Security fundamentals: Vulnerability management

Security practitioners agree that foundational controls have the biggest impact on security. Agencies should focus their efforts on four key fundamentals: log management, file integrity monitoring, policy compliance and vulnerability management. In the last of this four-part series, we address vulnerability management.

Any discussion around security controls needs to start with an understanding of the objectives of that control. Without clear objectives, we tend to implement tools that are ineffective, and then wonder why they didn’t work. Vulnerability management is fundamentally about risk reduction. More specifically, it’s focused on reducing the risk presented by vulnerabilities in an environment.

The Cybersecurity Executive Order provides a clear description of why vulnerability risk is important: “Known but unmitigated vulnerabilities are among the highest cybersecurity risks faced by executive departments and agencies.” It’s important to have that context because vendors always want to expand the capabilities they can offer, and it’s easy to see how the scope of a vulnerability management program can increase based on what the tools can do, rather than on actual objectives. This logic goes both ways, of course. That tool that a vendor claims delivers vulnerability management may not, in fact, be enough for an agency to meet its vulnerability management goals. Odds are, it’s not. 

Vulnerability management and compliance

Compliance requirements often can be a strong budget driver, and that’s true for vulnerability management as well. It’s important to consider that compliance may have a different objective from the vulnerability management program itself. Passing an audit is not the same as reducing vulnerability risk. If compliance is part of an organization’s drive for vulnerability assessment tools, being crystal clear on the objectives can help avoid headaches down the road. The reality is that meeting the compliance requirements doesn’t often require a full vulnerability management program.

That does not mean that agencies shouldn’t actively implement vulnerability management or assessment tools as part of a compliance program. For example, Department of Defense agencies that are subject to Command Cyber Readiness Inspection audits will need a vulnerability assessment tool for audit preparation. Understanding which assets are on the network, their vulnerabilities and which to fix first is a crucial part of CCRI preparation.

Vulnerability management is a process

It may seem obvious that there’s no single tool that delivers vulnerability management, but it’s still a common misconception agencies have. The process of reducing risk from vulnerabilities is just that: a process. There are tools that make that process substantially more efficient, but they don’t replace the need for the process or the people to run that process. It’s entirely possible to create a complex workflow diagram for the vulnerability management process, but at its core there are really three steps.

Discovery. The process starts by finding existing vulnerabilities and, by extension, checking all of the assets on which those vulnerabilities might reside. The most common method of doing so is with a vulnerability assessment tool, but there are environments where assessments are still done manually because scanning simply isn’t possible. The least efficient method of performing vulnerability discovery is through exploitation. Penetration tests are valuable, but they’re not a tool for vulnerability, or asset, discovery because they’re generally scoped to a more narrow objective than ‘find all the vulnerabilities.’ The output of discovery is some kind of inventory of assets and vulnerabilities.

Reporting.  To take action on that inventory, agencies need reporting tools. A simple report might just be a list of vulnerabilities found, but in most cases, there must be some method of prioritization for both the vulnerability and the sensitivity of the asset on which it resides. The most important aspect of any vulnerability scoring system is that it effectively enables an organization to take meaningful risk-reduction action. Every agency is different, and different scoring systems are variably successful at getting remediation work done. Of course, there’s no rule that a tool can only support a single system for representing vulnerability risk. Agencies have multiple audiences, so multiple scoring systems may be required. In civilian agencies, for example, the Department of Homeland Security's Continuous Diagnostics and Mitigation program may determine what and how vulnerabilities are reported up through the dashboard, but there can be additional considerations that drive action at the program and agency level. 

Remediation. Many vulnerability management programs stop after the first two of these three steps and consider themselves successful, but unless meaningful remediation is part of the equation, agencies haven’t accomplished the core objective of a vulnerability management program: reduction of risk. The challenge is that remediation  is the most diverse, most complicated step. There’s no single tool that delivers remediation. Different groups within an organization will have different tools. Different platforms will have different tools. Applying a patch isn’t always possible and often involves testing before deployment (more tools, more processes). The key objective of a vulnerability management process is connecting the prioritized reporting of vulnerabilities to the most successful workflow. “Most successful” doesn’t always mean perfect, of course.

For any organization, these three core steps are the starting point for a successful vulnerability management program. Each of them can be expanded into organization-specific workflows but leaving any one of them out will limit an agency's success at risk reduction.