Today, organizations of all sizes face significant challenges due to the increasing number of vulnerabilities in their systems. The National Vulnerability Database, a comprehensive source for vulnerability data, reports over 238,000 cases as of February 2024. Cybersecurity vulnerabilities can lead to severe consequences, including the disruption of critical processes, theft of sensitive information, financial losses and even blackmail.

Therefore, establishing a vulnerability management (VM) process is a crucial part of an organization’s cybersecurity strategy and demands thoughtful planning. Let’s explore how to build this process correctly.

Addressing Vulnerabilities and Management Issues

A vulnerability refers to a defect in information systems that attackers can exploit to disrupt software operations, undermine IT infrastructure integrity and access confidential data. Typically, they stem from mistakes made by developers in using programming languages, configuration errors or system design drawbacks.

Security analysis and the removal of vulnerabilities are emphasized across numerous cybersecurity regulations and standards, highlighting their critical role in maintaining organizational cybersecurity.

For small companies, using a simple scanning tool is sufficient to automate vulnerability detection in their systems. This process involves manually reviewing scan results and assigning remediation tasks to the IT department’s appropriate staff. Generally, this can be managed by a single cybersecurity professional, making it a practical solution for smaller operations.

As your business expands, it acquires more assets, systems and networks, leading to an increase in potential vulnerabilities. This expansion can strain resources, especially if the IT department has a skills shortage.

For big companies with complex IT infrastructures, simply scanning is not enough. Identifying vulnerabilities is just the first step. It is important to address and eliminate them quickly. VM goes beyond simple detection offered by scanners. It enables automated assessment, prioritization and elimination of diverse security weaknesses. In this context, using a DevOps ROI calculator might naturally aid in evaluating the scalability and cost-effectiveness of your VM efforts.

Creating an effective process tailored to an organization’s unique size, activities and needs presents numerous challenges and problems. Here are the most common challenges:

• Managing updates and changes within IT systems and infrastructure.
• Prioritizing vulnerabilities effectively due to their huge number.
• Incorporating measures for vulnerabilities that cannot be immediately fixed.
• Convincing the IT department of the urgency of remediation.
• Finding efficient tools for tracking remediation progress and deadlines.
• Overseeing the VM process and generating reports for management.

This list is incomplete and can vary with each organization’s specific circumstances. Given these challenges, it is vital to prioritize effectively when setting up this process.

Before addressing the listed challenges, it is essential to prepare and sign documents and agreements that detail the scope and objectives of the vulnerability management process. These documents should clearly define the roles and responsibilities of employees involved at each step.

Implementing Comprehensive Vulnerability Management

Establishing a vulnerability management process involves a series of important steps:
1. Taking an inventory of all assets.
2. Identifying any vulnerabilities within those assets.
3. Prioritizing vulnerabilities based on their potential impact.
4. Addressing and fixing vulnerabilities.
5. Continuously monitor and control your systems for new vulnerabilities.

Below, I will share practical tips for each phase of the VM life cycle to streamline and improve the efficiency of your cybersecurity measures.

1) Inventory
The initial step for any organization is to determine what assets it needs to protect. This involves carrying out an inventory and categorizing all assets, such as servers, computers and network equipment.

Asset information can come from IT infrastructure monitoring systems or configuration management database (CMDB) solutions. These are software tools designed to keep track of an organization’s IT assets.

Fully covering the company’s infrastructure is vital because any gaps here can leave essential systems vulnerable to hacker attacks. It is also important to consider the different stages of an asset’s lifecycle, such as when they are decommissioned, to get a comprehensive overview of all asset types.

Many companies operate outdated systems. For example, ATMs often run on old Windows systems. IT leaders must find solutions for updating legacy technologies for improved security and user experiences. It is also important to be aware of shadow IT, as these unofficially used devices and software can introduce further security vulnerabilities.

After completing your asset inventory, you are advised to develop a kind of resource space model (RSM) for the company’s assets. You should group the identified assets and assign a responsible party covering both equipment and software. Then, link these assets to specific departments and the business processes they support, as well as to the intangible assets involved in your company’s IT and information security frameworks.

At this stage, it is essential to assess the importance of each asset. Understanding which assets are most critical will help prioritize and focus efforts on fixing the most significant vulnerabilities.

2) Identification
Identification involves finding and analyzing potential vulnerabilities in a system. This can be done using scanners that examine networks, operating systems, connected devices and ports. They also analyze active processes and running applications, generating reports detailing any flaws discovered.

Alternatively, information security experts can manually search for vulnerabilities, which may include conducting team security assessments like penetration testing or red teaming. The process is ongoing and demands regular execution.

This ensures that the data on infrastructure vulnerabilities remains current and at an acceptable level.

Once information about vulnerabilities across all company assets has been gathered, the next question arises: What is the best order in which to address them?

3) Prioritization
There are various approaches to prioritizing vulnerabilities. Currently, the most widely used methodology is CVSS scoring, which is available in most vulnerability sources by default.

The CVSS standard offers both advantages and disadvantages. One of its strengths is the simplicity of ranking vulnerabilities by their rating value, which considers factors like attack vectors, exploit difficulty and system impact.

However, many data providers only supply basic metrics, lacking support for ongoing assessment updates. Consequently, the initially assigned rating often remains unchanged, even after the publication of exploits. This limitation undermines the reliability of CVSS, making it necessary to view it as a source of information about the potential severity of a vulnerability rather than relying on it entirely.

At the same time, other vulnerability prioritization methods include parameters that are challenging to evaluate. Consequently, when establishing vulnerability management, many companies primarily lean on basic prioritization strategies:
• Addressing only critical vulnerabilities
• Fixing vulnerabilities for which there are public exploits
• Fixing vulnerabilities affecting the most crucial assets

The choice of prioritization methods depends on the company’s existing processes and regulations. This yields a database of vulnerabilities with assigned ratings organized by assets, software or asset groups.

4) Elimination
Typically, information security specialists handle cyberthreat defense within an organization, while the IT department is tasked with addressing vulnerabilities. Therefore, fostering effective collaboration between the IT and information security departments is important for implementing measures to eliminate or mitigate identified vulnerabilities.

Information security specialists can assign tasks to the IT department for vulnerability remediation either manually or automatically. The scope of tasks often depends on the individual responsible for addressing the security gaps. This could be an IT specialist overseeing the information system or a dedicated employee managing Linux, Windows servers and network equipment. Once the information security team identifies vulnerabilities, the assigned employee begins the remediation process. This may involve installing patches/updates, implementing mitigation measures, or skipping the vulnerability and accepting the risk associated with the attack technique if the severity level is low.

Once a list of vulnerabilities to be addressed is generated, each vulnerability undergoes processing stages. Therefore, those in charge of IT should coordinate with information security specialists on how to proceed with this process.

The initial step involves assessing the relevance of the vulnerability to the specific information system. It may be labeled as a false positive if it is deemed irrelevant. Conversely, if the vulnerability is relevant, a decision must be made on whether to update the software or identify reasons why this cannot be done.

For most information systems, there is typically a stage involving the analysis of security updates. This process involves installing patches in a test environment and subsequently verifying whether the system continues to function properly.

If critical issues arise during the update installation or if patches are unavailable, I recommend implementing the following compensatory measures:
• Adjusting the settings of vulnerable components within the information system.
• Restricting the use of vulnerable software and equipment.
• Ensuring redundancy of servers and network equipment.
• Monitoring security events related to potential vulnerability exploitation within the information system.
• Installing additional security measures, such as a firewall or antivirus solutions.
• Considering virtual patching.

Once all tasks to address vulnerabilities have been completed, each should be assigned an appropriate status.

5) Continuous Monitoring and Control
The monitoring process is designed to assess the extent to which IT professionals have completed all assigned tasks to address vulnerabilities or implement compensatory measures. It also aims to evaluate the effectiveness of the vulnerability management process and identify opportunities for improvement.

I suggest verifying the elimination of vulnerabilities through repeated scanning and manual attempts to exploit the host. Additionally, integrating automatic document generation to enable the creation of periodic reports on assets, networks, or tasks is an integral part of the control stage.

Budget-Friendly Vulnerability Management Strategies

Improving cybersecurity may come with a price tag, but the cost of incidents often surpasses it. For companies operating on tight budgets, finding financial opportunities to establish a vulnerability management process is crucial yet challenging. One avenue to explore is leveraging free or open-source vulnerability scanning tools, which can provide basic functionality for identifying vulnerabilities without significant financial investment.

Additionally, organizations can seek partnerships or collaborations with cybersecurity firms or academic institutions offering pro bono or discounted vulnerability assessments and remediation services.

Furthermore, allocating resources toward employee training can enhance internal capabilities for vulnerability management without incurring substantial costs. Moreover, companies can consider invoice factoring as a means to improve cash flow or internal reinvestment of profits into cybersecurity infrastructure and personnel, ensuring that financial resources are allocated efficiently.

Conclusion

Vulnerability management is a continuous and essential process that directly influences the security level of a company. Ensuring effectiveness at each stage of the VM life cycle enables the identification and elimination of potential issues before they escalate into significant threats to the business.