Vulnerability and Configuration Management Best Practices for State and Local Governments Jonathan Trull, CISO, Qualys, Inc.

ATTACKS 80 % More than 80% of attacks target known vulnerabilities 79 % PATCHES 79% of vulnerabilities have patches available on day of disclosure Most Breaches Exploit Known Vulnerabilities 2

Threats vs. Vulnerabilities 3

Patch and Vulnerability Management A security practice designed to proactively prevent the exploitation of IT vulnerabilities that exist within an organization. The continuous process of identifying, classifying, remediating, and mitigating vulnerabilities. 4

Configuration Management The process of evaluating, coordinating, approving, disapproving, and implementing changes to systems and software. Security Perspective: The process of ensuring systems are configured to prevent successful cyber attacks and stay that way. 5

Major Constraints on Security Teams 6

Attack-Defend Cycle (OODA Loop) 7

Laws of Vulnerabilities Half-Life – time interval for reducing occurrence of a vulnerability by half. Prevalence – turnover rate of vulnerabilities in the “Top 20” list during a year. Persistence – total lifespan of vulnerabilities Exploitation – time interval between an exploit announcement and the first attack 8

Half-Life 29.5 Days 9

Prevalence 8 critical vulnerabilities retained a constant presence in the Top 20 10

Persistence Indefinite Stabilize at 5-10% 11

Exploitation Average: < 10 days Critical client vulnerabilities: < 48 hours –Exploit Kits offer money back guarantees / Next day delivery 12

Cyber Hygiene Campaign Multi-year effort that provides key recommendations for a low-cost security program that any organization can adopt to achieve immediate and effective defenses against cyber security attacks. 13

14 Pilot of scanning baselines completed Using Qualys, CIS provided a baseline network and app scan, for 12 States, at the following key agencies: o health o public safety o revenue Reports were sent to each State with the results and information to remediate; follow up discussions were available if needed Re-scans provided to remediate findings Feedback from the pilot states has helped to improve the process. CIS is ready to offer the same baseline scans to other governments, for further information, contact Kathleen Patentreger at

Cyber Hygiene Scans 15

Summary Results Network Based Vulnerabilities 16

Summary Results Application Based Vulnerabilities 17

Summary Results Types of Vulnerabilities 18

MS-ISAC Guidance The goal of your security team is to reduce risk by identifying and eliminating weaknesses in your network assets. To do this, there are a few questions you need to ask about your organization. 19

MS-ISAC Guidance 1.Do you maintain an asset inventory? Is it up to date? 2.Manage the flow of information -- what machines have access to critical information, how does that information get dispersed across your network? 3.Are your network assets classified? If not, assign them a position in a hierarchy. The systems at the top being the most critical. 4.Have you done a risk assessment on these systems? What level of risk is your organization okay with? 5.How often do you perform vulnerability assessments on these hosts? 6.How is the remediation of these hosts being tracked? How long does it take to remediate hosts on average? 7.If a host was compromised, how would you respond? 20

Case Studies State of New York University of Colorado State of Michigan State of Ohio Colorado Statewide Internet Portal Authority 21

The Great Divide 22

Vulnerability & Compliance Scanning Automated Remediation SecOps integration Vulnerability Information Matched vulnerabilities and patches SecOps Integration If then 23

Best Practices Vulnerability and configuration management should be an essential part of any security program Obtain executive level support –Identify and obtain an executive level champion –Build partnerships with other execs who need the same data –When selling security, keep it simple –Establish supporting written policies and procedures Communicate vertically and horizontally within your Organization –Essential to remove fear, uncertainty, and doubt 24

Best Practices Continued Scan everything and scan often –Scan anything connected to your network –Scan your perimeter daily and servers and endpoints weekly –Be prepared for zero days / use predictive analytics Use credentialed scanning Use metrics to drive risk reduction and program support Use tags to manage VM/CM processes / workflows –Use tags for business value, ownership, and compliance 25

Best Practices Continued Measure the security and ops teams’ performance by the half-life results & treatment of the persistence law –Include results in HR performance reviews Use metrics to communicate with senior management Integrate VM/CM solution with patch management systems, asset inventory systems, ticketing systems, configuration systems (Chef / Puppet), and reporting systems for best results 26

Best Practices Continued Focus patching on those things that will hurt you most Select a VM/CM solution with strong APIs, integration, and that limits resources spent on system administration Learn to speak the language of Ops staff / Ensure VM/CM data are reported in the most useful format 27

Question and Answers 28

@jonathantrull Government Series Webcasts: More Resources: Qualys Top 4 Security Controls Qualys Free Tools and Trials Cyber Hygiene Toolkits