Steps for Successful Vulnerability Management: Lessons from the Pitch

When I was younger, I played a variety of team sports and enjoyed competing against opponents with my teammates. Winning was always a matter of applying sound tactics and strategy, attacking and defending well and using a blend of skill, talent and luck.

Now that I'm older, I watch more than I play, and I'm able to appreciate the many lessons team sports teach, especially at the professional level. With sports, we can tackle technical topics in a relatable way. In this post, I take on vulnerability management (VM). The key word here being "management," an active and continuous approach to dealing with risk. Like the dynamic action of a ball on the field, vulnerability management is something that is always changing and rarely predictable. It also requires active participation.

There is an aphorism in sports that defense wins championships. While there is some debate about this in the sporting world, defending the enterprise against a data breach is a required business practice. Continuous vulnerability management is number seven in the CIS critical security controls – it contributes to the defense that wins business.

Framing the Challenge

To understand vulnerability management, it helps to have a common definition of vulnerability. A misconception about this term is that it is monolithic and binary. How often have we heard someone say, "We need to patch a vulnerability"? This framing is dangerous as it assumes a vulnerability is a singular thing that can be fixed and forgotten. Shifting the focus to what we want to protect rather than any specific weakness changes the question to "how vulnerable are we?" In other words, "how likely is it that a threat can cause harm to my critical asset?"

Soccer offers a good analogy: the critical asset is the goal, and the threat is the opposing team attempting to score. The goal is always vulnerable to attack; it is less vulnerable when there are defenders and a goal keeper and more vulnerable when those people are absent (which doesn't mean an attacker can exploit that vulnerability, it's just more likely).

Managing vulnerabilities is the process of decreasing the likelihood a threat can cause damage. SANS has developed a simple framework which outlines the steps for successful vulnerability management: Prepare, Identify, Analyze/Assess, Communicate, and Treat (PIACT).

Prepare

In sports, preparation is vital -- practicing, fitness conditioning, studying tactics and strategy are all part of creating a winning team. Vulnerability management is the same -- Identify key assets to protect, determine their level of importance, develop a plan to evaluate their weaknesses and know how to respond when weaknesses are found.

Like a successful sports team, a business team will need to come together to identify critical assets, determine their risk tolerance and determine a plan to identify and treat vulnerabilities. The players are IT and security professionals, systems owners and executive leadership.

With a full team effort, assets can be appropriately classified, and patching and remediation plans won't conflict with business objectives. The team itself is part of the risk management process.

Identify

Identification is the first step of enacting the plan. A football coach needs to know which players are ready for the game, which are injured, and which match up well against an opponent. Similarly, a VM team will be looking to identify which assets need protecting and begin to prioritize them. Which assets have critical uptime requirements? Which hold the most valuable data? Which sit in exposed locations? Every place where critical data are stored or valuable processes occur needs to be identified. This includes cloud, servers, endpoints, and even mobile devices. Access paths to those assets also need to be evaluated as potential points of exposure.

One way to automate this process is through asset discovery. Running a scan to find all the devices with IPs on your network is one way to reconcile (or create) your asset inventory (CIS control number one). This can also become an integral part of the next phase, which is to analyze and assess the environment.

Analyze / Assess

Elite sports teams utilize advanced techniques to analyze the fitness and health of the athletes. There was a story of a Tour de France cyclist who had every aspect of his day managed during the race – when to eat, what to eat, how much, when to drink and when to...everything else. The nutritionists and specialists had studied the cyclist during training to the point that they knew exactly what he needed and when to produce the fastest ride. That same level of rigor needs to be applied to our most critical IT assets when evaluating risk.

Understanding what controls are currently in place, what controls need to be implemented and what impact an exploited weakness would have can help determine an asset's security posture. The assessment results in a prioritization and a recommendation for how to proceed. Performing a risk assessment can be as simple as running a vulnerability scan or as complex as evaluating all the controls affecting the asset. The deeper the analysis, the more complete the view, so doing as much as is reasonable is recommended. A good start would be to evaluate access controls and who has access and then run an authenticated vulnerability scan with something like Fortra's vulnerability management solution and a CIS configuration benchmark with Tripwire Enterprise. This will provide a good start for evaluating the technical control in place.

Communicate

It's tempting to jump right into the "treat" phase at this time. However, that would be a mistake.

Before taking on remediation, it's important to communicate the analysis to the appropriate parties. The assessment phase results in recommendations, prioritization and potential impacts for each asset. Because this entails work from various groups, possible expenditure for tools, and changes in processes, the assessment team needs to present the results to IT operations, system owners, and executive staff. Risk is a business decision, and how to address it is balanced against other strategic goals. Additionally, developing a means to communicate risk posture over time will help fund future efforts and give executive leadership a scorecard to understand the effects of ongoing initiatives.

In the sporting world, think of this as the starting line-up. The specialists and trainers have watched practice all week, and now the manager needs to choose who starts, who is on the bench, and who doesn't make the gameday roster. All teams have more players available than can start, so just like managing IT assets, the head coach needs to decide who gets priority and who doesn't. And that brings us to game day.

Treat

Ultimately, this is the outcome of vulnerability management. Reduce the risk by treating the weaknesses. Like vulnerability management itself, this is a continuous process, not a single event. This may mean putting in patching processes and policy, updating practices such as change control, and running regular scans and assessments to ensure the appropriate controls are in place and are functioning well.

Then the cycle starts over again.

Train, play, compete week in and week out all season and maybe win a championship. And when the season is over, another season is right around the corner. With vulnerability management, it's no different – stay one step ahead of the adversary and play to win.

Looking for Help in Vulnerability Management?

Fortra can be part of your vulnerability management team. With Tripwire ExpertOps, we can provide you with the tools and expertise to jump start your vulnerability management program. If you need the skills and would like someone else to manage administer your security toolset, it's the perfect choice.

For those who have the skills and would like to manage it themselves, Fortra's Tripwire has a suite of vulnerability management, file integrity management, and secure configuration management tools as well as professional services for all industries. Tripwire is ready to be part of your security team!