assessment of risk. Evaluate continuous monitoring options, whether passive or agent- based.

The scanner days are behind us . . . Vulnerability management market trends: Scanners are commoditized. Vendors are collapsing the scanning stack. To vulnerability management and beyond! Vulnerability management needs to address the new digital age.

Integration and orchestration Source: January 7, 2015, “Forrester’s Targeted-Attack Hierarchy Of Needs: Assess Your Core Capabilities” Forrester report

Attack path modeling These tools help S&R pros map network topology to understand vulnerable systems based on attack paths within the environment. Example vendors: Core Security, RedSeal Networks, and Skybox Security

Governance, risk, and compliance Integration with GRC platforms brings enriched business context, workflow, and risk analysis. Example vendors: RSA Archer, LogicManager, Modulo Security, and Rsam

Remediation automation Workflow tools help S&R and I&O pros communicate and close the loop on vulnerabilities. Example vendors: BMC Software and ServiceNow

Penetration testing Incorporate the results of penetration testing into your vulnerability management. Commercial products: Core Security (Core Impact), Immunity (Canvas), and Rapid7 (Metasploit) Consulting services: Digital Defense, NopSec, and Synack

Key criteria for evaluating VM Evaluation criteria Network device coverage Asset discovery and classification Vulnerability information Distributed scanning and scalability/flexibility Mobile/cloud scanning Application-level scanning Unified infrastructure with web application and database scanning Prioritization Deployment models Remediation and integrations Administration and reporting

Next steps: Optimize remediation Know your data. Identify and protect your toxic data. Implement data discovery and data classification. Understand the business. Know your adversary. Focus efforts on areas that deserve the most attention based on adversary intelligence. Look at managed services. Managed services can lift the burden off of security operations. Leverage managed services for IT operations if a relationship is already there.

Rick Holland +1 469.221.5359 rholland@forrester.com Kelley Mak +1 212.857.0789 kmak@forrester.com