什麼是漏洞管理？

Vulnerability management is the continual process of assessing, identifying, managing, remediating, and reporting security vulnerabilities across endpoints, systems, and workloads. Generally, vulnerability management tools help the security team detect vulnerabilities and use different processes to remediate or patch them.

However, a powerful management program employs the knowledge of IT, business operations, and threat intelligence to prioritize vulnerabilities and risks as quickly as possible.

Is There Any Difference Between A Risk, Vulnerability, Or Threat?

According to the International Organization for Standardization (ISO), a vulnerability can be defined as a weakness of an asset or group of assets triggered by one or more threats.

On the other hand, a threat is anything that can capitalize on a vulnerability.

And lastly, risk occurs when a threat triggers vulnerabilities. It is usually damage that can happen when an open vulnerability is exploited by a threat.

Categories and Ranking of Vulnerabilities

Popular cybersecurity organizations use the Common Vulnerability Scoring System (CVSS) to communicate and assess the characteristics and severity of software vulnerabilities. Ideally, the CVSS base score has a range of 0.00 to 10.0 but, the National Vulnerability Database (NVD) added severity ratings to each CVSS score. The v3.0 of the CVSS scores and its associated ratings are as follows:

CVSS Score Severity Rating

• 0.0 – None
• 0.1-3.9 – Low
• 4.0 -6.9 – Medium
• 7.0-8.9 – High
• 9.0-10.0 – Critical

In addition, NVD provides a routinely updated library that houses common vulnerabilities and exposures (CVEs), providing the ranking of each vulnerability and other associated information, which includes: product name, vendor, version, etc. The list of Common Vulnerability Exposures originated from the MITRE Corporation. This corporation is a non-profit organization that began documenting CVEs in 1999. It is automatically synced with NVD and provides basic information about each vulnerability.

What are the differences between Vulnerability Assessment and Vulnerability Management?

Vulnerability assessment is not the same as vulnerability management; vulnerability management is a recurring process whereas vulnerability assessment is a one-time evaluation of a network or host. Hence, vulnerability assessment is a step in the vulnerability management process.

The stages in the Vulnerability Management Process

Vulnerability programs adhere to different stages of the vulnerability management process. However, the methods are mostly the same even though the terminology varies, but there are other ways to define each step in the process.

Preparation for a Vulnerability Management Program

According to Gartner’s Vulnerability Management Guidance framework, there are five preparation steps before commencing the process. They are:

• Step 1: Ascertain the Scope of the program
• Step 2: Illustrate Roles and Responsibilities
• Step 3: Choose Vulnerability Assessment Tools
• Step 4: Generate and Refine Policy SLAs
• Step 5: Identify context resources and asset

The primary role of this preparation stage is to measure and assess current processes, tools, and resources to identify gaps.

During this preparation, also known as the pre-work stage, security professionals need to ask questions that will help understand the scope of your program. Examples of such questions are:

• Which hosts or assets are most vital to protect?
• What are the assets needed to be measured for vulnerabilities?
• Who will manage such a program? What are their roles and responsibilities?
• What policies or service level agreements (SLAs) do we need to define? How often should an asset be assessed for weak points or vulnerabilities?
• What are the lists of the assets we plan to cover? 
• What are the necessary tools needed to effectively scan or manage our hosts

Once you provide answers to these questions, begin to implement the vulnerability management process.

The 5 steps of the Vulnerability Management Cycle

1. Assess
2. Prioritize
3. Act
4. Reassess
5. Improve

What to look for in Vulnerability Management Solutions

The primary responsibility of a vulnerability manager is to manage exposure to the known vulnerabilities. However, vulnerability management involves more than running a mere scanning tool. A high-quality and efficient toolset is needed to dramatically improve the implementation and the continuous success of any vulnerability program.

There are many options and solutions in the market claiming surpassing qualities, but if you want the best in a vulnerability management solution, here is how to evaluate your options:

Agent size impacts your endpoint performance: More than ever, the major vulnerability vendors in the marketplace lay claims of providing agent-based solutions. Sad to say, most of these agents are bulky, and choosing a bulky tool has an impact on your endpoint’s performance. Hence, before selecting any agent-based tool, make sure you are going for a lightweight agent because it consumes very little space on an endpoint and will minimize the effect on your productivity.

Pay attention to timeliness: One of the vital characteristics of any vulnerability management tool is to detect vulnerabilities in a timely manner. If a tool can’t detect a vulnerability earlier on, it isn’t very useful because it doesn’t contribute to overall protection. A ubiquitous tool that falls under this categorization is the network-based scanner. It takes a long time to complete a scan, using up the organization bandwidth and, in the end, producing outdated information. To avoid this, choose a tool that doesn’t rely on a network but on a lightweight agent.

Immediate and thorough visibility is critical: For maximum security, you should know and see what is vulnerable instantly. Unfortunately, legacy vulnerability tools can hamper your visibility – bulky reports provide little to no help addressing vulnerabilities promptly, scans take a long time and provide outdated results, and bloated agents slow business productivity. The best solution is a scanless technology that allows your team to interact with data in real-time. A scanless technology is always running, identifying vulnerabilities and constantly looking for weaknesses.

For maximum security, organizations no longer need a complicated set of solutions and security tools that requires specialized skills or personnel. Instead, they rely on an integrated platform that provides them with vulnerability management tools and other security tools for detecting threats.

If you need help with scanless vulnerability assessment or vulnerability management, Vicarius is the ideal software to use. Vicarius is a vulnerability management software that targets cybersecurity officers as well IT managers and operators from the U.S. market.

Photo by Christina @ wocintechchat.com on Unsplash