2. WEBINAR Exterminate Your Bugs With Vulnerability Management
Rick Holland, Principal Analyst
Kelley Mak, Researcher
June 11, Call in at 10:55 a.m. Eastern time

4. Image source: Flickr (https://www.flickr.com/)

5. Image source: Flickr (https://www.flickr.com/)

6. Agenda
The struggle is real.
The threat landscape doesn’t help.
Re-evaluate vulnerability management.
You need continuous monitoring.
Exploring the vulnerability management market

7. All aboard the struggle bus

9. But compliance . . .

10. Too many vulnerabilities, not enough time

11. Get your priorities straight!
Image source: YouTube (

12. CVSS only? SMH Results from the study:
94% to 95% of vulnerability should be skipped.
Patching high/medium with exploits in exploit kits (Metasploit) improves efforts by 62.81%.
Patching high/medium with proof-of-concept exploits from white hats improves efforts by 19.64%.
Patching just high/medium improves efforts by 3.2%.

13. Image source: National Vulnerability Database (https://nvd.nist.gov/)

14. We are supposed to be a unit
Image source: Flickr (

15. But what should we be worried about?

16. The age of the customer
A 20-year business cycle in which the most successful enterprises will reinvent themselves to systematically understand and serve increasingly powerful customers

17. The age of the customer
Source: October 10, 2013, “Competitive Strategy In The Age Of The Customer” Forrester report

18. Breach costs continue to rise
23%
Increase in the total cost of a data breach
$3.7 million
Average total cost of a data breach
Source: “2015 Cost of Data Breach Study: Global Analysis,” Ponemon Institute, May 2015

19. Targeted attacks outpace broad attacks
Image source: CyberFactors (

20. There’s a bug in your pocket
Employees work outside of the corporate at least a few times a month.
61%
43%
31%
Source: Forrester’s Global Business Technographics® Telecommunications And Mobility Workforce Survey, 2015

21. Don’t let your cloud drift away
Configuration management
Governance

22. Hyperconnected IoT increases risks
Thin g
Thing 3 1 2

23. The vulnerability management life cycle

24. Traditional vulnerability scanning
Tactical and little value
Vulnerability counting
Infrastructure focus
Checkbox security
Image source: Flickr (

25. Discover
What should I scan?
How often?
How about credentialed scans?

26. It’s all about the data!
Do you know what your high-risk data (and assets) are?
If you cannot triage based off data value, you will have a garbage-in/garbage-out scenario.

27. Data security and control framework
Source: June 5, 2014, “The Future Of Data Security: A Zero Trust Approach” Forrester report

28. No more scanning in silos
Complete picture
Infrastructure
Database
Web application

29. Assess How do I make sense of this information? How do I prioritize?
How does this relate to my organization?

30. Forrester’s Prioritized Patching Process (P3)
Source: November 11, 2013, “Introducing Forrester’s Prioritized Patching Process (P3)” Forrester report

31. Report How do I communicate these results?
How do I work with my counterparts in the organization?

32. Reduce the friction Communication Automated workflow
Ticketing systems
Validation scanning
Collaboration tools

33. Image source: Flickr (https://www.flickr.com/)

34. Remediate What are the target metrics for remediation?
What constitutes a successful VM program?

35. Track what matters You can’t manage what you don’t measure.
Track effort required for the operation of the VM solution as well as operational remediation.
During post incident after action reviews, reconcile the VM program policies associated with compromised assets.
Base metrics upon priority of asset.
Tie it back to the business.

36. Validate
What’s next?
Am I done?

37. Adopt continuous monitoring
Don’t think of CM as a requirement for federal agencies. CM is real-time visibility into the risks of your company’s assets.
Move beyond snapshot/periodic assessment of risk.
Evaluate continuous monitoring options, whether passive or agent- based.

38. The scanner days are behind us . . .
Vulnerability management market trends:
Scanners are commoditized.
Vendors are collapsing the scanning stack.
To vulnerability management and beyond!
Vulnerability management needs to address the new digital age.

39. Integration and orchestration
Source: January 7, 2015, “Forrester’s Targeted-Attack Hierarchy Of Needs: Assess Your Core Capabilities” Forrester report

40. Attack path modeling
These tools help S&R pros map network topology to understand vulnerable systems based on attack paths within the environment.
Example vendors: Core Security, RedSeal Networks, and Skybox Security

41. Governance, risk, and compliance
Integration with GRC platforms brings enriched business context, workflow, and risk analysis.
Example vendors: RSA Archer, LogicManager, Modulo Security, and Rsam

42. Remediation automation
Workflow tools help S&R and I&O pros communicate and close the loop on vulnerabilities.
Example vendors: BMC Software and ServiceNow

43. Penetration testing
Incorporate the results of penetration testing into your vulnerability management.
Commercial products: Core Security (Core Impact), Immunity (Canvas), and Rapid7 (Metasploit)
Consulting services: Digital Defense, NopSec, and Synack

44. Key criteria for evaluating VM
Evaluation criteria
Network device coverage
Asset discovery and classification
Vulnerability information
Distributed scanning and scalability/flexibility
Mobile/cloud scanning
Application-level scanning
Unified infrastructure with web application and database scanning
Prioritization
Deployment models
Remediation and integrations
Administration and reporting

45. Next steps: Optimize remediation
Know your data.
Identify and protect your toxic data. Implement data discovery and data classification. Understand the business.
Know your adversary.
Focus efforts on areas that deserve the most attention based on adversary intelligence.
Look at managed services.
Managed services can lift the burden off of security operations. Leverage managed services for IT operations if a relationship is already there.

46. Rick Holland
Kelley Mak