Agenda - September 24

Vulnerability Management has become an important business-critical function to help companies better understand their risk exposure across a vast landscape of attack vectors while managing vulnerabilities from their birth to their final remediation.

 

Often times vulnerability management programs have difficulty identifying assets, detecting, and managing vulnerabilities because of a lack of understanding of the direct and adjacent dependencies that are not well-defined across the company’s ecosystem to allow for the orchestration of people, process, and technology to govern the vulnerability management life cycle across those traditional IT towers.

 

The lack of well-defined vulnerability management relationships across traditional and siloed IT towers often creates an unmanageable backlog of vulnerabilities due to missing asset ownership identification, which ultimately hinders remediation assignment and final resolution.

 

In efforts to deal with this challenge, the NIST Cyber Security Framework (CSF) can be utilized to push companies left, to action the “right” way by “Identifying” assets to “Detect” their vulnerabilities to “Protect” by prioritizing risk using weaponized intelligence and asset attributes to “Respond” by having that foundation to create high fidelity campaigns, that allows for “Recovery” using governance and oversight for continual improvement.

 

The “Identify”, “Detect”, and “Protect” functions can be shifted to the left to concentrate on proactive activities of device activation and asset normalization to stop the bleeding of unknown assets being built with outdated images, while changing the culture to ensure all assets are identified with network location, asset criticality, and system ownership. The “Detect” function can be used to interrogate the company’s digital ecosystem to understand technology stacks (e.g., IT, OT, IoT & IoE) and their system components (e.g., operating system, application, database, & more) to address which types of scan platforms and modules are required to detect those system components across the technology stacks. Additional focus can be placed on the “Protect” function to move from a severity based (e.g., CVSS) venerated prioritization methodology to a risk-based approach using a combination of weaponized intelligence, network location, and asset criticality to prioritize which vulnerabilities should be first to be remediated.

 

The reactive NIST functions of “Respond” and “Recover” can be integrated with orchestration to assign urgent vulnerability ticket campaigns to attach accountability to downstream remediation teams that allows for the tracking and trending of key risk (i.e., urgent weaponized vulnerabilities) and key performance (i.e., mean time to remediate) indicators. Capitalizing on this layer of accountability, “Governance” can perform oversight to provide focus and assistance by improving process and procedures to align with resources and technology.