v1.1 1

Vulnerability Management for the Real World Contents: The Problem What is Vulnerability Management? Challenges to Effective VM Successful Approaches 2

The Problem 3

Organizations are Feeling the Pain 1. What causes the damage? 95% of breaches target known vulnerabilities 2. How do you prevent the damage? What are your options? RISK= Assets x Vulnerabilities x Threats You can control vulnerabilities. 4. How do you make the best security decisions? Focus on the right assets, right threats, right measures. 3. How do you successfully deal with vulnerabilities? Vulnerabilities Business complexity Human resources Financial resources

What is Vulnerability Management?

What Is Vulnerability Management (VM) A process to determine whether to eliminate, mitigate or tolerate vulnerabilities based upon risk and the cost associated with fixing the vulnerability. Methodologies Available for VM: Vulnerability Analysis (VA) Penetration Tests (PT) DAST (Dynamic Application Security Test) SAST (Static Application Security Test)

What Is Vulnerability Management At a high level, the ”intelligent confluence” of… Assessment What assets? Analysis What to fix first? Remediation Fix the problem + + As a component of Risk Management And balance the demands of business goals and processes

Difference between Vulnerability Assessment & Vulnerability Management Vulnerability Assessment: One time project with defined start and end date. External IS Consultant studies network, prepares report and assessment ends. The report will list identified vulnerabilities and provide actionable recommendations for remediation. Vulnerability Management: Ongoing/continuous process that aims at managing an organization’s vulnerabilities in a holistic manner. Assessment is continuously done in a cyclic/scheduled manner of critical assets & vulnerabilities identified are reported for further action.

Challenges to Effective VM

Challenges – Assessment Handling large networks Scan distribution is cumbersome Time consuming and resource intensive Compliance challenges

Challenges – Analysis Manual and resource intensive process to determine What to fix If you should fix When to fix Correlation between vulnerabilities, threats and assets A way to prioritize what vulnerabilities should be addressed What order Avoiding Stale data Making decisions on last quarter’s vulnerabilities Creating credible metrics

Challenges – Remediation Security resources are often decentralized The security organization often doesn’t own the network or system Multiple groups may own the asset Presenting useful and meaningful information to relevant stakeholders Determining if the fix was actually made

Asset Any equipment or device or end-point (identifiable using an IP) that has value to the organization or supports the ability of the organization to conduct business

Threat Any person, circumstance or event that has the potential to cause damage to an organizational asset or business function

Vulnerability Any flaw in the design, implementation or administration of a system that provides a mechanism for a threat to exploit the weakness of a system or process

Challenges – Time Threat Level Risk Threshold Asset Criticality Cost to ignore vulnerability is greater than the cost to repair Asset Criticality Risk Threshold Vulnerability discovered Exploit public Automated exploit Discovery Remediation

Challenges – Time Threat Level Risk Threshold Asset Criticality Goal = compress time from discovery to remediation Cost to ignore vulnerability is greater than the cost to repair Cost to ignore vulnerability is greater than the cost to repair Asset Criticality Risk Threshold Exploit public Automated exploit Vulnerability discovered Discovery Remediation

Challenges – Time Threat Level Risk Threshold Asset Criticality Goal = compress time from discovery to remediation Cost to ignore vulnerability is greater than the cost to repair Asset Criticality Risk Threshold x 15 new vulnerabilities per day across many assets Exploit public Automated exploit Vulnerability discovered Discovery Remediation

Vulnerability Management Lifecycle

Vulnerability Management Lifecycle

Successful Approaches: Implementing An Effective VM Strategy

Successful Approaches Focus on four key areas: Prioritize Assets Determine Risk Level (assets, threats, vulnerabilities) Remediate Vulnerabilities Measure

Prioritize Assets

Asset Prioritization Identify assets by: Networks Network Devices Logical groupings of devices Connectivity - None, LAN, broadband, wireless Network Devices Wireless access points, routers, switches Operating System Windows, Unix Applications IIS, Apache, SQL Server Versions IIS 5.0, Apache 1.3.12, SQL Server V.7

Asset Prioritization Network-based discovery Agent-based discovery Known and “unknown” devices Determine network-based applications Excellent scalability Agent-based discovery In-depth review of the applications and patch levels Deployment disadvantages Network- and agent-based discovery techniques are optimal Agents - Cover what you already know in great detail Network - Identify rogue or new devices Frequency Continuous, daily, weekly Depends on the asset

Correlate Threats

Correlate Threats (with your critical assets) Not all threat and vulnerability data have equal priority Primary goal is to rapidly protect your most critical assets Identify threats Worms Exploits Wide-scale attacks New vulnerabilities Correlate with your most critical assets Result = Prioritization of vulnerabilities within your environment

Determine Risk Level

Risk Calculation The Union of: Based upon the criticality of VAT Vulnerabilities Assets Threats Based upon the criticality of VAT Focus your resources on the true risk

Remediation

Remediation / Resolution Perfection is unrealistic (zero vulnerabilities) Think credit card fraud – will the banks ever eliminate credit card fraud? You have limited resources to address issues The question becomes: Do I address or not? Factor in the business impact costs + remediation costs If the risk outweighs the cost – eliminate or mitigate the vulnerability!

Remediation / Resolution Apply the Pareto Principle – the 80/20 rule Focus on the vital few not the trivial many 80% of your risk can be eliminated by addressing 20% of the issues The Risk Union will show you the way Right assets Relevant threats Critical vulnerabilities Patch or Mitigate Impact on availability from a bad patch vs. the risk of not patching Patch or mitigate Recommendations: QA security patches 24 hours Determine if there are wide spread problems Implement defense-in-depth

Measure

Measure Nemasis OutLook: Distribute Accountability (based on Asset, Asset-owner, Group) A universal standard to quantify risk (CVSS) Dashboard view of risk and vulnerabilities Nemasis will help answer the questions: Am I secure? Who is accountable and by when? Am I getting better or worse? How am I trending over time?

Summary All assets are not created equally You cannot respond to or even protect against all threats An effective vulnerability management program focuses on Risk Vulnerabilities Assets Threats The hardest step in a 1000 mile journey is the first – start somewhere Strategically manage vulnerabilities using a comprehensive process

10 Steps to Effective Vulnerability Management Identify all the assets in your purview Create an Asset Criticality Profile (ACP) Determine exposures and vulnerabilities Track relevant threats – realized and unrealized Determine Risk - union of vulnerabilities x assets x threats Take corrective action if risk > cost to eliminate or mitigate Create meaningful metrics Identify and address compliance gaps Implement an automated vulnerability management system Convince customer that vulnerability management is important

Protect The Right Assets With The Right Measures From The Right Threats With The Right Measures

Introducing Nemasis – Comprehensive Vulnerability Management Suite ‘Nemasis’ is a Vulnerability Management Suite which assists in implementing a comprehensive GRC (Governance, Risk Management, and Compliance) strategy for managing an organization's overall governance, risk, and compliance with regulations. ‘Nemasis’ offers various advantages like eliminating redundant costs, performing in-depth vulnerability scan, optimizing investments on assets by eliminating vulnerabilities and optimizing their performance, securing business reputation, asset discovery, and more. Contact sales@nemasisva.com for more information. Web: www.nemasisva.com