Automation key to vulnerability management, CISA says

ArtemisDiana/Getty Images

By Susan Miller,
Deputy Editor, Route Fifty

Connecting state and local government leaders

By Susan Miller

| November 14, 2022

By automating vulnerability disclosure, organizations can more easily categorize their exposure and limit impacts.

automation

To help organizations better manage cybersecurity vulnerabilities, the Cybersecurity and Infrastructure Security Agency issued guidance to “reduce the window that our adversaries have to exploit American networks,” CISA Executive Assistant Director for Cybersecurity Eric Goldstein wrote in a Nov. 10 blog post.

Three strategies could help large enterprises with mature vulnerability management programs and the smaller, less-experienced organizations—like local governments that may have limited resources—prioritize remediation.

The first recommendation is increasing automation and expanding the use of machine-readable security advisories that are based on the Common Security Advisory Framework. Vendors that use CSAF—a standard format for disclosing and ingesting vulnerability advisories—will help organizations much more quickly determine a flaw’s impact and how to address it.

The second strategy involves more widespread use of the Vulnerability Exploitability eXchange (VEX), another automated security advisory that allows vendors to document whether or not their product is affected by a specific vulnerability.

Finally, CISA advocates greater use of vulnerability management frameworks, like the Stakeholder Specific Vulnerability Categorization (SSVC), which considers a vulnerability’s exploitation status. It also advises organizations build a catalog for known exploited vulnerabilities into their security management framework and prioritize issues included in CISA’s KEV catalog.

To help organizations use the SSVC, CISA released an SSVC webpage that includes CISA's SSVC decision tree that will help prioritize a vulnerability based on its exploitation status, technical impact, ability to be automated, mission prevalence and impact on the public well being. A SSVC Guide explaining how to use the scoring decision tree and a calculator for evaluating how to prioritize vulnerability responses have also been released by CISA.

NEXT STORY: Cyber range looks to inspire next generation of talent

This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. / Do Not Sell My Personal Information

Accept Cookies