Information Security Management: Module 5
Vulnerability Management
Learn about vulnerability management and some resources that ranks and lists these vulnerabilities.
Estimated reading time
18 minutes
What is vulnerability management?
According to Rhodes, vulnerability management is a thorough process in order to continuously maintain an organisation's vulnerabilities. It is important because reducing vulnerabilities is the best way to lower risk and mitigate chances of attackers exploiting the system.
Common information security vulnerabilities
- Flaws in the design and testing of technology
- Poor implementation of hardware or software
- Lack of rules or gaps in business policies or processes
- Lack of user training and awareness
- Physical or environmental factors
Common Vulnerability Scoring System (CVSS)
This framework was created by the non-profit organisation Forum of Incident Response and Security Teams (FIRST) to characterise and classifies these vulnerabilities. The CVSS has three sets of metrics: base, temporal and environmental. The base metrics has two sets of metrics: exploitability and impact. However, the CVSS base impacts do not consider organisational impact. The results of the scoring system ranges from 0 to 10.
Common Vulnerabilities and Exposures (CVE)
Created and maintained by MITRE, this is a public list of cybersecurity vulnerabilities. They also set the standards for naming the software vulnerabilities.
The US National Vulnerability Database (NVD)
This database is created by NIST and contains CVE-identified software vulnerabilities. It also has advanced search features that allow users to search by product name, version and even search by vulnerability type and severity.
The vulnerability management process
- Maintaining asset inventories for hardware and software
- Establishing secure configurations
- Maintaining awareness of new vulnerabilties and detecting them
- Mitigating and remediating identified vulnerabilities
- Continuously monitoring the organisation's environment
Maintaining an asset inventory
Maintaining both a hardware and software inventory is the most essential step because it is difficult to protect something you do not know. Identifying the asset that needs protection, where it is and its current state must be done first before vulnerability management can begin.
Some important questions to ask are
- Is the asset vendor still supported?
- What is the asset's current patch status?
- What is the asset's current configuration?
Establishing secure configurations
This phase is for establishing which configurations should be hardened and in what way should they be done. This helps reduce vulnerabilities and makes patching them easier.
Maintaining awareness and detecting vulnerabilities
While being aware of vulnerabilities can be challenging since there is a lot of information on them, vulnerability management tools can help since they provide a summary of the information out there. They can also find vulnerabilities in assets as well.
Mitigating and remediating identified vulnerabilities
Vulnerabilities can be resolved by either applying patches to fix the defect or changing configurations to improve security. These patches should be tested before they are deployed. Vulnerabilities could also be managed to lessen the severity through blocking access or disabling services. However, the latter option is only a temporary fix until a better solution is applied.
Continuously monitoring the environment
Changes need to be identified often because
- Configuration changes occur frequently
- New systems get installed
- New vulnerabilities will be found from time to time
- Old vulnerabilities that had temporary fixes can still be exploited