Last week, it was reported by SiliconBeat that NASA’s CIO, Renee Wynn, had allowed an Authority to Operate (ATO) for a key network to expire because the network in question had over 15,000 critical vulnerabilities that had not been properly patched. The move was apparently intended to hold the contractor in charge of maintenance of the devices accountable for their contractual obligations by bringing visibility to the situation.
In a recent article on Credit Union Journal, I wrote about how to go beyond risk management to assess vulnerabilities in order to secure your data. It’s important to understand that vulnerability and risk are not the same thing. Risk is the probability of the vulnerability being exploited multiplied by the cost of damage it will cause. This is required for risk evaluation and will help you focus your remediation efforts as well as define compliance boundaries. Vulnerability management is the cyclical practice of identifying, classifying, remediating, and mitigating vulnerabilities especially in software and firmware. It works by analyzing computer systems for known vulnerabilities such as open ports, insecure software configuration, susceptibility to malware, etc.
With bugs like the glibc vulnerability announced nearly every day, it’s important to consider how your organization handles vulnerability management. How do you know which of your critical systems are exposed to which new vulnerabilities? If you had only one server or device to keep track of, you might know all the details of the device’s configurations; which software is running, and which versions are installed. But even then, keeping up with the latest CVE announcements and identifying which of these affect your system may be overwhelming, particularly if maintaining the device is not your only job. If you’re like many of the IT professionals we speak with every day, you’re wearing many hats and fighting constant fires. Therefore, it becomes critical to construct a comprehensive vulnerability management program to protect your organization. Here are three things every security professional should consider when building a vulnerability management program:
Another day, another update to install—if businesses stay on top of these software patches, are they well defended against cybersecurity threats? Only those who believe in the method known as “patch and pray” would say so. To patch and pray is to simply apply a patch and then hope for the best. But patches often deliver disappointing security performances, and the approach itself produces a fundamental flaw, which means companies should supplement patching with the proactive practice of vulnerability management.